@vritti/api-sdk 0.3.7 → 0.3.9

package/dist/decimal.d.cts

@@ -1,3 +1,4 @@
 export { default } from 'decimal.js';
 import 'drizzle-orm';
 import 'lodash';
+import 'pluralize-esm';

package/dist/decimal.d.ts

@@ -1,3 +1,4 @@
 export { default } from 'decimal.js';
 import 'drizzle-orm';
 import 'lodash';
+import 'pluralize-esm';

package/dist/pluralize.cjs

@@ -0,0 +1,41 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/pluralize.ts
+var pluralize_exports = {};
+__export(pluralize_exports, {
+  pluralize: () => import_pluralize_esm.default
+});
+module.exports = __toCommonJS(pluralize_exports);
+var import_pluralize_esm = __toESM(require("pluralize-esm"), 1);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  pluralize
+});
+//# sourceMappingURL=pluralize.cjs.map

package/dist/pluralize.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pluralize.ts"],"sourcesContent":["// Re-export pluralize-esm's default export as the subpath entry point\nexport { default as pluralize } from 'pluralize-esm';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;AACA,2BAAqC;","names":[]}

package/dist/pluralize.d.cts

@@ -0,0 +1 @@
+export { default as pluralize } from 'pluralize-esm';

package/dist/pluralize.d.ts

@@ -0,0 +1 @@
+export { default as pluralize } from 'pluralize-esm';

package/dist/pluralize.js

@@ -0,0 +1,6 @@
+// src/pluralize.ts
+import { default as default2 } from "pluralize-esm";
+export {
+  default2 as pluralize
+};
+//# sourceMappingURL=pluralize.js.map

package/dist/pluralize.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pluralize.ts"],"sourcesContent":["// Re-export pluralize-esm's default export as the subpath entry point\nexport { default as pluralize } from 'pluralize-esm';\n"],"mappings":";AACA,SAAoBA,WAAXC,gBAA4B;","names":["pluralize","default"]}

package/dist/storage.cjs

@@ -22,11 +22,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var storage_exports = {};
 __export(storage_exports, {
   BucketUsageReader: () => BucketUsageReader,
-  OrgStorageProvisionerFactory: () => OrgStorageProvisionerFactory,
   R2BucketProvisioner: () => R2BucketProvisioner,
   R2StorageProvider: () => R2StorageProvider,
   StorageFactory: () => StorageFactory,
-  orgBucketNames: () => orgBucketNames,
   readConfigSource: () => readConfigSource
 });
 module.exports = __toCommonJS(storage_exports);
@@ -298,17 +296,9 @@ var R2StorageProvider = class _R2StorageProvider {
 };
 
 // src/storage/provisioners/r2-bucket.provisioner.ts
-var import_node_crypto = require("crypto");
 var import_common22 = require("@nestjs/common");
 var CF_API = "https://api.cloudflare.com/client/v4";
 var BUCKET_ITEM_WRITE = "Workers R2 Storage Bucket Item Write";
-function orgBucketNames(subdomain) {
-  return {
-    storageBucket: `org-${subdomain}`,
-    storagePublicBucket: `org-${subdomain}-public`
-  };
-}
-__name(orgBucketNames, "orgBucketNames");
 var R2BucketProvisioner = class _R2BucketProvisioner {
   static {
     __name(this, "R2BucketProvisioner");
@@ -321,84 +311,6 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     this.config = config;
     this.jurisdiction = config.jurisdiction ?? "default";
   }
-  // Creates the org's two buckets and one credential scoped to just those buckets
-  async provisionOrg(subdomain) {
-    const names = orgBucketNames(subdomain);
-    await this.createBucket(names.storageBucket);
-    await this.createBucket(names.storagePublicBucket);
-    let publicUrl = null;
-    try {
-      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);
-    } catch (error) {
-      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);
-    }
-    const token = await this.createScopedToken(subdomain, [
-      names.storageBucket,
-      names.storagePublicBucket
-    ]);
-    return {
-      provider: "r2",
-      accountId: this.config.accountId,
-      bucket: names.storageBucket,
-      publicBucket: names.storagePublicBucket,
-      publicUrl,
-      accessKeyId: token.id,
-      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is
-      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.
-      secretAccessKey: (0, import_node_crypto.createHash)("sha256").update(token.value).digest("hex"),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole
-  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.
-  //
-  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org
-  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.
-  async rotateCredential(subdomain, buckets) {
-    const token = await this.createScopedToken(subdomain, [
-      buckets.storageBucket,
-      buckets.storagePublicBucket
-    ]);
-    return {
-      accessKeyId: token.id,
-      secretAccessKey: (0, import_node_crypto.createHash)("sha256").update(token.value).digest("hex")
-    };
-  }
-  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must
-  // have emptied them first — a 'not empty' failure here means that step did not finish.
-  async deleteOrgBuckets(buckets) {
-    for (const bucket of [
-      buckets.storageBucket,
-      buckets.storagePublicBucket
-    ]) {
-      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {
-        method: "DELETE",
-        headers: {
-          Authorization: `Bearer ${this.config.adminToken}`
-        }
-      });
-      const body = await response.json();
-      if (body.success || body.errors?.some((e) => e.code === 10006)) {
-        this.logger.log(`Deleted bucket ${bucket}`);
-        continue;
-      }
-      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);
-    }
-  }
-  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id
-  async deleteCredential(accessKeyId) {
-    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {
-      method: "DELETE",
-      headers: {
-        Authorization: `Bearer ${this.config.tokensToken}`
-      }
-    });
-    const body = await response.json();
-    if (!body.success) {
-      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);
-    }
-    this.logger.log(`Revoked storage credential ${accessKeyId}`);
-  }
   // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile
   async createBucket(name) {
     const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {
@@ -423,9 +335,25 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     if (body.errors?.some((e) => e.code === 10004)) return;
     throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);
   }
-  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as
-  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into
-  // this same field.
+  // Deletes one bucket. R2 refuses to delete a bucket that still holds objects, so the caller must have emptied it
+  // first — a 'not empty' failure here means that step did not finish. A missing bucket counts as success.
+  async deleteBucket(name) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${name}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.adminToken}`
+      }
+    });
+    const body = await response.json();
+    if (body.success || body.errors?.some((e) => e.code === 10006)) {
+      this.logger.log(`Deleted bucket ${name}`);
+      return;
+    }
+    throw new Error(`Cloudflare bucket delete failed for ${name}: ${this.describe(body)}`);
+  }
+  // Turns on the bucket's Cloudflare-managed domain and returns its https URL. NOTE: r2.dev is rate limited and
+  // documented as non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer,
+  // and drops into this same field. Throws on failure; the caller decides whether that is fatal.
   async enablePublicAccess(bucket) {
     const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {
       method: "PUT",
@@ -444,10 +372,11 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     this.logger.log(`Enabled public access for ${bucket} \u2192 ${body.result.domain}`);
     return `https://${body.result.domain}`;
   }
-  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a
+  // Mints an ACCOUNT-owned token that can only touch the named buckets. Account-owned rather than user-owned so a
   // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the
   // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.
-  async createScopedToken(subdomain, buckets) {
+  // `name` is the token's display label; the value is returned by R2 exactly once.
+  async createScopedToken(name, buckets) {
     const permissionGroupId = await this.resolveBucketItemWriteGroupId();
     const resources = Object.fromEntries(buckets.map((bucket) => [
       `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,
@@ -460,7 +389,7 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
-        name: `org-${subdomain}`,
+        name,
         policies: [
           {
             effect: "allow",
@@ -476,11 +405,25 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     });
     const body = await response.json();
     if (!body.success || !body.result?.value) {
-      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);
+      throw new Error(`Cloudflare token create failed for ${name}: ${this.describe(body)}`);
     }
-    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);
+    this.logger.log(`Minted storage credential ${name} scoped to ${buckets.length} bucket(s)`);
     return body.result;
   }
+  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id
+  async deleteCredential(accessKeyId) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.tokensToken}`
+      }
+    });
+    const body = await response.json();
+    if (!body.success) {
+      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);
+    }
+    this.logger.log(`Revoked storage credential ${accessKeyId}`);
+  }
   // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied
   // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.
   async resolveBucketItemWriteGroupId() {
@@ -503,34 +446,6 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
   }
 };
 
-// src/storage/provisioner.factory.ts
-var OrgStorageProvisionerFactory = class {
-  static {
-    __name(this, "OrgStorageProvisionerFactory");
-  }
-  options;
-  cache = /* @__PURE__ */ new Map();
-  constructor(options) {
-    this.options = options;
-  }
-  // Resolves a provisioner by provider name, constructing it once on first use
-  resolve(provider) {
-    const cached = this.cache.get(provider);
-    if (cached) return cached;
-    const created = this.create(provider);
-    this.cache.set(provider, created);
-    return created;
-  }
-  create(provider) {
-    switch (provider) {
-      case "r2":
-        return new R2BucketProvisioner(readConfigSource(this.options.r2, "r2"));
-      default:
-        throw new Error(`Unsupported storage provider: ${provider}`);
-    }
-  }
-};
-
 // src/storage/storage.factory.ts
 var StorageFactory = class {
   static {
@@ -561,11 +476,9 @@ var StorageFactory = class {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BucketUsageReader,
-  OrgStorageProvisionerFactory,
   R2BucketProvisioner,
   R2StorageProvider,
   StorageFactory,
-  orgBucketNames,
   readConfigSource
 });
 //# sourceMappingURL=storage.cjs.map

package/dist/storage.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/storage/index.ts","../src/storage/bucket-usage.reader.ts","../src/storage/config-source.ts","../src/storage/providers/r2-storage.provider.ts","../src/exceptions/bad-gateway.exception.ts","../src/exceptions/base-field.exception.ts","../src/exceptions/bad-request.exception.ts","../src/exceptions/conflict.exception.ts","../src/exceptions/forbidden.exception.ts","../src/exceptions/gone.exception.ts","../src/exceptions/internal-server-error.exception.ts","../src/exceptions/method-not-allowed.exception.ts","../src/exceptions/not-acceptable.exception.ts","../src/exceptions/not-found.exception.ts","../src/exceptions/not-implemented.exception.ts","../src/exceptions/payload-too-large.exception.ts","../src/exceptions/request-timeout.exception.ts","../src/exceptions/service-unavailable.exception.ts","../src/exceptions/too-many-requests.exception.ts","../src/exceptions/unauthorized.exception.ts","../src/exceptions/unprocessable-entity.exception.ts","../src/exceptions/unsupported-media-type.exception.ts","../src/exceptions/validation.exception.ts","../src/storage/provisioners/r2-bucket.provisioner.ts","../src/storage/provisioner.factory.ts","../src/storage/storage.factory.ts"],"sourcesContent":["export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig } from './bucket-usage.reader';\nexport { readConfigSource, type StorageConfigSource } from './config-source';\nexport { R2StorageProvider } from './providers/r2-storage.provider';\nexport { OrgStorageProvisionerFactory, type OrgStorageProvisionerFactoryOptions } from './provisioner.factory';\nexport { orgBucketNames, R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nexport { StorageFactory, type StorageFactoryOptions } from './storage.factory';\nexport type {\n  ListObjectsPage,\n  OrgBuckets,\n  OrgCredential,\n  OrgStorage,\n  OrgStorageProvisioner,\n  OrgStorageTracking,\n  R2ProvisionerConfig,\n  R2StorageConfig,\n  StorageProvider,\n  StoredObject,\n  UploadParams,\n} from './types';\n","import { Logger } from '@nestjs/common';\n\nconst CF_GRAPHQL = 'https://api.cloudflare.com/client/v4/graphql';\n\nexport interface BucketUsage {\n  bytes: number;\n  objectCount: number;\n}\n\nexport interface BucketUsageReaderConfig {\n  accountId: string;\n  // Account-level token with Analytics Read. NOT the org's scoped S3 credential and NOT the R2 admin token: the\n  // analytics dataset is filtered by accountTag and is not reachable with object-level credentials.\n  analyticsToken: string;\n}\n\n// r2StorageAdaptiveGroups is a time series, so the newest bucketed sample is the closest thing to \"current\". It lags\n// real writes by minutes — fine for a periodic quota check, useless for gating an individual upload.\n//\n// `dimensions { datetime }` is required, not decorative: ordering by a field that is neither aggregated nor selected\n// as a dimension is rejected. Keep the query free of `#` comments too — Cloudflare's parser rejects them.\nconst QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {\n  viewer {\n    accounts(filter: { accountTag: $accountTag }) {\n      r2StorageAdaptiveGroups(\n        limit: 1\n        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }\n        orderBy: [datetime_DESC]\n      ) {\n        max { objectCount payloadSize metadataSize }\n        dimensions { datetime }\n      }\n    }\n  }\n}`;\n\ninterface UsageResponse {\n  errors?: { message: string }[];\n  data?: {\n    viewer?: {\n      accounts?: {\n        r2StorageAdaptiveGroups?: {\n          max?: { objectCount?: number; payloadSize?: number; metadataSize?: number };\n        }[];\n      }[];\n    };\n  };\n}\n\n// Reads how much an org's bucket actually holds, straight from the provider — the authoritative figure a locally\n// maintained counter would only ever approximate.\nexport class BucketUsageReader {\n  private readonly logger = new Logger(BucketUsageReader.name);\n\n  constructor(private readonly config: BucketUsageReaderConfig) {}\n\n  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or\n  // empty bucket produces no rows at all rather than a row of zeroes)\n  async getBucketUsage(bucketName: string, windowHours = 24): Promise<BucketUsage> {\n    const end = new Date();\n    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1000);\n\n    const response = await fetch(CF_GRAPHQL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.analyticsToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        query: QUERY,\n        variables: {\n          accountTag: this.config.accountId,\n          bucketName,\n          start: start.toISOString(),\n          end: end.toISOString(),\n        },\n      }),\n    });\n\n    const body = (await response.json()) as UsageResponse;\n    if (body.errors?.length) {\n      throw new Error(\n        `Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join('; ')}`,\n      );\n    }\n\n    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;\n    if (!sample) {\n      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);\n      return { bytes: 0, objectCount: 0 };\n    }\n\n    // Billed storage is payload plus per-object metadata, so both count against a quota\n    return {\n      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),\n      objectCount: sample.objectCount ?? 0,\n    };\n  }\n}\n","// Config may be a value or a thunk. Servers pass a thunk when the credentials come from required-only-if-selected\n// env keys, so reading them is deferred to the first resolve() instead of running at module construction.\nexport type StorageConfigSource<T> = T | (() => T);\n\n// A backend configured nowhere is a deployment asking for something it was never given credentials for\nexport function readConfigSource<T>(source: StorageConfigSource<T> | undefined, provider: string): T {\n  if (source === undefined) {\n    throw new Error(`Storage provider '${provider}' is not configured.`);\n  }\n  return typeof source === 'function' ? (source as () => T)() : source;\n}\n","import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  ListObjectsV2Command,\n  PutObjectCommand,\n  S3Client,\n} from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Logger } from '@nestjs/common';\nimport { NotFoundException } from '../../exceptions';\nimport type { ListObjectsPage, R2StorageConfig, StorageProvider, UploadParams } from '../types';\n\nexport class R2StorageProvider implements StorageProvider {\n  private readonly logger = new Logger(R2StorageProvider.name);\n  private readonly client: S3Client;\n\n  constructor(private readonly config: R2StorageConfig) {\n    this.client = new S3Client({\n      region: 'auto',\n      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,\n      credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },\n    });\n  }\n\n  // Uploads a file buffer or stream\n  async upload(params: UploadParams): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),\n        Key: params.key,\n        Body: params.body,\n        ContentType: params.contentType,\n      }),\n    );\n\n    this.logger.log(`Uploaded file to R2: ${params.key}`);\n    return params.key;\n  }\n\n  // Uploads a file to a public bucket and returns its permanent URL\n  async uploadPublic(key: string, body: Buffer, contentType: string, bucket?: string): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(bucket, this.config.publicBucket),\n        Key: key,\n        Body: body,\n        ContentType: contentType,\n      }),\n    );\n\n    const url = this.getPublicUrl(key);\n    this.logger.log(`Uploaded public file to R2: ${key} → ${url}`);\n    return url;\n  }\n\n  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,\n  // so a multi-tenant caller with a bucket per org cannot build one at all\n  getPublicUrl(key: string): string {\n    if (!this.config.publicUrl) {\n      throw new Error('R2 storage has no publicUrl configured; public URLs cannot be built.');\n    }\n    return `${this.config.publicUrl}/${key}`;\n  }\n\n  // Deletes a file\n  async delete(key: string, bucket?: string): Promise<void> {\n    await this.client.send(new DeleteObjectCommand({ Bucket: bucket ?? this.config.defaultBucket, Key: key }));\n\n    this.logger.log(`Deleted file from R2: ${key}`);\n  }\n\n  // Generates a presigned download URL (default 1 hour)\n  async getSignedUrl(key: string, expiresInSeconds = 3600, bucket?: string): Promise<string> {\n    const command = new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key });\n    return getSignedUrl(this.client, command, { expiresIn: expiresInSeconds });\n  }\n\n  // Returns a readable stream\n  async getStream(key: string, bucket?: string): Promise<Readable> {\n    const response = await this.client.send(\n      new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key }),\n    );\n\n    if (!response.Body) {\n      throw new NotFoundException('File not found in storage.');\n    }\n\n    return response.Body as Readable;\n  }\n\n  // One page of a bucket's contents. S3 has no \"list everything\" call and no bucket-size call — a full inventory is\n  // this looped until nextToken is absent, and each page is a Class A request.\n  async listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage> {\n    const response = await this.client.send(\n      new ListObjectsV2Command({ Bucket: bucket, ContinuationToken: continuationToken }),\n    );\n\n    return {\n      objects: (response.Contents ?? []).map((o) => ({\n        key: o.Key ?? '',\n        size: o.Size ?? 0,\n        lastModified: o.LastModified ?? new Date(0),\n      })),\n      nextToken: response.NextContinuationToken,\n    };\n  }\n\n  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default\n  private requireBucket(bucket: string | undefined, fallback: string | undefined): string {\n    const resolved = bucket ?? fallback;\n    if (!resolved) {\n      throw new Error('No bucket supplied and R2 storage has no default bucket configured.');\n    }\n    return resolved;\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadGatewayException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Gateway', HttpStatus.BAD_GATEWAY);\n  }\n}\n","import { HttpException, HttpStatus } from '@nestjs/common';\nimport type { FieldError } from '../types/error-response.types';\n\n// Re-export FieldError for backwards compatibility\nexport type { FieldError } from '../types/error-response.types';\n\nexport interface ProblemOptions {\n  type?: string;\n  label?: string;\n  detail?: string;\n  errors?: FieldError[];\n}\n\nexport abstract class HttpProblemException extends HttpException {\n  constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus) {\n    const options = typeof detailOrOptions === 'string' ? { detail: detailOrOptions } : detailOrOptions;\n\n    super(\n      {\n        type: options.type ?? 'about:blank',\n        label: options.label,\n        detail: options.detail,\n        errors: options.errors ?? [],\n      },\n      httpStatus,\n    );\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadRequestException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Request', HttpStatus.BAD_REQUEST);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ConflictException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Conflict', HttpStatus.CONFLICT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ForbiddenException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Forbidden', HttpStatus.FORBIDDEN);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class GoneException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Gone', HttpStatus.GONE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class InternalServerErrorException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Internal Server Error', HttpStatus.INTERNAL_SERVER_ERROR);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class MethodNotAllowedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Method Not Allowed', HttpStatus.METHOD_NOT_ALLOWED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotAcceptableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Acceptable', HttpStatus.NOT_ACCEPTABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotFoundException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Found', HttpStatus.NOT_FOUND);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotImplementedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Implemented', HttpStatus.NOT_IMPLEMENTED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class PayloadTooLargeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Payload Too Large', HttpStatus.PAYLOAD_TOO_LARGE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class RequestTimeoutException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Request Timeout', HttpStatus.REQUEST_TIMEOUT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ServiceUnavailableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Service Unavailable', HttpStatus.SERVICE_UNAVAILABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class TooManyRequestsException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnauthorizedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unauthorized', HttpStatus.UNAUTHORIZED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnprocessableEntityException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unprocessable Entity', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnsupportedMediaTypeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unsupported Media Type', HttpStatus.UNSUPPORTED_MEDIA_TYPE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ValidationException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Validation Failed', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { createHash } from 'node:crypto';\nimport { Logger } from '@nestjs/common';\nimport type { OrgBuckets, OrgCredential, OrgStorage, OrgStorageProvisioner, R2ProvisionerConfig } from '../types';\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\n\n// Bucket-level group: read/write/list objects in named buckets. Deliberately NOT 'Workers R2 Storage Write', which is\n// account-level and can create and delete buckets — exactly what a tenant credential must never do.\nconst BUCKET_ITEM_WRITE = 'Workers R2 Storage Bucket Item Write';\n\n// Bucket names are prefixed because the account also holds Vritti's own buckets, and a subdomain like \"media\" collides\nexport function orgBucketNames(subdomain: string): OrgBuckets {\n  return { storageBucket: `org-${subdomain}`, storagePublicBucket: `org-${subdomain}-public` };\n}\n\ninterface CloudflareEnvelope<T> {\n  success: boolean;\n  errors: { code: number; message: string }[];\n  result: T;\n}\n\nexport class R2BucketProvisioner implements OrgStorageProvisioner {\n  private readonly logger = new Logger(R2BucketProvisioner.name);\n  private readonly jurisdiction: string;\n  private bucketItemWriteGroupId: string | null = null;\n\n  constructor(private readonly config: R2ProvisionerConfig) {\n    this.jurisdiction = config.jurisdiction ?? 'default';\n  }\n\n  // Creates the org's two buckets and one credential scoped to just those buckets\n  async provisionOrg(subdomain: string): Promise<OrgStorage> {\n    const names = orgBucketNames(subdomain);\n    await this.createBucket(names.storageBucket);\n    await this.createBucket(names.storagePublicBucket);\n\n    // Not fatal: an org whose public bucket is private still works for every presigned read, and the URL can be\n    // filled in later. Failing the whole signup over a CDN convenience would be the wrong trade.\n    let publicUrl: string | null = null;\n    try {\n      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);\n    } catch (error: unknown) {\n      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);\n    }\n\n    const token = await this.createScopedToken(subdomain, [names.storageBucket, names.storagePublicBucket]);\n\n    return {\n      provider: 'r2',\n      accountId: this.config.accountId,\n      bucket: names.storageBucket,\n      publicBucket: names.storagePublicBucket,\n      publicUrl,\n      accessKeyId: token.id,\n      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is\n      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n      createdAt: new Date().toISOString(),\n    };\n  }\n\n  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole\n  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.\n  //\n  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org\n  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.\n  async rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential> {\n    const token = await this.createScopedToken(subdomain, [buckets.storageBucket, buckets.storagePublicBucket]);\n\n    return {\n      accessKeyId: token.id,\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n    };\n  }\n\n  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must\n  // have emptied them first — a 'not empty' failure here means that step did not finish.\n  async deleteOrgBuckets(buckets: OrgBuckets): Promise<void> {\n    for (const bucket of [buckets.storageBucket, buckets.storagePublicBucket]) {\n      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {\n        method: 'DELETE',\n        headers: { Authorization: `Bearer ${this.config.adminToken}` },\n      });\n\n      const body = (await response.json()) as CloudflareEnvelope<unknown>;\n      // 10006 is \"bucket not found\" — already gone, which is the state we wanted\n      if (body.success || body.errors?.some((e) => e.code === 10006)) {\n        this.logger.log(`Deleted bucket ${bucket}`);\n        continue;\n      }\n      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);\n    }\n  }\n\n  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id\n  async deleteCredential(accessKeyId: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (!body.success) {\n      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Revoked storage credential ${accessKeyId}`);\n  }\n\n  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile\n  private async createBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.config.adminToken}`,\n        'Content-Type': 'application/json',\n        'cf-r2-jurisdiction': this.jurisdiction,\n      },\n      body: JSON.stringify({\n        name,\n        ...(this.config.locationHint && { locationHint: this.config.locationHint }),\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (body.success) {\n      this.logger.log(`Created bucket ${name}`);\n      return;\n    }\n\n    // 10004 is \"bucket already exists\" — two provisioning attempts racing, or a reconcile pass\n    if (body.errors?.some((e) => e.code === 10004)) return;\n    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as\n  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into\n  // this same field.\n  private async enablePublicAccess(bucket: string): Promise<string | null> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {\n      method: 'PUT',\n      headers: { Authorization: `Bearer ${this.config.adminToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ enabled: true }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ domain?: string; enabled?: boolean }>;\n    if (!body.success || !body.result?.domain) {\n      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Enabled public access for ${bucket} → ${body.result.domain}`);\n    return `https://${body.result.domain}`;\n  }\n\n  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a\n  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the\n  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.\n  private async createScopedToken(subdomain: string, buckets: string[]): Promise<{ id: string; value: string }> {\n    const permissionGroupId = await this.resolveBucketItemWriteGroupId();\n\n    // The jurisdiction is embedded in the resource key and must match the bucket's, or the token authenticates fine\n    // and then 403s on every object because it is scoped to a bucket that does not exist\n    const resources = Object.fromEntries(\n      buckets.map((bucket) => [\n        `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,\n        '*',\n      ]),\n    );\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        name: `org-${subdomain}`,\n        policies: [{ effect: 'allow', permission_groups: [{ id: permissionGroupId }], resources }],\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; value: string }>;\n    if (!body.success || !body.result?.value) {\n      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);\n    return body.result;\n  }\n\n  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied\n  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.\n  private async resolveBucketItemWriteGroupId(): Promise<string> {\n    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; name: string }[]>;\n    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);\n    if (!group) {\n      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);\n    }\n\n    this.bucketItemWriteGroupId = group.id;\n    return group.id;\n  }\n\n  private describe(body: CloudflareEnvelope<unknown>): string {\n    return body.errors?.map((e) => `${e.code} ${e.message}`).join('; ') || 'unknown error';\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nimport type { OrgStorageProvisioner, R2ProvisionerConfig } from './types';\n\nexport interface OrgStorageProvisionerFactoryOptions {\n  r2?: StorageConfigSource<R2ProvisionerConfig>;\n}\n\n// Mirrors StorageFactory for the control-plane side: same provider names, same lazy config, different job\nexport class OrgStorageProvisionerFactory {\n  private readonly cache = new Map<string, OrgStorageProvisioner>();\n\n  constructor(private readonly options: OrgStorageProvisionerFactoryOptions) {}\n\n  // Resolves a provisioner by provider name, constructing it once on first use\n  resolve(provider: string): OrgStorageProvisioner {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): OrgStorageProvisioner {\n    switch (provider) {\n      case 'r2':\n        return new R2BucketProvisioner(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2StorageProvider } from './providers/r2-storage.provider';\nimport type { R2StorageConfig, StorageProvider } from './types';\n\nexport interface StorageFactoryOptions {\n  r2?: StorageConfigSource<R2StorageConfig>;\n}\n\nexport class StorageFactory {\n  private readonly cache = new Map<string, StorageProvider>();\n\n  constructor(private readonly options: StorageFactoryOptions) {}\n\n  // Resolves a provider by name, constructing it once on first use\n  resolve(provider: string): StorageProvider {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): StorageProvider {\n    switch (provider) {\n      case 'r2':\n        return new R2StorageProvider(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;ACAA,oBAAuB;AAEvB,IAAMA,aAAa;AAmBnB,IAAMC,QAAQ;;;;;;;;;;;;;;AA8BP,IAAMC,oBAAN,MAAMA,mBAAAA;EAnDb,OAmDaA;;;;EACMC,SAAS,IAAIC,qBAAOF,mBAAkBG,IAAI;EAE3D,YAA6BC,QAAiC;SAAjCA,SAAAA;EAAkC;;;EAI/D,MAAMC,eAAeC,YAAoBC,cAAc,IAA0B;AAC/E,UAAMC,MAAM,oBAAIC,KAAAA;AAChB,UAAMC,QAAQ,IAAID,KAAKD,IAAIG,QAAO,IAAKJ,cAAc,KAAK,KAAK,GAAA;AAE/D,UAAMK,WAAW,MAAMC,MAAMf,YAAY;MACvCgB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKZ,OAAOa,cAAc;QAAI,gBAAgB;MAAmB;MACrGC,MAAMC,KAAKC,UAAU;QACnBC,OAAOtB;QACPuB,WAAW;UACTC,YAAY,KAAKnB,OAAOoB;UACxBlB;UACAI,OAAOA,MAAMe,YAAW;UACxBjB,KAAKA,IAAIiB,YAAW;QACtB;MACF,CAAA;IACF,CAAA;AAEA,UAAMP,OAAQ,MAAMN,SAASc,KAAI;AACjC,QAAIR,KAAKS,QAAQC,QAAQ;AACvB,YAAM,IAAIC,MACR,qCAAqCvB,UAAAA,KAAeY,KAAKS,OAAOG,IAAI,CAACC,MAAMA,EAAEC,OAAO,EAAEC,KAAK,IAAA,CAAA,EAAO;IAEtG;AAEA,UAAMC,SAAShB,KAAKiB,MAAMC,QAAQC,WAAW,CAAA,GAAIC,0BAA0B,CAAA,GAAIC;AAC/E,QAAI,CAACL,QAAQ;AACX,WAAKjC,OAAOuC,MAAM,mCAAmClC,UAAAA,EAAY;AACjE,aAAO;QAAEmC,OAAO;QAAGC,aAAa;MAAE;IACpC;AAGA,WAAO;MACLD,QAAQP,OAAOS,eAAe,MAAMT,OAAOU,gBAAgB;MAC3DF,aAAaR,OAAOQ,eAAe;IACrC;EACF;AACF;;;AC1FO,SAASG,iBAAoBC,QAA4CC,UAAgB;AAC9F,MAAID,WAAWE,QAAW;AACxB,UAAM,IAAIC,MAAM,qBAAqBF,QAAAA,sBAA8B;EACrE;AACA,SAAO,OAAOD,WAAW,aAAcA,OAAAA,IAAuBA;AAChE;AALgBD;;;ACJhB,uBAMO;AACP,kCAA6B;AAC7B,IAAAK,kBAAuB;;;ACTvB,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA0C;AAanC,IAAeC,uBAAf,cAA4CC,6BAAAA;EAbnD,OAamDA;;;EACjD,YAAYC,iBAA0CC,YAAwB;AAC5E,UAAMC,UAAU,OAAOF,oBAAoB,WAAW;MAAEG,QAAQH;IAAgB,IAAIA;AAEpF,UACE;MACEI,MAAMF,QAAQE,QAAQ;MACtBC,OAAOH,QAAQG;MACfF,QAAQD,QAAQC;MAChBG,QAAQJ,QAAQI,UAAU,CAAA;IAC5B,GACAL,UAAAA;EAEJ;AACF;;;AC3BA,IAAAM,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;AAGpB,IAAMC,oBAAN,cAAgCC,qBAAAA;EAHvC,OAGuCA;;;EACrC,YAAYC,iBAA2C;AACrD,UAAMA,mBAAmB,aAAaC,2BAAWC,SAAS;EAC5D;AACF;;;ACPA,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;AnBapB,IAAMC,oBAAN,MAAMA,mBAAAA;EAZb,OAYaA;;;;EACMC,SAAS,IAAIC,uBAAOF,mBAAkBG,IAAI;EAC1CC;EAEjB,YAA6BC,QAAyB;SAAzBA,SAAAA;AAC3B,SAAKD,SAAS,IAAIE,0BAAS;MACzBC,QAAQ;MACRC,UAAU,WAAWH,OAAOI,SAAS;MACrCC,aAAa;QAAEC,aAAaN,OAAOM;QAAaC,iBAAiBP,OAAOO;MAAgB;IAC1F,CAAA;EACF;;EAGA,MAAMC,OAAOC,QAAuC;AAClD,UAAM,KAAKV,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcJ,OAAOK,QAAQ,KAAKd,OAAOe,aAAa;MACnEC,KAAKP,OAAOQ;MACZC,MAAMT,OAAOU;MACbC,aAAaX,OAAOY;IACtB,CAAA,CAAA;AAGF,SAAKzB,OAAO0B,IAAI,wBAAwBb,OAAOQ,GAAG,EAAE;AACpD,WAAOR,OAAOQ;EAChB;;EAGA,MAAMM,aAAaN,KAAaE,MAAcE,aAAqBP,QAAkC;AACnG,UAAM,KAAKf,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOwB,YAAY;MAC3DR,KAAKC;MACLC,MAAMC;MACNC,aAAaC;IACf,CAAA,CAAA;AAGF,UAAMI,MAAM,KAAKC,aAAaT,GAAAA;AAC9B,SAAKrB,OAAO0B,IAAI,+BAA+BL,GAAAA,WAASQ,GAAAA,EAAK;AAC7D,WAAOA;EACT;;;EAIAC,aAAaT,KAAqB;AAChC,QAAI,CAAC,KAAKjB,OAAO2B,WAAW;AAC1B,YAAM,IAAIC,MAAM,sEAAA;IAClB;AACA,WAAO,GAAG,KAAK5B,OAAO2B,SAAS,IAAIV,GAAAA;EACrC;;EAGA,MAAMY,OAAOZ,KAAaH,QAAgC;AACxD,UAAM,KAAKf,OAAOW,KAAK,IAAIoB,qCAAoB;MAAElB,QAAQE,UAAU,KAAKd,OAAOe;MAAeC,KAAKC;IAAI,CAAA,CAAA;AAEvG,SAAKrB,OAAO0B,IAAI,yBAAyBL,GAAAA,EAAK;EAChD;;EAGA,MAAMc,aAAad,KAAae,mBAAmB,MAAMlB,QAAkC;AACzF,UAAMmB,UAAU,IAAIC,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA;AAC/G,eAAOc,0CAAa,KAAKhC,QAAQkC,SAAS;MAAEE,WAAWH;IAAiB,CAAA;EAC1E;;EAGA,MAAMI,UAAUnB,KAAaH,QAAoC;AAC/D,UAAMuB,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAIwB,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA,CAAA;AAGjG,QAAI,CAACoB,SAASnB,MAAM;AAClB,YAAM,IAAIoB,kBAAkB,4BAAA;IAC9B;AAEA,WAAOD,SAASnB;EAClB;;;EAIA,MAAMqB,YAAYzB,QAAgB0B,mBAAsD;AACtF,UAAMH,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAI+B,sCAAqB;MAAE7B,QAAQE;MAAQ4B,mBAAmBF;IAAkB,CAAA,CAAA;AAGlF,WAAO;MACLG,UAAUN,SAASO,YAAY,CAAA,GAAIC,IAAI,CAACC,OAAO;QAC7C7B,KAAK6B,EAAE9B,OAAO;QACd+B,MAAMD,EAAEE,QAAQ;QAChBC,cAAcH,EAAEI,gBAAgB,oBAAIC,KAAK,CAAA;MAC3C,EAAA;MACAC,WAAWf,SAASgB;IACtB;EACF;;EAGQxC,cAAcC,QAA4BwC,UAAsC;AACtF,UAAMC,WAAWzC,UAAUwC;AAC3B,QAAI,CAACC,UAAU;AACb,YAAM,IAAI3B,MAAM,qEAAA;IAClB;AACA,WAAO2B;EACT;AACF;;;AoBpHA,yBAA2B;AAC3B,IAAAC,kBAAuB;AAGvB,IAAMC,SAAS;AAIf,IAAMC,oBAAoB;AAGnB,SAASC,eAAeC,WAAiB;AAC9C,SAAO;IAAEC,eAAe,OAAOD,SAAAA;IAAaE,qBAAqB,OAAOF,SAAAA;EAAmB;AAC7F;AAFgBD;AAUT,IAAMI,sBAAN,MAAMA,qBAAAA;EArBb,OAqBaA;;;;EACMC,SAAS,IAAIC,uBAAOF,qBAAoBG,IAAI;EAC5CC;EACTC,yBAAwC;EAEhD,YAA6BC,QAA6B;SAA7BA,SAAAA;AAC3B,SAAKF,eAAeE,OAAOF,gBAAgB;EAC7C;;EAGA,MAAMG,aAAaV,WAAwC;AACzD,UAAMW,QAAQZ,eAAeC,SAAAA;AAC7B,UAAM,KAAKY,aAAaD,MAAMV,aAAa;AAC3C,UAAM,KAAKW,aAAaD,MAAMT,mBAAmB;AAIjD,QAAIW,YAA2B;AAC/B,QAAI;AACFA,kBAAY,MAAM,KAAKC,mBAAmBH,MAAMT,mBAAmB;IACrE,SAASa,OAAgB;AACvB,WAAKX,OAAOY,KAAK,iCAAiCL,MAAMT,mBAAmB,KAAKa,KAAAA,EAAO;IACzF;AAEA,UAAME,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACW,MAAMV;MAAeU,MAAMT;KAAoB;AAEtG,WAAO;MACLiB,UAAU;MACVC,WAAW,KAAKX,OAAOW;MACvBC,QAAQV,MAAMV;MACdqB,cAAcX,MAAMT;MACpBW;MACAU,aAAaN,MAAMO;;;MAGnBC,qBAAiBC,+BAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;MACjEC,YAAW,oBAAIC,KAAAA,GAAOC,YAAW;IACnC;EACF;;;;;;EAOA,MAAMC,iBAAiBjC,WAAmBkC,SAA6C;AACrF,UAAMjB,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACkC,QAAQjC;MAAeiC,QAAQhC;KAAoB;AAE1G,WAAO;MACLqB,aAAaN,MAAMO;MACnBC,qBAAiBC,+BAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;IACnE;EACF;;;EAIA,MAAMM,iBAAiBD,SAAoC;AACzD,eAAWb,UAAU;MAACa,QAAQjC;MAAeiC,QAAQhC;OAAsB;AACzE,YAAMkC,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,IAAU;QAC/FiB,QAAQ;QACRC,SAAS;UAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAG;MAC/D,CAAA;AAEA,YAAMC,OAAQ,MAAMN,SAASO,KAAI;AAEjC,UAAID,KAAKE,WAAWF,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,GAAQ;AAC9D,aAAK5C,OAAO6C,IAAI,kBAAkB5B,MAAAA,EAAQ;AAC1C;MACF;AACA,YAAM,IAAI6B,MAAM,uCAAuC7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IACzF;EACF;;EAGA,MAAMU,iBAAiB7B,aAAoC;AACzD,UAAMa,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAWG,WAAAA,IAAe;MAChGe,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,SAAS;AACjB,YAAM,IAAIM,MAAM,sCAAsC3B,WAAAA,KAAgB,KAAK4B,SAAST,IAAAA,CAAAA,EAAO;IAC7F;AAEA,SAAKtC,OAAO6C,IAAI,8BAA8B1B,WAAAA,EAAa;EAC7D;;EAGA,MAAcX,aAAaN,MAA6B;AACtD,UAAM8B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAe;MACrFkB,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAC/C,gBAAgB;QAChB,sBAAsB,KAAKlC;MAC7B;MACAmC,MAAMY,KAAKC,UAAU;QACnBjD;QACA,GAAI,KAAKG,OAAO+C,gBAAgB;UAAEA,cAAc,KAAK/C,OAAO+C;QAAa;MAC3E,CAAA;IACF,CAAA;AAEA,UAAMd,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAID,KAAKE,SAAS;AAChB,WAAKxC,OAAO6C,IAAI,kBAAkB3C,IAAAA,EAAM;AACxC;IACF;AAGA,QAAIoC,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,EAAQ;AAChD,UAAM,IAAIE,MAAM,uCAAuC5C,IAAAA,KAAS,KAAK6C,SAAST,IAAAA,CAAAA,EAAO;EACvF;;;;EAKA,MAAc5B,mBAAmBO,QAAwC;AACvE,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,oBAA0B;MAC/GiB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAI,gBAAgB;MAAmB;MACjGC,MAAMY,KAAKC,UAAU;QAAEE,SAAS;MAAK,CAAA;IACvC,CAAA;AAEA,UAAMf,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQC,QAAQ;AACzC,YAAM,IAAIT,MAAM,8CAA8C7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IAChG;AAEA,SAAKtC,OAAO6C,IAAI,6BAA6B5B,MAAAA,WAAYqB,KAAKgB,OAAOC,MAAM,EAAE;AAC7E,WAAO,WAAWjB,KAAKgB,OAAOC,MAAM;EACtC;;;;EAKA,MAAczC,kBAAkBlB,WAAmBkC,SAA2D;AAC5G,UAAM0B,oBAAoB,MAAM,KAAKC,8BAA6B;AAIlE,UAAMC,YAAYC,OAAOC,YACvB9B,QAAQ+B,IAAI,CAAC5C,WAAW;MACtB,iCAAiC,KAAKZ,OAAOW,SAAS,IAAI,KAAKb,YAAY,IAAIc,MAAAA;MAC/E;KACD,CAAA;AAGH,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAW;MACjFkB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;QAAI,gBAAgB;MAAmB;MAClGX,MAAMY,KAAKC,UAAU;QACnBjD,MAAM,OAAON,SAAAA;QACbkE,UAAU;UAAC;YAAEC,QAAQ;YAASC,mBAAmB;cAAC;gBAAE5C,IAAIoC;cAAkB;;YAAIE;UAAU;;MAC1F,CAAA;IACF,CAAA;AAEA,UAAMpB,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQ9B,OAAO;AACxC,YAAM,IAAIsB,MAAM,0CAA0ClD,SAAAA,KAAc,KAAKmD,SAAST,IAAAA,CAAAA,EAAO;IAC/F;AAEA,SAAKtC,OAAO6C,IAAI,qCAAqCjD,SAAAA,cAAuBkC,QAAQmC,MAAM,YAAY;AACtG,WAAO3B,KAAKgB;EACd;;;EAIA,MAAcG,gCAAiD;AAC7D,QAAI,KAAKrD,uBAAwB,QAAO,KAAKA;AAE7C,UAAM4B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,6BAA6B;MACnGmB,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,UAAM2B,QAAQ5B,KAAKgB,QAAQa,KAAK,CAACC,MAAMA,EAAElE,SAASR,iBAAAA;AAClD,QAAI,CAACwE,OAAO;AACV,YAAM,IAAIpB,MAAM,gCAAgCpD,iBAAAA,gBAAiC,KAAKqD,SAAST,IAAAA,CAAAA,EAAO;IACxG;AAEA,SAAKlC,yBAAyB8D,MAAM9C;AACpC,WAAO8C,MAAM9C;EACf;EAEQ2B,SAAST,MAA2C;AAC1D,WAAOA,KAAKG,QAAQoB,IAAI,CAAClB,MAAM,GAAGA,EAAEC,IAAI,IAAID,EAAE0B,OAAO,EAAE,EAAEC,KAAK,IAAA,KAAS;EACzE;AACF;;;ACxMO,IAAMC,+BAAN,MAAMA;EATb,OASaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAA8C;SAA9CA,UAAAA;EAA+C;;EAG5EC,QAAQC,UAAyC;AAC/C,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAyC;AACtD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,oBAAoBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACnE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;;;ACxBO,IAAMU,iBAAN,MAAMA;EARb,OAQaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAAgC;SAAhCA,UAAAA;EAAiC;;EAG9DC,QAAQC,UAAmC;AACzC,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAmC;AAChD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,kBAAkBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACjE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;","names":["CF_GRAPHQL","QUERY","BucketUsageReader","logger","Logger","name","config","getBucketUsage","bucketName","windowHours","end","Date","start","getTime","response","fetch","method","headers","Authorization","analyticsToken","body","JSON","stringify","query","variables","accountTag","accountId","toISOString","json","errors","length","Error","map","e","message","join","sample","data","viewer","accounts","r2StorageAdaptiveGroups","max","debug","bytes","objectCount","payloadSize","metadataSize","readConfigSource","source","provider","undefined","Error","import_common","import_common","import_common","HttpProblemException","HttpException","detailOrOptions","httpStatus","options","detail","type","label","errors","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","NotFoundException","HttpProblemException","detailOrOptions","HttpStatus","NOT_FOUND","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","R2StorageProvider","logger","Logger","name","client","config","S3Client","region","endpoint","accountId","credentials","accessKeyId","secretAccessKey","upload","params","send","PutObjectCommand","Bucket","requireBucket","bucket","defaultBucket","Key","key","Body","body","ContentType","contentType","log","uploadPublic","publicBucket","url","getPublicUrl","publicUrl","Error","delete","DeleteObjectCommand","getSignedUrl","expiresInSeconds","command","GetObjectCommand","expiresIn","getStream","response","NotFoundException","listObjects","continuationToken","ListObjectsV2Command","ContinuationToken","objects","Contents","map","o","size","Size","lastModified","LastModified","Date","nextToken","NextContinuationToken","fallback","resolved","import_common","CF_API","BUCKET_ITEM_WRITE","orgBucketNames","subdomain","storageBucket","storagePublicBucket","R2BucketProvisioner","logger","Logger","name","jurisdiction","bucketItemWriteGroupId","config","provisionOrg","names","createBucket","publicUrl","enablePublicAccess","error","warn","token","createScopedToken","provider","accountId","bucket","publicBucket","accessKeyId","id","secretAccessKey","createHash","update","value","digest","createdAt","Date","toISOString","rotateCredential","buckets","deleteOrgBuckets","response","fetch","method","headers","Authorization","adminToken","body","json","success","errors","some","e","code","log","Error","describe","deleteCredential","tokensToken","JSON","stringify","locationHint","enabled","result","domain","permissionGroupId","resolveBucketItemWriteGroupId","resources","Object","fromEntries","map","policies","effect","permission_groups","length","group","find","g","message","join","OrgStorageProvisionerFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2BucketProvisioner","readConfigSource","r2","Error","StorageFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2StorageProvider","readConfigSource","r2","Error"]}
+{"version":3,"sources":["../src/storage/index.ts","../src/storage/bucket-usage.reader.ts","../src/storage/config-source.ts","../src/storage/providers/r2-storage.provider.ts","../src/exceptions/bad-gateway.exception.ts","../src/exceptions/base-field.exception.ts","../src/exceptions/bad-request.exception.ts","../src/exceptions/conflict.exception.ts","../src/exceptions/forbidden.exception.ts","../src/exceptions/gone.exception.ts","../src/exceptions/internal-server-error.exception.ts","../src/exceptions/method-not-allowed.exception.ts","../src/exceptions/not-acceptable.exception.ts","../src/exceptions/not-found.exception.ts","../src/exceptions/not-implemented.exception.ts","../src/exceptions/payload-too-large.exception.ts","../src/exceptions/request-timeout.exception.ts","../src/exceptions/service-unavailable.exception.ts","../src/exceptions/too-many-requests.exception.ts","../src/exceptions/unauthorized.exception.ts","../src/exceptions/unprocessable-entity.exception.ts","../src/exceptions/unsupported-media-type.exception.ts","../src/exceptions/validation.exception.ts","../src/storage/provisioners/r2-bucket.provisioner.ts","../src/storage/storage.factory.ts"],"sourcesContent":["export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig } from './bucket-usage.reader';\nexport { readConfigSource, type StorageConfigSource } from './config-source';\nexport { R2StorageProvider } from './providers/r2-storage.provider';\nexport { R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nexport { StorageFactory, type StorageFactoryOptions } from './storage.factory';\nexport type {\n  ListObjectsPage,\n  R2ProvisionerConfig,\n  R2StorageConfig,\n  StorageProvider,\n  StoredObject,\n  UploadParams,\n} from './types';\n","import { Logger } from '@nestjs/common';\n\nconst CF_GRAPHQL = 'https://api.cloudflare.com/client/v4/graphql';\n\nexport interface BucketUsage {\n  bytes: number;\n  objectCount: number;\n}\n\nexport interface BucketUsageReaderConfig {\n  accountId: string;\n  // Account-level token with Analytics Read. NOT the org's scoped S3 credential and NOT the R2 admin token: the\n  // analytics dataset is filtered by accountTag and is not reachable with object-level credentials.\n  analyticsToken: string;\n}\n\n// r2StorageAdaptiveGroups is a time series, so the newest bucketed sample is the closest thing to \"current\". It lags\n// real writes by minutes — fine for a periodic quota check, useless for gating an individual upload.\n//\n// `dimensions { datetime }` is required, not decorative: ordering by a field that is neither aggregated nor selected\n// as a dimension is rejected. Keep the query free of `#` comments too — Cloudflare's parser rejects them.\nconst QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {\n  viewer {\n    accounts(filter: { accountTag: $accountTag }) {\n      r2StorageAdaptiveGroups(\n        limit: 1\n        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }\n        orderBy: [datetime_DESC]\n      ) {\n        max { objectCount payloadSize metadataSize }\n        dimensions { datetime }\n      }\n    }\n  }\n}`;\n\ninterface UsageResponse {\n  errors?: { message: string }[];\n  data?: {\n    viewer?: {\n      accounts?: {\n        r2StorageAdaptiveGroups?: {\n          max?: { objectCount?: number; payloadSize?: number; metadataSize?: number };\n        }[];\n      }[];\n    };\n  };\n}\n\n// Reads how much an org's bucket actually holds, straight from the provider — the authoritative figure a locally\n// maintained counter would only ever approximate.\nexport class BucketUsageReader {\n  private readonly logger = new Logger(BucketUsageReader.name);\n\n  constructor(private readonly config: BucketUsageReaderConfig) {}\n\n  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or\n  // empty bucket produces no rows at all rather than a row of zeroes)\n  async getBucketUsage(bucketName: string, windowHours = 24): Promise<BucketUsage> {\n    const end = new Date();\n    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1000);\n\n    const response = await fetch(CF_GRAPHQL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.analyticsToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        query: QUERY,\n        variables: {\n          accountTag: this.config.accountId,\n          bucketName,\n          start: start.toISOString(),\n          end: end.toISOString(),\n        },\n      }),\n    });\n\n    const body = (await response.json()) as UsageResponse;\n    if (body.errors?.length) {\n      throw new Error(\n        `Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join('; ')}`,\n      );\n    }\n\n    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;\n    if (!sample) {\n      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);\n      return { bytes: 0, objectCount: 0 };\n    }\n\n    // Billed storage is payload plus per-object metadata, so both count against a quota\n    return {\n      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),\n      objectCount: sample.objectCount ?? 0,\n    };\n  }\n}\n","// Config may be a value or a thunk. Servers pass a thunk when the credentials come from required-only-if-selected\n// env keys, so reading them is deferred to the first resolve() instead of running at module construction.\nexport type StorageConfigSource<T> = T | (() => T);\n\n// A backend configured nowhere is a deployment asking for something it was never given credentials for\nexport function readConfigSource<T>(source: StorageConfigSource<T> | undefined, provider: string): T {\n  if (source === undefined) {\n    throw new Error(`Storage provider '${provider}' is not configured.`);\n  }\n  return typeof source === 'function' ? (source as () => T)() : source;\n}\n","import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  ListObjectsV2Command,\n  PutObjectCommand,\n  S3Client,\n} from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Logger } from '@nestjs/common';\nimport { NotFoundException } from '../../exceptions';\nimport type { ListObjectsPage, R2StorageConfig, StorageProvider, UploadParams } from '../types';\n\nexport class R2StorageProvider implements StorageProvider {\n  private readonly logger = new Logger(R2StorageProvider.name);\n  private readonly client: S3Client;\n\n  constructor(private readonly config: R2StorageConfig) {\n    this.client = new S3Client({\n      region: 'auto',\n      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,\n      credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },\n    });\n  }\n\n  // Uploads a file buffer or stream\n  async upload(params: UploadParams): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),\n        Key: params.key,\n        Body: params.body,\n        ContentType: params.contentType,\n      }),\n    );\n\n    this.logger.log(`Uploaded file to R2: ${params.key}`);\n    return params.key;\n  }\n\n  // Uploads a file to a public bucket and returns its permanent URL\n  async uploadPublic(key: string, body: Buffer, contentType: string, bucket?: string): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(bucket, this.config.publicBucket),\n        Key: key,\n        Body: body,\n        ContentType: contentType,\n      }),\n    );\n\n    const url = this.getPublicUrl(key);\n    this.logger.log(`Uploaded public file to R2: ${key} → ${url}`);\n    return url;\n  }\n\n  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,\n  // so a multi-tenant caller with a bucket per org cannot build one at all\n  getPublicUrl(key: string): string {\n    if (!this.config.publicUrl) {\n      throw new Error('R2 storage has no publicUrl configured; public URLs cannot be built.');\n    }\n    return `${this.config.publicUrl}/${key}`;\n  }\n\n  // Deletes a file\n  async delete(key: string, bucket?: string): Promise<void> {\n    await this.client.send(new DeleteObjectCommand({ Bucket: bucket ?? this.config.defaultBucket, Key: key }));\n\n    this.logger.log(`Deleted file from R2: ${key}`);\n  }\n\n  // Generates a presigned download URL (default 1 hour)\n  async getSignedUrl(key: string, expiresInSeconds = 3600, bucket?: string): Promise<string> {\n    const command = new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key });\n    return getSignedUrl(this.client, command, { expiresIn: expiresInSeconds });\n  }\n\n  // Returns a readable stream\n  async getStream(key: string, bucket?: string): Promise<Readable> {\n    const response = await this.client.send(\n      new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key }),\n    );\n\n    if (!response.Body) {\n      throw new NotFoundException('File not found in storage.');\n    }\n\n    return response.Body as Readable;\n  }\n\n  // One page of a bucket's contents. S3 has no \"list everything\" call and no bucket-size call — a full inventory is\n  // this looped until nextToken is absent, and each page is a Class A request.\n  async listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage> {\n    const response = await this.client.send(\n      new ListObjectsV2Command({ Bucket: bucket, ContinuationToken: continuationToken }),\n    );\n\n    return {\n      objects: (response.Contents ?? []).map((o) => ({\n        key: o.Key ?? '',\n        size: o.Size ?? 0,\n        lastModified: o.LastModified ?? new Date(0),\n      })),\n      nextToken: response.NextContinuationToken,\n    };\n  }\n\n  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default\n  private requireBucket(bucket: string | undefined, fallback: string | undefined): string {\n    const resolved = bucket ?? fallback;\n    if (!resolved) {\n      throw new Error('No bucket supplied and R2 storage has no default bucket configured.');\n    }\n    return resolved;\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadGatewayException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Gateway', HttpStatus.BAD_GATEWAY);\n  }\n}\n","import { HttpException, HttpStatus } from '@nestjs/common';\nimport type { FieldError } from '../types/error-response.types';\n\n// Re-export FieldError for backwards compatibility\nexport type { FieldError } from '../types/error-response.types';\n\nexport interface ProblemOptions {\n  type?: string;\n  label?: string;\n  detail?: string;\n  errors?: FieldError[];\n}\n\nexport abstract class HttpProblemException extends HttpException {\n  constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus) {\n    const options = typeof detailOrOptions === 'string' ? { detail: detailOrOptions } : detailOrOptions;\n\n    super(\n      {\n        type: options.type ?? 'about:blank',\n        label: options.label,\n        detail: options.detail,\n        errors: options.errors ?? [],\n      },\n      httpStatus,\n    );\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadRequestException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Request', HttpStatus.BAD_REQUEST);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ConflictException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Conflict', HttpStatus.CONFLICT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ForbiddenException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Forbidden', HttpStatus.FORBIDDEN);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class GoneException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Gone', HttpStatus.GONE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class InternalServerErrorException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Internal Server Error', HttpStatus.INTERNAL_SERVER_ERROR);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class MethodNotAllowedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Method Not Allowed', HttpStatus.METHOD_NOT_ALLOWED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotAcceptableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Acceptable', HttpStatus.NOT_ACCEPTABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotFoundException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Found', HttpStatus.NOT_FOUND);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotImplementedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Implemented', HttpStatus.NOT_IMPLEMENTED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class PayloadTooLargeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Payload Too Large', HttpStatus.PAYLOAD_TOO_LARGE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class RequestTimeoutException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Request Timeout', HttpStatus.REQUEST_TIMEOUT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ServiceUnavailableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Service Unavailable', HttpStatus.SERVICE_UNAVAILABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class TooManyRequestsException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnauthorizedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unauthorized', HttpStatus.UNAUTHORIZED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnprocessableEntityException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unprocessable Entity', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnsupportedMediaTypeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unsupported Media Type', HttpStatus.UNSUPPORTED_MEDIA_TYPE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ValidationException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Validation Failed', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { Logger } from '@nestjs/common';\nimport type { R2ProvisionerConfig } from '../types';\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\n\n// Bucket-level group: read/write/list objects in named buckets. Deliberately NOT 'Workers R2 Storage Write', which is\n// account-level and can create and delete buckets — exactly what a tenant credential must never do.\nconst BUCKET_ITEM_WRITE = 'Workers R2 Storage Bucket Item Write';\n\ninterface CloudflareEnvelope<T> {\n  success: boolean;\n  errors: { code: number; message: string }[];\n  result: T;\n}\n\n// Generic R2 admin client: create/delete buckets, toggle a bucket's Cloudflare-managed public domain, and mint/revoke\n// bucket-scoped credentials. It has NO notion of organizations — bucket naming, which buckets a tenant gets, and how\n// the stored descriptor is assembled all live in the caller. Every operation is a Cloudflare REST call.\nexport class R2BucketProvisioner {\n  private readonly logger = new Logger(R2BucketProvisioner.name);\n  private readonly jurisdiction: string;\n  private bucketItemWriteGroupId: string | null = null;\n\n  constructor(private readonly config: R2ProvisionerConfig) {\n    this.jurisdiction = config.jurisdiction ?? 'default';\n  }\n\n  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile\n  async createBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.config.adminToken}`,\n        'Content-Type': 'application/json',\n        'cf-r2-jurisdiction': this.jurisdiction,\n      },\n      body: JSON.stringify({\n        name,\n        ...(this.config.locationHint && { locationHint: this.config.locationHint }),\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (body.success) {\n      this.logger.log(`Created bucket ${name}`);\n      return;\n    }\n\n    // 10004 is \"bucket already exists\" — two provisioning attempts racing, or a reconcile pass\n    if (body.errors?.some((e) => e.code === 10004)) return;\n    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Deletes one bucket. R2 refuses to delete a bucket that still holds objects, so the caller must have emptied it\n  // first — a 'not empty' failure here means that step did not finish. A missing bucket counts as success.\n  async deleteBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${name}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.adminToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    // 10006 is \"bucket not found\" — already gone, which is the state we wanted\n    if (body.success || body.errors?.some((e) => e.code === 10006)) {\n      this.logger.log(`Deleted bucket ${name}`);\n      return;\n    }\n    throw new Error(`Cloudflare bucket delete failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Turns on the bucket's Cloudflare-managed domain and returns its https URL. NOTE: r2.dev is rate limited and\n  // documented as non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer,\n  // and drops into this same field. Throws on failure; the caller decides whether that is fatal.\n  async enablePublicAccess(bucket: string): Promise<string> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {\n      method: 'PUT',\n      headers: { Authorization: `Bearer ${this.config.adminToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ enabled: true }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ domain?: string; enabled?: boolean }>;\n    if (!body.success || !body.result?.domain) {\n      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Enabled public access for ${bucket} → ${body.result.domain}`);\n    return `https://${body.result.domain}`;\n  }\n\n  // Mints an ACCOUNT-owned token that can only touch the named buckets. Account-owned rather than user-owned so a\n  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the\n  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.\n  // `name` is the token's display label; the value is returned by R2 exactly once.\n  async createScopedToken(name: string, buckets: string[]): Promise<{ id: string; value: string }> {\n    const permissionGroupId = await this.resolveBucketItemWriteGroupId();\n\n    // The jurisdiction is embedded in the resource key and must match the bucket's, or the token authenticates fine\n    // and then 403s on every object because it is scoped to a bucket that does not exist\n    const resources = Object.fromEntries(\n      buckets.map((bucket) => [\n        `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,\n        '*',\n      ]),\n    );\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        name,\n        policies: [{ effect: 'allow', permission_groups: [{ id: permissionGroupId }], resources }],\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; value: string }>;\n    if (!body.success || !body.result?.value) {\n      throw new Error(`Cloudflare token create failed for ${name}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Minted storage credential ${name} scoped to ${buckets.length} bucket(s)`);\n    return body.result;\n  }\n\n  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id\n  async deleteCredential(accessKeyId: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (!body.success) {\n      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Revoked storage credential ${accessKeyId}`);\n  }\n\n  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied\n  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.\n  private async resolveBucketItemWriteGroupId(): Promise<string> {\n    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; name: string }[]>;\n    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);\n    if (!group) {\n      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);\n    }\n\n    this.bucketItemWriteGroupId = group.id;\n    return group.id;\n  }\n\n  private describe(body: CloudflareEnvelope<unknown>): string {\n    return body.errors?.map((e) => `${e.code} ${e.message}`).join('; ') || 'unknown error';\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2StorageProvider } from './providers/r2-storage.provider';\nimport type { R2StorageConfig, StorageProvider } from './types';\n\nexport interface StorageFactoryOptions {\n  r2?: StorageConfigSource<R2StorageConfig>;\n}\n\nexport class StorageFactory {\n  private readonly cache = new Map<string, StorageProvider>();\n\n  constructor(private readonly options: StorageFactoryOptions) {}\n\n  // Resolves a provider by name, constructing it once on first use\n  resolve(provider: string): StorageProvider {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): StorageProvider {\n    switch (provider) {\n      case 'r2':\n        return new R2StorageProvider(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;ACAA,oBAAuB;AAEvB,IAAMA,aAAa;AAmBnB,IAAMC,QAAQ;;;;;;;;;;;;;;AA8BP,IAAMC,oBAAN,MAAMA,mBAAAA;EAnDb,OAmDaA;;;;EACMC,SAAS,IAAIC,qBAAOF,mBAAkBG,IAAI;EAE3D,YAA6BC,QAAiC;SAAjCA,SAAAA;EAAkC;;;EAI/D,MAAMC,eAAeC,YAAoBC,cAAc,IAA0B;AAC/E,UAAMC,MAAM,oBAAIC,KAAAA;AAChB,UAAMC,QAAQ,IAAID,KAAKD,IAAIG,QAAO,IAAKJ,cAAc,KAAK,KAAK,GAAA;AAE/D,UAAMK,WAAW,MAAMC,MAAMf,YAAY;MACvCgB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKZ,OAAOa,cAAc;QAAI,gBAAgB;MAAmB;MACrGC,MAAMC,KAAKC,UAAU;QACnBC,OAAOtB;QACPuB,WAAW;UACTC,YAAY,KAAKnB,OAAOoB;UACxBlB;UACAI,OAAOA,MAAMe,YAAW;UACxBjB,KAAKA,IAAIiB,YAAW;QACtB;MACF,CAAA;IACF,CAAA;AAEA,UAAMP,OAAQ,MAAMN,SAASc,KAAI;AACjC,QAAIR,KAAKS,QAAQC,QAAQ;AACvB,YAAM,IAAIC,MACR,qCAAqCvB,UAAAA,KAAeY,KAAKS,OAAOG,IAAI,CAACC,MAAMA,EAAEC,OAAO,EAAEC,KAAK,IAAA,CAAA,EAAO;IAEtG;AAEA,UAAMC,SAAShB,KAAKiB,MAAMC,QAAQC,WAAW,CAAA,GAAIC,0BAA0B,CAAA,GAAIC;AAC/E,QAAI,CAACL,QAAQ;AACX,WAAKjC,OAAOuC,MAAM,mCAAmClC,UAAAA,EAAY;AACjE,aAAO;QAAEmC,OAAO;QAAGC,aAAa;MAAE;IACpC;AAGA,WAAO;MACLD,QAAQP,OAAOS,eAAe,MAAMT,OAAOU,gBAAgB;MAC3DF,aAAaR,OAAOQ,eAAe;IACrC;EACF;AACF;;;AC1FO,SAASG,iBAAoBC,QAA4CC,UAAgB;AAC9F,MAAID,WAAWE,QAAW;AACxB,UAAM,IAAIC,MAAM,qBAAqBF,QAAAA,sBAA8B;EACrE;AACA,SAAO,OAAOD,WAAW,aAAcA,OAAAA,IAAuBA;AAChE;AALgBD;;;ACJhB,uBAMO;AACP,kCAA6B;AAC7B,IAAAK,kBAAuB;;;ACTvB,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA0C;AAanC,IAAeC,uBAAf,cAA4CC,6BAAAA;EAbnD,OAamDA;;;EACjD,YAAYC,iBAA0CC,YAAwB;AAC5E,UAAMC,UAAU,OAAOF,oBAAoB,WAAW;MAAEG,QAAQH;IAAgB,IAAIA;AAEpF,UACE;MACEI,MAAMF,QAAQE,QAAQ;MACtBC,OAAOH,QAAQG;MACfF,QAAQD,QAAQC;MAChBG,QAAQJ,QAAQI,UAAU,CAAA;IAC5B,GACAL,UAAAA;EAEJ;AACF;;;AC3BA,IAAAM,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;AAGpB,IAAMC,oBAAN,cAAgCC,qBAAAA;EAHvC,OAGuCA;;;EACrC,YAAYC,iBAA2C;AACrD,UAAMA,mBAAmB,aAAaC,2BAAWC,SAAS;EAC5D;AACF;;;ACPA,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;AnBapB,IAAMC,oBAAN,MAAMA,mBAAAA;EAZb,OAYaA;;;;EACMC,SAAS,IAAIC,uBAAOF,mBAAkBG,IAAI;EAC1CC;EAEjB,YAA6BC,QAAyB;SAAzBA,SAAAA;AAC3B,SAAKD,SAAS,IAAIE,0BAAS;MACzBC,QAAQ;MACRC,UAAU,WAAWH,OAAOI,SAAS;MACrCC,aAAa;QAAEC,aAAaN,OAAOM;QAAaC,iBAAiBP,OAAOO;MAAgB;IAC1F,CAAA;EACF;;EAGA,MAAMC,OAAOC,QAAuC;AAClD,UAAM,KAAKV,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcJ,OAAOK,QAAQ,KAAKd,OAAOe,aAAa;MACnEC,KAAKP,OAAOQ;MACZC,MAAMT,OAAOU;MACbC,aAAaX,OAAOY;IACtB,CAAA,CAAA;AAGF,SAAKzB,OAAO0B,IAAI,wBAAwBb,OAAOQ,GAAG,EAAE;AACpD,WAAOR,OAAOQ;EAChB;;EAGA,MAAMM,aAAaN,KAAaE,MAAcE,aAAqBP,QAAkC;AACnG,UAAM,KAAKf,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOwB,YAAY;MAC3DR,KAAKC;MACLC,MAAMC;MACNC,aAAaC;IACf,CAAA,CAAA;AAGF,UAAMI,MAAM,KAAKC,aAAaT,GAAAA;AAC9B,SAAKrB,OAAO0B,IAAI,+BAA+BL,GAAAA,WAASQ,GAAAA,EAAK;AAC7D,WAAOA;EACT;;;EAIAC,aAAaT,KAAqB;AAChC,QAAI,CAAC,KAAKjB,OAAO2B,WAAW;AAC1B,YAAM,IAAIC,MAAM,sEAAA;IAClB;AACA,WAAO,GAAG,KAAK5B,OAAO2B,SAAS,IAAIV,GAAAA;EACrC;;EAGA,MAAMY,OAAOZ,KAAaH,QAAgC;AACxD,UAAM,KAAKf,OAAOW,KAAK,IAAIoB,qCAAoB;MAAElB,QAAQE,UAAU,KAAKd,OAAOe;MAAeC,KAAKC;IAAI,CAAA,CAAA;AAEvG,SAAKrB,OAAO0B,IAAI,yBAAyBL,GAAAA,EAAK;EAChD;;EAGA,MAAMc,aAAad,KAAae,mBAAmB,MAAMlB,QAAkC;AACzF,UAAMmB,UAAU,IAAIC,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA;AAC/G,eAAOc,0CAAa,KAAKhC,QAAQkC,SAAS;MAAEE,WAAWH;IAAiB,CAAA;EAC1E;;EAGA,MAAMI,UAAUnB,KAAaH,QAAoC;AAC/D,UAAMuB,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAIwB,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA,CAAA;AAGjG,QAAI,CAACoB,SAASnB,MAAM;AAClB,YAAM,IAAIoB,kBAAkB,4BAAA;IAC9B;AAEA,WAAOD,SAASnB;EAClB;;;EAIA,MAAMqB,YAAYzB,QAAgB0B,mBAAsD;AACtF,UAAMH,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAI+B,sCAAqB;MAAE7B,QAAQE;MAAQ4B,mBAAmBF;IAAkB,CAAA,CAAA;AAGlF,WAAO;MACLG,UAAUN,SAASO,YAAY,CAAA,GAAIC,IAAI,CAACC,OAAO;QAC7C7B,KAAK6B,EAAE9B,OAAO;QACd+B,MAAMD,EAAEE,QAAQ;QAChBC,cAAcH,EAAEI,gBAAgB,oBAAIC,KAAK,CAAA;MAC3C,EAAA;MACAC,WAAWf,SAASgB;IACtB;EACF;;EAGQxC,cAAcC,QAA4BwC,UAAsC;AACtF,UAAMC,WAAWzC,UAAUwC;AAC3B,QAAI,CAACC,UAAU;AACb,YAAM,IAAI3B,MAAM,qEAAA;IAClB;AACA,WAAO2B;EACT;AACF;;;AoBpHA,IAAAC,kBAAuB;AAGvB,IAAMC,SAAS;AAIf,IAAMC,oBAAoB;AAWnB,IAAMC,sBAAN,MAAMA,qBAAAA;EAlBb,OAkBaA;;;;EACMC,SAAS,IAAIC,uBAAOF,qBAAoBG,IAAI;EAC5CC;EACTC,yBAAwC;EAEhD,YAA6BC,QAA6B;SAA7BA,SAAAA;AAC3B,SAAKF,eAAeE,OAAOF,gBAAgB;EAC7C;;EAGA,MAAMG,aAAaJ,MAA6B;AAC9C,UAAMK,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAe;MACrFC,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;QAC/C,gBAAgB;QAChB,sBAAsB,KAAKV;MAC7B;MACAW,MAAMC,KAAKC,UAAU;QACnBd;QACA,GAAI,KAAKG,OAAOY,gBAAgB;UAAEA,cAAc,KAAKZ,OAAOY;QAAa;MAC3E,CAAA;IACF,CAAA;AAEA,UAAMH,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAIJ,KAAKK,SAAS;AAChB,WAAKnB,OAAOoB,IAAI,kBAAkBlB,IAAAA,EAAM;AACxC;IACF;AAGA,QAAIY,KAAKO,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,EAAQ;AAChD,UAAM,IAAIC,MAAM,uCAAuCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;EACvF;;;EAIA,MAAMa,aAAazB,MAA6B;AAC9C,UAAMK,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAeP,IAAAA,IAAQ;MAC7FQ,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;MAAG;IAC/D,CAAA;AAEA,UAAMC,OAAQ,MAAMP,SAASW,KAAI;AAEjC,QAAIJ,KAAKK,WAAWL,KAAKO,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,GAAQ;AAC9D,WAAKxB,OAAOoB,IAAI,kBAAkBlB,IAAAA,EAAM;AACxC;IACF;AACA,UAAM,IAAIuB,MAAM,uCAAuCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;EACvF;;;;EAKA,MAAMc,mBAAmBC,QAAiC;AACxD,UAAMtB,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAeoB,MAAAA,oBAA0B;MAC/GnB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;QAAI,gBAAgB;MAAmB;MACjGC,MAAMC,KAAKC,UAAU;QAAEc,SAAS;MAAK,CAAA;IACvC,CAAA;AAEA,UAAMhB,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,WAAW,CAACL,KAAKiB,QAAQC,QAAQ;AACzC,YAAM,IAAIP,MAAM,8CAA8CI,MAAAA,KAAW,KAAKH,SAASZ,IAAAA,CAAAA,EAAO;IAChG;AAEA,SAAKd,OAAOoB,IAAI,6BAA6BS,MAAAA,WAAYf,KAAKiB,OAAOC,MAAM,EAAE;AAC7E,WAAO,WAAWlB,KAAKiB,OAAOC,MAAM;EACtC;;;;;EAMA,MAAMC,kBAAkB/B,MAAcgC,SAA2D;AAC/F,UAAMC,oBAAoB,MAAM,KAAKC,8BAA6B;AAIlE,UAAMC,YAAYC,OAAOC,YACvBL,QAAQM,IAAI,CAACX,WAAW;MACtB,iCAAiC,KAAKxB,OAAOI,SAAS,IAAI,KAAKN,YAAY,IAAI0B,MAAAA;MAC/E;KACD,CAAA;AAGH,UAAMtB,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,WAAW;MACjFC,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;QAAI,gBAAgB;MAAmB;MAClG3B,MAAMC,KAAKC,UAAU;QACnBd;QACAwC,UAAU;UAAC;YAAEC,QAAQ;YAASC,mBAAmB;cAAC;gBAAEC,IAAIV;cAAkB;;YAAIE;UAAU;;MAC1F,CAAA;IACF,CAAA;AAEA,UAAMvB,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,WAAW,CAACL,KAAKiB,QAAQe,OAAO;AACxC,YAAM,IAAIrB,MAAM,sCAAsCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;IACtF;AAEA,SAAKd,OAAOoB,IAAI,6BAA6BlB,IAAAA,cAAkBgC,QAAQa,MAAM,YAAY;AACzF,WAAOjC,KAAKiB;EACd;;EAGA,MAAMiB,iBAAiBC,aAAoC;AACzD,UAAM1C,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,WAAWwC,WAAAA,IAAe;MAChGvC,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;MAAG;IAChE,CAAA;AAEA,UAAM3B,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,SAAS;AACjB,YAAM,IAAIM,MAAM,sCAAsCwB,WAAAA,KAAgB,KAAKvB,SAASZ,IAAAA,CAAAA,EAAO;IAC7F;AAEA,SAAKd,OAAOoB,IAAI,8BAA8B6B,WAAAA,EAAa;EAC7D;;;EAIA,MAAcb,gCAAiD;AAC7D,QAAI,KAAKhC,uBAAwB,QAAO,KAAKA;AAE7C,UAAMG,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,6BAA6B;MACnGE,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;MAAG;IAChE,CAAA;AAEA,UAAM3B,OAAQ,MAAMP,SAASW,KAAI;AACjC,UAAMgC,QAAQpC,KAAKiB,QAAQoB,KAAK,CAACC,MAAMA,EAAElD,SAASJ,iBAAAA;AAClD,QAAI,CAACoD,OAAO;AACV,YAAM,IAAIzB,MAAM,gCAAgC3B,iBAAAA,gBAAiC,KAAK4B,SAASZ,IAAAA,CAAAA,EAAO;IACxG;AAEA,SAAKV,yBAAyB8C,MAAML;AACpC,WAAOK,MAAML;EACf;EAEQnB,SAASZ,MAA2C;AAC1D,WAAOA,KAAKO,QAAQmB,IAAI,CAACjB,MAAM,GAAGA,EAAEC,IAAI,IAAID,EAAE8B,OAAO,EAAE,EAAEC,KAAK,IAAA,KAAS;EACzE;AACF;;;ACxJO,IAAMC,iBAAN,MAAMA;EARb,OAQaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAAgC;SAAhCA,UAAAA;EAAiC;;EAG9DC,QAAQC,UAAmC;AACzC,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAmC;AAChD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,kBAAkBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACjE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;","names":["CF_GRAPHQL","QUERY","BucketUsageReader","logger","Logger","name","config","getBucketUsage","bucketName","windowHours","end","Date","start","getTime","response","fetch","method","headers","Authorization","analyticsToken","body","JSON","stringify","query","variables","accountTag","accountId","toISOString","json","errors","length","Error","map","e","message","join","sample","data","viewer","accounts","r2StorageAdaptiveGroups","max","debug","bytes","objectCount","payloadSize","metadataSize","readConfigSource","source","provider","undefined","Error","import_common","import_common","import_common","HttpProblemException","HttpException","detailOrOptions","httpStatus","options","detail","type","label","errors","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","NotFoundException","HttpProblemException","detailOrOptions","HttpStatus","NOT_FOUND","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","R2StorageProvider","logger","Logger","name","client","config","S3Client","region","endpoint","accountId","credentials","accessKeyId","secretAccessKey","upload","params","send","PutObjectCommand","Bucket","requireBucket","bucket","defaultBucket","Key","key","Body","body","ContentType","contentType","log","uploadPublic","publicBucket","url","getPublicUrl","publicUrl","Error","delete","DeleteObjectCommand","getSignedUrl","expiresInSeconds","command","GetObjectCommand","expiresIn","getStream","response","NotFoundException","listObjects","continuationToken","ListObjectsV2Command","ContinuationToken","objects","Contents","map","o","size","Size","lastModified","LastModified","Date","nextToken","NextContinuationToken","fallback","resolved","import_common","CF_API","BUCKET_ITEM_WRITE","R2BucketProvisioner","logger","Logger","name","jurisdiction","bucketItemWriteGroupId","config","createBucket","response","fetch","accountId","method","headers","Authorization","adminToken","body","JSON","stringify","locationHint","json","success","log","errors","some","e","code","Error","describe","deleteBucket","enablePublicAccess","bucket","enabled","result","domain","createScopedToken","buckets","permissionGroupId","resolveBucketItemWriteGroupId","resources","Object","fromEntries","map","tokensToken","policies","effect","permission_groups","id","value","length","deleteCredential","accessKeyId","group","find","g","message","join","StorageFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2StorageProvider","readConfigSource","r2","Error"]}

package/dist/storage.d.cts

@@ -42,25 +42,6 @@ interface StorageProvider {
     getStream(key: string, bucket?: string): Promise<Readable>;
     listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage>;
 }
-interface OrgBuckets {
-    storageBucket: string;
-    storagePublicBucket: string;
-}
-interface OrgCredential {
-    accessKeyId: string;
-    secretAccessKey: string;
-}
-interface OrgStorageProvisioner {
-    provisionOrg(subdomain: string): Promise<OrgStorage>;
-    rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential>;
-    deleteOrgBuckets(buckets: OrgBuckets): Promise<void>;
-    deleteCredential(accessKeyId: string): Promise<void>;
-}
-interface OrgStorageTracking {
-    bucket: string;
-    publicBucket: string;
-    accessKeyId: string | null;
-}
 interface R2ProvisionerConfig {
     accountId: string;
     adminToken: string;
@@ -68,16 +49,6 @@ interface R2ProvisionerConfig {
     locationHint?: string;
     jurisdiction?: string;
 }
-interface OrgStorage {
-    provider: 'r2';
-    accountId: string;
-    bucket: string;
-    publicBucket: string;
-    publicUrl: string | null;
-    accessKeyId: string;
-    secretAccessKey: string;
-    createdAt: string;
-}
 interface R2StorageConfig {
     accountId: string;
     accessKeyId: string;
@@ -102,31 +73,20 @@ declare class R2StorageProvider implements StorageProvider {
     private requireBucket;
 }
 
-interface OrgStorageProvisionerFactoryOptions {
-    r2?: StorageConfigSource<R2ProvisionerConfig>;
-}
-declare class OrgStorageProvisionerFactory {
-    private readonly options;
-    private readonly cache;
-    constructor(options: OrgStorageProvisionerFactoryOptions);
-    resolve(provider: string): OrgStorageProvisioner;
-    private create;
-}
-
-declare function orgBucketNames(subdomain: string): OrgBuckets;
-declare class R2BucketProvisioner implements OrgStorageProvisioner {
+declare class R2BucketProvisioner {
     private readonly config;
     private readonly logger;
     private readonly jurisdiction;
     private bucketItemWriteGroupId;
     constructor(config: R2ProvisionerConfig);
-    provisionOrg(subdomain: string): Promise<OrgStorage>;
-    rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential>;
-    deleteOrgBuckets(buckets: OrgBuckets): Promise<void>;
+    createBucket(name: string): Promise<void>;
+    deleteBucket(name: string): Promise<void>;
+    enablePublicAccess(bucket: string): Promise<string>;
+    createScopedToken(name: string, buckets: string[]): Promise<{
+        id: string;
+        value: string;
+    }>;
     deleteCredential(accessKeyId: string): Promise<void>;
-    private createBucket;
-    private enablePublicAccess;
-    private createScopedToken;
     private resolveBucketItemWriteGroupId;
     private describe;
 }
@@ -142,4 +102,4 @@ declare class StorageFactory {
     private create;
 }
 
-export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig, type ListObjectsPage, type OrgBuckets, type OrgCredential, type OrgStorage, type OrgStorageProvisioner, OrgStorageProvisionerFactory, type OrgStorageProvisionerFactoryOptions, type OrgStorageTracking, R2BucketProvisioner, type R2ProvisionerConfig, type R2StorageConfig, R2StorageProvider, type StorageConfigSource, StorageFactory, type StorageFactoryOptions, type StorageProvider, type StoredObject, type UploadParams, orgBucketNames, readConfigSource };
+export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig, type ListObjectsPage, R2BucketProvisioner, type R2ProvisionerConfig, type R2StorageConfig, R2StorageProvider, type StorageConfigSource, StorageFactory, type StorageFactoryOptions, type StorageProvider, type StoredObject, type UploadParams, readConfigSource };

package/dist/storage.d.ts

@@ -42,25 +42,6 @@ interface StorageProvider {
     getStream(key: string, bucket?: string): Promise<Readable>;
     listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage>;
 }
-interface OrgBuckets {
-    storageBucket: string;
-    storagePublicBucket: string;
-}
-interface OrgCredential {
-    accessKeyId: string;
-    secretAccessKey: string;
-}
-interface OrgStorageProvisioner {
-    provisionOrg(subdomain: string): Promise<OrgStorage>;
-    rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential>;
-    deleteOrgBuckets(buckets: OrgBuckets): Promise<void>;
-    deleteCredential(accessKeyId: string): Promise<void>;
-}
-interface OrgStorageTracking {
-    bucket: string;
-    publicBucket: string;
-    accessKeyId: string | null;
-}
 interface R2ProvisionerConfig {
     accountId: string;
     adminToken: string;
@@ -68,16 +49,6 @@ interface R2ProvisionerConfig {
     locationHint?: string;
     jurisdiction?: string;
 }
-interface OrgStorage {
-    provider: 'r2';
-    accountId: string;
-    bucket: string;
-    publicBucket: string;
-    publicUrl: string | null;
-    accessKeyId: string;
-    secretAccessKey: string;
-    createdAt: string;
-}
 interface R2StorageConfig {
     accountId: string;
     accessKeyId: string;
@@ -102,31 +73,20 @@ declare class R2StorageProvider implements StorageProvider {
     private requireBucket;
 }
 
-interface OrgStorageProvisionerFactoryOptions {
-    r2?: StorageConfigSource<R2ProvisionerConfig>;
-}
-declare class OrgStorageProvisionerFactory {
-    private readonly options;
-    private readonly cache;
-    constructor(options: OrgStorageProvisionerFactoryOptions);
-    resolve(provider: string): OrgStorageProvisioner;
-    private create;
-}
-
-declare function orgBucketNames(subdomain: string): OrgBuckets;
-declare class R2BucketProvisioner implements OrgStorageProvisioner {
+declare class R2BucketProvisioner {
     private readonly config;
     private readonly logger;
     private readonly jurisdiction;
     private bucketItemWriteGroupId;
     constructor(config: R2ProvisionerConfig);
-    provisionOrg(subdomain: string): Promise<OrgStorage>;
-    rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential>;
-    deleteOrgBuckets(buckets: OrgBuckets): Promise<void>;
+    createBucket(name: string): Promise<void>;
+    deleteBucket(name: string): Promise<void>;
+    enablePublicAccess(bucket: string): Promise<string>;
+    createScopedToken(name: string, buckets: string[]): Promise<{
+        id: string;
+        value: string;
+    }>;
     deleteCredential(accessKeyId: string): Promise<void>;
-    private createBucket;
-    private enablePublicAccess;
-    private createScopedToken;
     private resolveBucketItemWriteGroupId;
     private describe;
 }
@@ -142,4 +102,4 @@ declare class StorageFactory {
     private create;
 }
 
-export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig, type ListObjectsPage, type OrgBuckets, type OrgCredential, type OrgStorage, type OrgStorageProvisioner, OrgStorageProvisionerFactory, type OrgStorageProvisionerFactoryOptions, type OrgStorageTracking, R2BucketProvisioner, type R2ProvisionerConfig, type R2StorageConfig, R2StorageProvider, type StorageConfigSource, StorageFactory, type StorageFactoryOptions, type StorageProvider, type StoredObject, type UploadParams, orgBucketNames, readConfigSource };
+export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig, type ListObjectsPage, R2BucketProvisioner, type R2ProvisionerConfig, type R2StorageConfig, R2StorageProvider, type StorageConfigSource, StorageFactory, type StorageFactoryOptions, type StorageProvider, type StoredObject, type UploadParams, readConfigSource };

package/dist/storage.js

@@ -268,17 +268,9 @@ var R2StorageProvider = class _R2StorageProvider {
 };
 
 // src/storage/provisioners/r2-bucket.provisioner.ts
-import { createHash } from "crypto";
 import { Logger as Logger3 } from "@nestjs/common";
 var CF_API = "https://api.cloudflare.com/client/v4";
 var BUCKET_ITEM_WRITE = "Workers R2 Storage Bucket Item Write";
-function orgBucketNames(subdomain) {
-  return {
-    storageBucket: `org-${subdomain}`,
-    storagePublicBucket: `org-${subdomain}-public`
-  };
-}
-__name(orgBucketNames, "orgBucketNames");
 var R2BucketProvisioner = class _R2BucketProvisioner {
   static {
     __name(this, "R2BucketProvisioner");
@@ -291,84 +283,6 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     this.config = config;
     this.jurisdiction = config.jurisdiction ?? "default";
   }
-  // Creates the org's two buckets and one credential scoped to just those buckets
-  async provisionOrg(subdomain) {
-    const names = orgBucketNames(subdomain);
-    await this.createBucket(names.storageBucket);
-    await this.createBucket(names.storagePublicBucket);
-    let publicUrl = null;
-    try {
-      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);
-    } catch (error) {
-      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);
-    }
-    const token = await this.createScopedToken(subdomain, [
-      names.storageBucket,
-      names.storagePublicBucket
-    ]);
-    return {
-      provider: "r2",
-      accountId: this.config.accountId,
-      bucket: names.storageBucket,
-      publicBucket: names.storagePublicBucket,
-      publicUrl,
-      accessKeyId: token.id,
-      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is
-      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.
-      secretAccessKey: createHash("sha256").update(token.value).digest("hex"),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole
-  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.
-  //
-  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org
-  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.
-  async rotateCredential(subdomain, buckets) {
-    const token = await this.createScopedToken(subdomain, [
-      buckets.storageBucket,
-      buckets.storagePublicBucket
-    ]);
-    return {
-      accessKeyId: token.id,
-      secretAccessKey: createHash("sha256").update(token.value).digest("hex")
-    };
-  }
-  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must
-  // have emptied them first — a 'not empty' failure here means that step did not finish.
-  async deleteOrgBuckets(buckets) {
-    for (const bucket of [
-      buckets.storageBucket,
-      buckets.storagePublicBucket
-    ]) {
-      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {
-        method: "DELETE",
-        headers: {
-          Authorization: `Bearer ${this.config.adminToken}`
-        }
-      });
-      const body = await response.json();
-      if (body.success || body.errors?.some((e) => e.code === 10006)) {
-        this.logger.log(`Deleted bucket ${bucket}`);
-        continue;
-      }
-      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);
-    }
-  }
-  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id
-  async deleteCredential(accessKeyId) {
-    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {
-      method: "DELETE",
-      headers: {
-        Authorization: `Bearer ${this.config.tokensToken}`
-      }
-    });
-    const body = await response.json();
-    if (!body.success) {
-      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);
-    }
-    this.logger.log(`Revoked storage credential ${accessKeyId}`);
-  }
   // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile
   async createBucket(name) {
     const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {
@@ -393,9 +307,25 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     if (body.errors?.some((e) => e.code === 10004)) return;
     throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);
   }
-  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as
-  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into
-  // this same field.
+  // Deletes one bucket. R2 refuses to delete a bucket that still holds objects, so the caller must have emptied it
+  // first — a 'not empty' failure here means that step did not finish. A missing bucket counts as success.
+  async deleteBucket(name) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${name}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.adminToken}`
+      }
+    });
+    const body = await response.json();
+    if (body.success || body.errors?.some((e) => e.code === 10006)) {
+      this.logger.log(`Deleted bucket ${name}`);
+      return;
+    }
+    throw new Error(`Cloudflare bucket delete failed for ${name}: ${this.describe(body)}`);
+  }
+  // Turns on the bucket's Cloudflare-managed domain and returns its https URL. NOTE: r2.dev is rate limited and
+  // documented as non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer,
+  // and drops into this same field. Throws on failure; the caller decides whether that is fatal.
   async enablePublicAccess(bucket) {
     const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {
       method: "PUT",
@@ -414,10 +344,11 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     this.logger.log(`Enabled public access for ${bucket} \u2192 ${body.result.domain}`);
     return `https://${body.result.domain}`;
   }
-  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a
+  // Mints an ACCOUNT-owned token that can only touch the named buckets. Account-owned rather than user-owned so a
   // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the
   // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.
-  async createScopedToken(subdomain, buckets) {
+  // `name` is the token's display label; the value is returned by R2 exactly once.
+  async createScopedToken(name, buckets) {
     const permissionGroupId = await this.resolveBucketItemWriteGroupId();
     const resources = Object.fromEntries(buckets.map((bucket) => [
       `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,
@@ -430,7 +361,7 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
-        name: `org-${subdomain}`,
+        name,
         policies: [
           {
             effect: "allow",
@@ -446,11 +377,25 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
     });
     const body = await response.json();
     if (!body.success || !body.result?.value) {
-      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);
+      throw new Error(`Cloudflare token create failed for ${name}: ${this.describe(body)}`);
     }
-    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);
+    this.logger.log(`Minted storage credential ${name} scoped to ${buckets.length} bucket(s)`);
     return body.result;
   }
+  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id
+  async deleteCredential(accessKeyId) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.tokensToken}`
+      }
+    });
+    const body = await response.json();
+    if (!body.success) {
+      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);
+    }
+    this.logger.log(`Revoked storage credential ${accessKeyId}`);
+  }
   // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied
   // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.
   async resolveBucketItemWriteGroupId() {
@@ -473,34 +418,6 @@ var R2BucketProvisioner = class _R2BucketProvisioner {
   }
 };
 
-// src/storage/provisioner.factory.ts
-var OrgStorageProvisionerFactory = class {
-  static {
-    __name(this, "OrgStorageProvisionerFactory");
-  }
-  options;
-  cache = /* @__PURE__ */ new Map();
-  constructor(options) {
-    this.options = options;
-  }
-  // Resolves a provisioner by provider name, constructing it once on first use
-  resolve(provider) {
-    const cached = this.cache.get(provider);
-    if (cached) return cached;
-    const created = this.create(provider);
-    this.cache.set(provider, created);
-    return created;
-  }
-  create(provider) {
-    switch (provider) {
-      case "r2":
-        return new R2BucketProvisioner(readConfigSource(this.options.r2, "r2"));
-      default:
-        throw new Error(`Unsupported storage provider: ${provider}`);
-    }
-  }
-};
-
 // src/storage/storage.factory.ts
 var StorageFactory = class {
   static {
@@ -530,11 +447,9 @@ var StorageFactory = class {
 };
 export {
   BucketUsageReader,
-  OrgStorageProvisionerFactory,
   R2BucketProvisioner,
   R2StorageProvider,
   StorageFactory,
-  orgBucketNames,
   readConfigSource
 };
 //# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/storage/bucket-usage.reader.ts","../src/storage/config-source.ts","../src/storage/providers/r2-storage.provider.ts","../src/exceptions/bad-gateway.exception.ts","../src/exceptions/base-field.exception.ts","../src/exceptions/bad-request.exception.ts","../src/exceptions/conflict.exception.ts","../src/exceptions/forbidden.exception.ts","../src/exceptions/gone.exception.ts","../src/exceptions/internal-server-error.exception.ts","../src/exceptions/method-not-allowed.exception.ts","../src/exceptions/not-acceptable.exception.ts","../src/exceptions/not-found.exception.ts","../src/exceptions/not-implemented.exception.ts","../src/exceptions/payload-too-large.exception.ts","../src/exceptions/request-timeout.exception.ts","../src/exceptions/service-unavailable.exception.ts","../src/exceptions/too-many-requests.exception.ts","../src/exceptions/unauthorized.exception.ts","../src/exceptions/unprocessable-entity.exception.ts","../src/exceptions/unsupported-media-type.exception.ts","../src/exceptions/validation.exception.ts","../src/storage/provisioners/r2-bucket.provisioner.ts","../src/storage/provisioner.factory.ts","../src/storage/storage.factory.ts"],"sourcesContent":["import { Logger } from '@nestjs/common';\n\nconst CF_GRAPHQL = 'https://api.cloudflare.com/client/v4/graphql';\n\nexport interface BucketUsage {\n  bytes: number;\n  objectCount: number;\n}\n\nexport interface BucketUsageReaderConfig {\n  accountId: string;\n  // Account-level token with Analytics Read. NOT the org's scoped S3 credential and NOT the R2 admin token: the\n  // analytics dataset is filtered by accountTag and is not reachable with object-level credentials.\n  analyticsToken: string;\n}\n\n// r2StorageAdaptiveGroups is a time series, so the newest bucketed sample is the closest thing to \"current\". It lags\n// real writes by minutes — fine for a periodic quota check, useless for gating an individual upload.\n//\n// `dimensions { datetime }` is required, not decorative: ordering by a field that is neither aggregated nor selected\n// as a dimension is rejected. Keep the query free of `#` comments too — Cloudflare's parser rejects them.\nconst QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {\n  viewer {\n    accounts(filter: { accountTag: $accountTag }) {\n      r2StorageAdaptiveGroups(\n        limit: 1\n        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }\n        orderBy: [datetime_DESC]\n      ) {\n        max { objectCount payloadSize metadataSize }\n        dimensions { datetime }\n      }\n    }\n  }\n}`;\n\ninterface UsageResponse {\n  errors?: { message: string }[];\n  data?: {\n    viewer?: {\n      accounts?: {\n        r2StorageAdaptiveGroups?: {\n          max?: { objectCount?: number; payloadSize?: number; metadataSize?: number };\n        }[];\n      }[];\n    };\n  };\n}\n\n// Reads how much an org's bucket actually holds, straight from the provider — the authoritative figure a locally\n// maintained counter would only ever approximate.\nexport class BucketUsageReader {\n  private readonly logger = new Logger(BucketUsageReader.name);\n\n  constructor(private readonly config: BucketUsageReaderConfig) {}\n\n  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or\n  // empty bucket produces no rows at all rather than a row of zeroes)\n  async getBucketUsage(bucketName: string, windowHours = 24): Promise<BucketUsage> {\n    const end = new Date();\n    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1000);\n\n    const response = await fetch(CF_GRAPHQL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.analyticsToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        query: QUERY,\n        variables: {\n          accountTag: this.config.accountId,\n          bucketName,\n          start: start.toISOString(),\n          end: end.toISOString(),\n        },\n      }),\n    });\n\n    const body = (await response.json()) as UsageResponse;\n    if (body.errors?.length) {\n      throw new Error(\n        `Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join('; ')}`,\n      );\n    }\n\n    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;\n    if (!sample) {\n      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);\n      return { bytes: 0, objectCount: 0 };\n    }\n\n    // Billed storage is payload plus per-object metadata, so both count against a quota\n    return {\n      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),\n      objectCount: sample.objectCount ?? 0,\n    };\n  }\n}\n","// Config may be a value or a thunk. Servers pass a thunk when the credentials come from required-only-if-selected\n// env keys, so reading them is deferred to the first resolve() instead of running at module construction.\nexport type StorageConfigSource<T> = T | (() => T);\n\n// A backend configured nowhere is a deployment asking for something it was never given credentials for\nexport function readConfigSource<T>(source: StorageConfigSource<T> | undefined, provider: string): T {\n  if (source === undefined) {\n    throw new Error(`Storage provider '${provider}' is not configured.`);\n  }\n  return typeof source === 'function' ? (source as () => T)() : source;\n}\n","import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  ListObjectsV2Command,\n  PutObjectCommand,\n  S3Client,\n} from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Logger } from '@nestjs/common';\nimport { NotFoundException } from '../../exceptions';\nimport type { ListObjectsPage, R2StorageConfig, StorageProvider, UploadParams } from '../types';\n\nexport class R2StorageProvider implements StorageProvider {\n  private readonly logger = new Logger(R2StorageProvider.name);\n  private readonly client: S3Client;\n\n  constructor(private readonly config: R2StorageConfig) {\n    this.client = new S3Client({\n      region: 'auto',\n      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,\n      credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },\n    });\n  }\n\n  // Uploads a file buffer or stream\n  async upload(params: UploadParams): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),\n        Key: params.key,\n        Body: params.body,\n        ContentType: params.contentType,\n      }),\n    );\n\n    this.logger.log(`Uploaded file to R2: ${params.key}`);\n    return params.key;\n  }\n\n  // Uploads a file to a public bucket and returns its permanent URL\n  async uploadPublic(key: string, body: Buffer, contentType: string, bucket?: string): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(bucket, this.config.publicBucket),\n        Key: key,\n        Body: body,\n        ContentType: contentType,\n      }),\n    );\n\n    const url = this.getPublicUrl(key);\n    this.logger.log(`Uploaded public file to R2: ${key} → ${url}`);\n    return url;\n  }\n\n  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,\n  // so a multi-tenant caller with a bucket per org cannot build one at all\n  getPublicUrl(key: string): string {\n    if (!this.config.publicUrl) {\n      throw new Error('R2 storage has no publicUrl configured; public URLs cannot be built.');\n    }\n    return `${this.config.publicUrl}/${key}`;\n  }\n\n  // Deletes a file\n  async delete(key: string, bucket?: string): Promise<void> {\n    await this.client.send(new DeleteObjectCommand({ Bucket: bucket ?? this.config.defaultBucket, Key: key }));\n\n    this.logger.log(`Deleted file from R2: ${key}`);\n  }\n\n  // Generates a presigned download URL (default 1 hour)\n  async getSignedUrl(key: string, expiresInSeconds = 3600, bucket?: string): Promise<string> {\n    const command = new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key });\n    return getSignedUrl(this.client, command, { expiresIn: expiresInSeconds });\n  }\n\n  // Returns a readable stream\n  async getStream(key: string, bucket?: string): Promise<Readable> {\n    const response = await this.client.send(\n      new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key }),\n    );\n\n    if (!response.Body) {\n      throw new NotFoundException('File not found in storage.');\n    }\n\n    return response.Body as Readable;\n  }\n\n  // One page of a bucket's contents. S3 has no \"list everything\" call and no bucket-size call — a full inventory is\n  // this looped until nextToken is absent, and each page is a Class A request.\n  async listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage> {\n    const response = await this.client.send(\n      new ListObjectsV2Command({ Bucket: bucket, ContinuationToken: continuationToken }),\n    );\n\n    return {\n      objects: (response.Contents ?? []).map((o) => ({\n        key: o.Key ?? '',\n        size: o.Size ?? 0,\n        lastModified: o.LastModified ?? new Date(0),\n      })),\n      nextToken: response.NextContinuationToken,\n    };\n  }\n\n  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default\n  private requireBucket(bucket: string | undefined, fallback: string | undefined): string {\n    const resolved = bucket ?? fallback;\n    if (!resolved) {\n      throw new Error('No bucket supplied and R2 storage has no default bucket configured.');\n    }\n    return resolved;\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadGatewayException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Gateway', HttpStatus.BAD_GATEWAY);\n  }\n}\n","import { HttpException, HttpStatus } from '@nestjs/common';\nimport type { FieldError } from '../types/error-response.types';\n\n// Re-export FieldError for backwards compatibility\nexport type { FieldError } from '../types/error-response.types';\n\nexport interface ProblemOptions {\n  type?: string;\n  label?: string;\n  detail?: string;\n  errors?: FieldError[];\n}\n\nexport abstract class HttpProblemException extends HttpException {\n  constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus) {\n    const options = typeof detailOrOptions === 'string' ? { detail: detailOrOptions } : detailOrOptions;\n\n    super(\n      {\n        type: options.type ?? 'about:blank',\n        label: options.label,\n        detail: options.detail,\n        errors: options.errors ?? [],\n      },\n      httpStatus,\n    );\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadRequestException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Request', HttpStatus.BAD_REQUEST);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ConflictException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Conflict', HttpStatus.CONFLICT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ForbiddenException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Forbidden', HttpStatus.FORBIDDEN);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class GoneException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Gone', HttpStatus.GONE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class InternalServerErrorException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Internal Server Error', HttpStatus.INTERNAL_SERVER_ERROR);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class MethodNotAllowedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Method Not Allowed', HttpStatus.METHOD_NOT_ALLOWED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotAcceptableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Acceptable', HttpStatus.NOT_ACCEPTABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotFoundException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Found', HttpStatus.NOT_FOUND);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotImplementedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Implemented', HttpStatus.NOT_IMPLEMENTED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class PayloadTooLargeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Payload Too Large', HttpStatus.PAYLOAD_TOO_LARGE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class RequestTimeoutException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Request Timeout', HttpStatus.REQUEST_TIMEOUT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ServiceUnavailableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Service Unavailable', HttpStatus.SERVICE_UNAVAILABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class TooManyRequestsException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnauthorizedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unauthorized', HttpStatus.UNAUTHORIZED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnprocessableEntityException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unprocessable Entity', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnsupportedMediaTypeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unsupported Media Type', HttpStatus.UNSUPPORTED_MEDIA_TYPE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ValidationException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Validation Failed', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { createHash } from 'node:crypto';\nimport { Logger } from '@nestjs/common';\nimport type { OrgBuckets, OrgCredential, OrgStorage, OrgStorageProvisioner, R2ProvisionerConfig } from '../types';\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\n\n// Bucket-level group: read/write/list objects in named buckets. Deliberately NOT 'Workers R2 Storage Write', which is\n// account-level and can create and delete buckets — exactly what a tenant credential must never do.\nconst BUCKET_ITEM_WRITE = 'Workers R2 Storage Bucket Item Write';\n\n// Bucket names are prefixed because the account also holds Vritti's own buckets, and a subdomain like \"media\" collides\nexport function orgBucketNames(subdomain: string): OrgBuckets {\n  return { storageBucket: `org-${subdomain}`, storagePublicBucket: `org-${subdomain}-public` };\n}\n\ninterface CloudflareEnvelope<T> {\n  success: boolean;\n  errors: { code: number; message: string }[];\n  result: T;\n}\n\nexport class R2BucketProvisioner implements OrgStorageProvisioner {\n  private readonly logger = new Logger(R2BucketProvisioner.name);\n  private readonly jurisdiction: string;\n  private bucketItemWriteGroupId: string | null = null;\n\n  constructor(private readonly config: R2ProvisionerConfig) {\n    this.jurisdiction = config.jurisdiction ?? 'default';\n  }\n\n  // Creates the org's two buckets and one credential scoped to just those buckets\n  async provisionOrg(subdomain: string): Promise<OrgStorage> {\n    const names = orgBucketNames(subdomain);\n    await this.createBucket(names.storageBucket);\n    await this.createBucket(names.storagePublicBucket);\n\n    // Not fatal: an org whose public bucket is private still works for every presigned read, and the URL can be\n    // filled in later. Failing the whole signup over a CDN convenience would be the wrong trade.\n    let publicUrl: string | null = null;\n    try {\n      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);\n    } catch (error: unknown) {\n      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);\n    }\n\n    const token = await this.createScopedToken(subdomain, [names.storageBucket, names.storagePublicBucket]);\n\n    return {\n      provider: 'r2',\n      accountId: this.config.accountId,\n      bucket: names.storageBucket,\n      publicBucket: names.storagePublicBucket,\n      publicUrl,\n      accessKeyId: token.id,\n      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is\n      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n      createdAt: new Date().toISOString(),\n    };\n  }\n\n  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole\n  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.\n  //\n  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org\n  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.\n  async rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential> {\n    const token = await this.createScopedToken(subdomain, [buckets.storageBucket, buckets.storagePublicBucket]);\n\n    return {\n      accessKeyId: token.id,\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n    };\n  }\n\n  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must\n  // have emptied them first — a 'not empty' failure here means that step did not finish.\n  async deleteOrgBuckets(buckets: OrgBuckets): Promise<void> {\n    for (const bucket of [buckets.storageBucket, buckets.storagePublicBucket]) {\n      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {\n        method: 'DELETE',\n        headers: { Authorization: `Bearer ${this.config.adminToken}` },\n      });\n\n      const body = (await response.json()) as CloudflareEnvelope<unknown>;\n      // 10006 is \"bucket not found\" — already gone, which is the state we wanted\n      if (body.success || body.errors?.some((e) => e.code === 10006)) {\n        this.logger.log(`Deleted bucket ${bucket}`);\n        continue;\n      }\n      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);\n    }\n  }\n\n  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id\n  async deleteCredential(accessKeyId: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (!body.success) {\n      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Revoked storage credential ${accessKeyId}`);\n  }\n\n  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile\n  private async createBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.config.adminToken}`,\n        'Content-Type': 'application/json',\n        'cf-r2-jurisdiction': this.jurisdiction,\n      },\n      body: JSON.stringify({\n        name,\n        ...(this.config.locationHint && { locationHint: this.config.locationHint }),\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (body.success) {\n      this.logger.log(`Created bucket ${name}`);\n      return;\n    }\n\n    // 10004 is \"bucket already exists\" — two provisioning attempts racing, or a reconcile pass\n    if (body.errors?.some((e) => e.code === 10004)) return;\n    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as\n  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into\n  // this same field.\n  private async enablePublicAccess(bucket: string): Promise<string | null> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {\n      method: 'PUT',\n      headers: { Authorization: `Bearer ${this.config.adminToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ enabled: true }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ domain?: string; enabled?: boolean }>;\n    if (!body.success || !body.result?.domain) {\n      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Enabled public access for ${bucket} → ${body.result.domain}`);\n    return `https://${body.result.domain}`;\n  }\n\n  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a\n  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the\n  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.\n  private async createScopedToken(subdomain: string, buckets: string[]): Promise<{ id: string; value: string }> {\n    const permissionGroupId = await this.resolveBucketItemWriteGroupId();\n\n    // The jurisdiction is embedded in the resource key and must match the bucket's, or the token authenticates fine\n    // and then 403s on every object because it is scoped to a bucket that does not exist\n    const resources = Object.fromEntries(\n      buckets.map((bucket) => [\n        `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,\n        '*',\n      ]),\n    );\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        name: `org-${subdomain}`,\n        policies: [{ effect: 'allow', permission_groups: [{ id: permissionGroupId }], resources }],\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; value: string }>;\n    if (!body.success || !body.result?.value) {\n      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);\n    return body.result;\n  }\n\n  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied\n  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.\n  private async resolveBucketItemWriteGroupId(): Promise<string> {\n    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; name: string }[]>;\n    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);\n    if (!group) {\n      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);\n    }\n\n    this.bucketItemWriteGroupId = group.id;\n    return group.id;\n  }\n\n  private describe(body: CloudflareEnvelope<unknown>): string {\n    return body.errors?.map((e) => `${e.code} ${e.message}`).join('; ') || 'unknown error';\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nimport type { OrgStorageProvisioner, R2ProvisionerConfig } from './types';\n\nexport interface OrgStorageProvisionerFactoryOptions {\n  r2?: StorageConfigSource<R2ProvisionerConfig>;\n}\n\n// Mirrors StorageFactory for the control-plane side: same provider names, same lazy config, different job\nexport class OrgStorageProvisionerFactory {\n  private readonly cache = new Map<string, OrgStorageProvisioner>();\n\n  constructor(private readonly options: OrgStorageProvisionerFactoryOptions) {}\n\n  // Resolves a provisioner by provider name, constructing it once on first use\n  resolve(provider: string): OrgStorageProvisioner {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): OrgStorageProvisioner {\n    switch (provider) {\n      case 'r2':\n        return new R2BucketProvisioner(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2StorageProvider } from './providers/r2-storage.provider';\nimport type { R2StorageConfig, StorageProvider } from './types';\n\nexport interface StorageFactoryOptions {\n  r2?: StorageConfigSource<R2StorageConfig>;\n}\n\nexport class StorageFactory {\n  private readonly cache = new Map<string, StorageProvider>();\n\n  constructor(private readonly options: StorageFactoryOptions) {}\n\n  // Resolves a provider by name, constructing it once on first use\n  resolve(provider: string): StorageProvider {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): StorageProvider {\n    switch (provider) {\n      case 'r2':\n        return new R2StorageProvider(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n"],"mappings":";;;;AAAA,SAASA,cAAc;AAEvB,IAAMC,aAAa;AAmBnB,IAAMC,QAAQ;;;;;;;;;;;;;;AA8BP,IAAMC,oBAAN,MAAMA,mBAAAA;EAnDb,OAmDaA;;;;EACMC,SAAS,IAAIC,OAAOF,mBAAkBG,IAAI;EAE3D,YAA6BC,QAAiC;SAAjCA,SAAAA;EAAkC;;;EAI/D,MAAMC,eAAeC,YAAoBC,cAAc,IAA0B;AAC/E,UAAMC,MAAM,oBAAIC,KAAAA;AAChB,UAAMC,QAAQ,IAAID,KAAKD,IAAIG,QAAO,IAAKJ,cAAc,KAAK,KAAK,GAAA;AAE/D,UAAMK,WAAW,MAAMC,MAAMf,YAAY;MACvCgB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKZ,OAAOa,cAAc;QAAI,gBAAgB;MAAmB;MACrGC,MAAMC,KAAKC,UAAU;QACnBC,OAAOtB;QACPuB,WAAW;UACTC,YAAY,KAAKnB,OAAOoB;UACxBlB;UACAI,OAAOA,MAAMe,YAAW;UACxBjB,KAAKA,IAAIiB,YAAW;QACtB;MACF,CAAA;IACF,CAAA;AAEA,UAAMP,OAAQ,MAAMN,SAASc,KAAI;AACjC,QAAIR,KAAKS,QAAQC,QAAQ;AACvB,YAAM,IAAIC,MACR,qCAAqCvB,UAAAA,KAAeY,KAAKS,OAAOG,IAAI,CAACC,MAAMA,EAAEC,OAAO,EAAEC,KAAK,IAAA,CAAA,EAAO;IAEtG;AAEA,UAAMC,SAAShB,KAAKiB,MAAMC,QAAQC,WAAW,CAAA,GAAIC,0BAA0B,CAAA,GAAIC;AAC/E,QAAI,CAACL,QAAQ;AACX,WAAKjC,OAAOuC,MAAM,mCAAmClC,UAAAA,EAAY;AACjE,aAAO;QAAEmC,OAAO;QAAGC,aAAa;MAAE;IACpC;AAGA,WAAO;MACLD,QAAQP,OAAOS,eAAe,MAAMT,OAAOU,gBAAgB;MAC3DF,aAAaR,OAAOQ,eAAe;IACrC;EACF;AACF;;;AC1FO,SAASG,iBAAoBC,QAA4CC,UAAgB;AAC9F,MAAID,WAAWE,QAAW;AACxB,UAAM,IAAIC,MAAM,qBAAqBF,QAAAA,sBAA8B;EACrE;AACA,SAAO,OAAOD,WAAW,aAAcA,OAAAA,IAAuBA;AAChE;AALgBD;;;ACJhB,SACEK,qBACAC,kBACAC,sBACAC,kBACAC,gBACK;AACP,SAASC,oBAAoB;AAC7B,SAASC,UAAAA,eAAc;;;ACTvB,SAASC,kBAAkB;;;ACA3B,SAASC,qBAAiC;AAanC,IAAeC,uBAAf,cAA4CC,cAAAA;EAbnD,OAamDA;;;EACjD,YAAYC,iBAA0CC,YAAwB;AAC5E,UAAMC,UAAU,OAAOF,oBAAoB,WAAW;MAAEG,QAAQH;IAAgB,IAAIA;AAEpF,UACE;MACEI,MAAMF,QAAQE,QAAQ;MACtBC,OAAOH,QAAQG;MACfF,QAAQD,QAAQC;MAChBG,QAAQJ,QAAQI,UAAU,CAAA;IAC5B,GACAL,UAAAA;EAEJ;AACF;;;AC3BA,SAASM,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;AAGpB,IAAMC,oBAAN,cAAgCC,qBAAAA;EAHvC,OAGuCA;;;EACrC,YAAYC,iBAA2C;AACrD,UAAMA,mBAAmB,aAAaC,YAAWC,SAAS;EAC5D;AACF;;;ACPA,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;AnBapB,IAAMC,oBAAN,MAAMA,mBAAAA;EAZb,OAYaA;;;;EACMC,SAAS,IAAIC,QAAOF,mBAAkBG,IAAI;EAC1CC;EAEjB,YAA6BC,QAAyB;SAAzBA,SAAAA;AAC3B,SAAKD,SAAS,IAAIE,SAAS;MACzBC,QAAQ;MACRC,UAAU,WAAWH,OAAOI,SAAS;MACrCC,aAAa;QAAEC,aAAaN,OAAOM;QAAaC,iBAAiBP,OAAOO;MAAgB;IAC1F,CAAA;EACF;;EAGA,MAAMC,OAAOC,QAAuC;AAClD,UAAM,KAAKV,OAAOW,KAChB,IAAIC,iBAAiB;MACnBC,QAAQ,KAAKC,cAAcJ,OAAOK,QAAQ,KAAKd,OAAOe,aAAa;MACnEC,KAAKP,OAAOQ;MACZC,MAAMT,OAAOU;MACbC,aAAaX,OAAOY;IACtB,CAAA,CAAA;AAGF,SAAKzB,OAAO0B,IAAI,wBAAwBb,OAAOQ,GAAG,EAAE;AACpD,WAAOR,OAAOQ;EAChB;;EAGA,MAAMM,aAAaN,KAAaE,MAAcE,aAAqBP,QAAkC;AACnG,UAAM,KAAKf,OAAOW,KAChB,IAAIC,iBAAiB;MACnBC,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOwB,YAAY;MAC3DR,KAAKC;MACLC,MAAMC;MACNC,aAAaC;IACf,CAAA,CAAA;AAGF,UAAMI,MAAM,KAAKC,aAAaT,GAAAA;AAC9B,SAAKrB,OAAO0B,IAAI,+BAA+BL,GAAAA,WAASQ,GAAAA,EAAK;AAC7D,WAAOA;EACT;;;EAIAC,aAAaT,KAAqB;AAChC,QAAI,CAAC,KAAKjB,OAAO2B,WAAW;AAC1B,YAAM,IAAIC,MAAM,sEAAA;IAClB;AACA,WAAO,GAAG,KAAK5B,OAAO2B,SAAS,IAAIV,GAAAA;EACrC;;EAGA,MAAMY,OAAOZ,KAAaH,QAAgC;AACxD,UAAM,KAAKf,OAAOW,KAAK,IAAIoB,oBAAoB;MAAElB,QAAQE,UAAU,KAAKd,OAAOe;MAAeC,KAAKC;IAAI,CAAA,CAAA;AAEvG,SAAKrB,OAAO0B,IAAI,yBAAyBL,GAAAA,EAAK;EAChD;;EAGA,MAAMc,aAAad,KAAae,mBAAmB,MAAMlB,QAAkC;AACzF,UAAMmB,UAAU,IAAIC,iBAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA;AAC/G,WAAOc,aAAa,KAAKhC,QAAQkC,SAAS;MAAEE,WAAWH;IAAiB,CAAA;EAC1E;;EAGA,MAAMI,UAAUnB,KAAaH,QAAoC;AAC/D,UAAMuB,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAIwB,iBAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA,CAAA;AAGjG,QAAI,CAACoB,SAASnB,MAAM;AAClB,YAAM,IAAIoB,kBAAkB,4BAAA;IAC9B;AAEA,WAAOD,SAASnB;EAClB;;;EAIA,MAAMqB,YAAYzB,QAAgB0B,mBAAsD;AACtF,UAAMH,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAI+B,qBAAqB;MAAE7B,QAAQE;MAAQ4B,mBAAmBF;IAAkB,CAAA,CAAA;AAGlF,WAAO;MACLG,UAAUN,SAASO,YAAY,CAAA,GAAIC,IAAI,CAACC,OAAO;QAC7C7B,KAAK6B,EAAE9B,OAAO;QACd+B,MAAMD,EAAEE,QAAQ;QAChBC,cAAcH,EAAEI,gBAAgB,oBAAIC,KAAK,CAAA;MAC3C,EAAA;MACAC,WAAWf,SAASgB;IACtB;EACF;;EAGQxC,cAAcC,QAA4BwC,UAAsC;AACtF,UAAMC,WAAWzC,UAAUwC;AAC3B,QAAI,CAACC,UAAU;AACb,YAAM,IAAI3B,MAAM,qEAAA;IAClB;AACA,WAAO2B;EACT;AACF;;;AoBpHA,SAASC,kBAAkB;AAC3B,SAASC,UAAAA,eAAc;AAGvB,IAAMC,SAAS;AAIf,IAAMC,oBAAoB;AAGnB,SAASC,eAAeC,WAAiB;AAC9C,SAAO;IAAEC,eAAe,OAAOD,SAAAA;IAAaE,qBAAqB,OAAOF,SAAAA;EAAmB;AAC7F;AAFgBD;AAUT,IAAMI,sBAAN,MAAMA,qBAAAA;EArBb,OAqBaA;;;;EACMC,SAAS,IAAIC,QAAOF,qBAAoBG,IAAI;EAC5CC;EACTC,yBAAwC;EAEhD,YAA6BC,QAA6B;SAA7BA,SAAAA;AAC3B,SAAKF,eAAeE,OAAOF,gBAAgB;EAC7C;;EAGA,MAAMG,aAAaV,WAAwC;AACzD,UAAMW,QAAQZ,eAAeC,SAAAA;AAC7B,UAAM,KAAKY,aAAaD,MAAMV,aAAa;AAC3C,UAAM,KAAKW,aAAaD,MAAMT,mBAAmB;AAIjD,QAAIW,YAA2B;AAC/B,QAAI;AACFA,kBAAY,MAAM,KAAKC,mBAAmBH,MAAMT,mBAAmB;IACrE,SAASa,OAAgB;AACvB,WAAKX,OAAOY,KAAK,iCAAiCL,MAAMT,mBAAmB,KAAKa,KAAAA,EAAO;IACzF;AAEA,UAAME,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACW,MAAMV;MAAeU,MAAMT;KAAoB;AAEtG,WAAO;MACLiB,UAAU;MACVC,WAAW,KAAKX,OAAOW;MACvBC,QAAQV,MAAMV;MACdqB,cAAcX,MAAMT;MACpBW;MACAU,aAAaN,MAAMO;;;MAGnBC,iBAAiBC,WAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;MACjEC,YAAW,oBAAIC,KAAAA,GAAOC,YAAW;IACnC;EACF;;;;;;EAOA,MAAMC,iBAAiBjC,WAAmBkC,SAA6C;AACrF,UAAMjB,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACkC,QAAQjC;MAAeiC,QAAQhC;KAAoB;AAE1G,WAAO;MACLqB,aAAaN,MAAMO;MACnBC,iBAAiBC,WAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;IACnE;EACF;;;EAIA,MAAMM,iBAAiBD,SAAoC;AACzD,eAAWb,UAAU;MAACa,QAAQjC;MAAeiC,QAAQhC;OAAsB;AACzE,YAAMkC,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,IAAU;QAC/FiB,QAAQ;QACRC,SAAS;UAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAG;MAC/D,CAAA;AAEA,YAAMC,OAAQ,MAAMN,SAASO,KAAI;AAEjC,UAAID,KAAKE,WAAWF,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,GAAQ;AAC9D,aAAK5C,OAAO6C,IAAI,kBAAkB5B,MAAAA,EAAQ;AAC1C;MACF;AACA,YAAM,IAAI6B,MAAM,uCAAuC7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IACzF;EACF;;EAGA,MAAMU,iBAAiB7B,aAAoC;AACzD,UAAMa,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAWG,WAAAA,IAAe;MAChGe,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,SAAS;AACjB,YAAM,IAAIM,MAAM,sCAAsC3B,WAAAA,KAAgB,KAAK4B,SAAST,IAAAA,CAAAA,EAAO;IAC7F;AAEA,SAAKtC,OAAO6C,IAAI,8BAA8B1B,WAAAA,EAAa;EAC7D;;EAGA,MAAcX,aAAaN,MAA6B;AACtD,UAAM8B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAe;MACrFkB,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAC/C,gBAAgB;QAChB,sBAAsB,KAAKlC;MAC7B;MACAmC,MAAMY,KAAKC,UAAU;QACnBjD;QACA,GAAI,KAAKG,OAAO+C,gBAAgB;UAAEA,cAAc,KAAK/C,OAAO+C;QAAa;MAC3E,CAAA;IACF,CAAA;AAEA,UAAMd,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAID,KAAKE,SAAS;AAChB,WAAKxC,OAAO6C,IAAI,kBAAkB3C,IAAAA,EAAM;AACxC;IACF;AAGA,QAAIoC,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,EAAQ;AAChD,UAAM,IAAIE,MAAM,uCAAuC5C,IAAAA,KAAS,KAAK6C,SAAST,IAAAA,CAAAA,EAAO;EACvF;;;;EAKA,MAAc5B,mBAAmBO,QAAwC;AACvE,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,oBAA0B;MAC/GiB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAI,gBAAgB;MAAmB;MACjGC,MAAMY,KAAKC,UAAU;QAAEE,SAAS;MAAK,CAAA;IACvC,CAAA;AAEA,UAAMf,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQC,QAAQ;AACzC,YAAM,IAAIT,MAAM,8CAA8C7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IAChG;AAEA,SAAKtC,OAAO6C,IAAI,6BAA6B5B,MAAAA,WAAYqB,KAAKgB,OAAOC,MAAM,EAAE;AAC7E,WAAO,WAAWjB,KAAKgB,OAAOC,MAAM;EACtC;;;;EAKA,MAAczC,kBAAkBlB,WAAmBkC,SAA2D;AAC5G,UAAM0B,oBAAoB,MAAM,KAAKC,8BAA6B;AAIlE,UAAMC,YAAYC,OAAOC,YACvB9B,QAAQ+B,IAAI,CAAC5C,WAAW;MACtB,iCAAiC,KAAKZ,OAAOW,SAAS,IAAI,KAAKb,YAAY,IAAIc,MAAAA;MAC/E;KACD,CAAA;AAGH,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAW;MACjFkB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;QAAI,gBAAgB;MAAmB;MAClGX,MAAMY,KAAKC,UAAU;QACnBjD,MAAM,OAAON,SAAAA;QACbkE,UAAU;UAAC;YAAEC,QAAQ;YAASC,mBAAmB;cAAC;gBAAE5C,IAAIoC;cAAkB;;YAAIE;UAAU;;MAC1F,CAAA;IACF,CAAA;AAEA,UAAMpB,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQ9B,OAAO;AACxC,YAAM,IAAIsB,MAAM,0CAA0ClD,SAAAA,KAAc,KAAKmD,SAAST,IAAAA,CAAAA,EAAO;IAC/F;AAEA,SAAKtC,OAAO6C,IAAI,qCAAqCjD,SAAAA,cAAuBkC,QAAQmC,MAAM,YAAY;AACtG,WAAO3B,KAAKgB;EACd;;;EAIA,MAAcG,gCAAiD;AAC7D,QAAI,KAAKrD,uBAAwB,QAAO,KAAKA;AAE7C,UAAM4B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,6BAA6B;MACnGmB,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,UAAM2B,QAAQ5B,KAAKgB,QAAQa,KAAK,CAACC,MAAMA,EAAElE,SAASR,iBAAAA;AAClD,QAAI,CAACwE,OAAO;AACV,YAAM,IAAIpB,MAAM,gCAAgCpD,iBAAAA,gBAAiC,KAAKqD,SAAST,IAAAA,CAAAA,EAAO;IACxG;AAEA,SAAKlC,yBAAyB8D,MAAM9C;AACpC,WAAO8C,MAAM9C;EACf;EAEQ2B,SAAST,MAA2C;AAC1D,WAAOA,KAAKG,QAAQoB,IAAI,CAAClB,MAAM,GAAGA,EAAEC,IAAI,IAAID,EAAE0B,OAAO,EAAE,EAAEC,KAAK,IAAA,KAAS;EACzE;AACF;;;ACxMO,IAAMC,+BAAN,MAAMA;EATb,OASaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAA8C;SAA9CA,UAAAA;EAA+C;;EAG5EC,QAAQC,UAAyC;AAC/C,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAyC;AACtD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,oBAAoBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACnE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;;;ACxBO,IAAMU,iBAAN,MAAMA;EARb,OAQaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAAgC;SAAhCA,UAAAA;EAAiC;;EAG9DC,QAAQC,UAAmC;AACzC,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAmC;AAChD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,kBAAkBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACjE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;","names":["Logger","CF_GRAPHQL","QUERY","BucketUsageReader","logger","Logger","name","config","getBucketUsage","bucketName","windowHours","end","Date","start","getTime","response","fetch","method","headers","Authorization","analyticsToken","body","JSON","stringify","query","variables","accountTag","accountId","toISOString","json","errors","length","Error","map","e","message","join","sample","data","viewer","accounts","r2StorageAdaptiveGroups","max","debug","bytes","objectCount","payloadSize","metadataSize","readConfigSource","source","provider","undefined","Error","DeleteObjectCommand","GetObjectCommand","ListObjectsV2Command","PutObjectCommand","S3Client","getSignedUrl","Logger","HttpStatus","HttpException","HttpProblemException","HttpException","detailOrOptions","httpStatus","options","detail","type","label","errors","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","NotFoundException","HttpProblemException","detailOrOptions","HttpStatus","NOT_FOUND","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","R2StorageProvider","logger","Logger","name","client","config","S3Client","region","endpoint","accountId","credentials","accessKeyId","secretAccessKey","upload","params","send","PutObjectCommand","Bucket","requireBucket","bucket","defaultBucket","Key","key","Body","body","ContentType","contentType","log","uploadPublic","publicBucket","url","getPublicUrl","publicUrl","Error","delete","DeleteObjectCommand","getSignedUrl","expiresInSeconds","command","GetObjectCommand","expiresIn","getStream","response","NotFoundException","listObjects","continuationToken","ListObjectsV2Command","ContinuationToken","objects","Contents","map","o","size","Size","lastModified","LastModified","Date","nextToken","NextContinuationToken","fallback","resolved","createHash","Logger","CF_API","BUCKET_ITEM_WRITE","orgBucketNames","subdomain","storageBucket","storagePublicBucket","R2BucketProvisioner","logger","Logger","name","jurisdiction","bucketItemWriteGroupId","config","provisionOrg","names","createBucket","publicUrl","enablePublicAccess","error","warn","token","createScopedToken","provider","accountId","bucket","publicBucket","accessKeyId","id","secretAccessKey","createHash","update","value","digest","createdAt","Date","toISOString","rotateCredential","buckets","deleteOrgBuckets","response","fetch","method","headers","Authorization","adminToken","body","json","success","errors","some","e","code","log","Error","describe","deleteCredential","tokensToken","JSON","stringify","locationHint","enabled","result","domain","permissionGroupId","resolveBucketItemWriteGroupId","resources","Object","fromEntries","map","policies","effect","permission_groups","length","group","find","g","message","join","OrgStorageProvisionerFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2BucketProvisioner","readConfigSource","r2","Error","StorageFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2StorageProvider","readConfigSource","r2","Error"]}
+{"version":3,"sources":["../src/storage/bucket-usage.reader.ts","../src/storage/config-source.ts","../src/storage/providers/r2-storage.provider.ts","../src/exceptions/bad-gateway.exception.ts","../src/exceptions/base-field.exception.ts","../src/exceptions/bad-request.exception.ts","../src/exceptions/conflict.exception.ts","../src/exceptions/forbidden.exception.ts","../src/exceptions/gone.exception.ts","../src/exceptions/internal-server-error.exception.ts","../src/exceptions/method-not-allowed.exception.ts","../src/exceptions/not-acceptable.exception.ts","../src/exceptions/not-found.exception.ts","../src/exceptions/not-implemented.exception.ts","../src/exceptions/payload-too-large.exception.ts","../src/exceptions/request-timeout.exception.ts","../src/exceptions/service-unavailable.exception.ts","../src/exceptions/too-many-requests.exception.ts","../src/exceptions/unauthorized.exception.ts","../src/exceptions/unprocessable-entity.exception.ts","../src/exceptions/unsupported-media-type.exception.ts","../src/exceptions/validation.exception.ts","../src/storage/provisioners/r2-bucket.provisioner.ts","../src/storage/storage.factory.ts"],"sourcesContent":["import { Logger } from '@nestjs/common';\n\nconst CF_GRAPHQL = 'https://api.cloudflare.com/client/v4/graphql';\n\nexport interface BucketUsage {\n  bytes: number;\n  objectCount: number;\n}\n\nexport interface BucketUsageReaderConfig {\n  accountId: string;\n  // Account-level token with Analytics Read. NOT the org's scoped S3 credential and NOT the R2 admin token: the\n  // analytics dataset is filtered by accountTag and is not reachable with object-level credentials.\n  analyticsToken: string;\n}\n\n// r2StorageAdaptiveGroups is a time series, so the newest bucketed sample is the closest thing to \"current\". It lags\n// real writes by minutes — fine for a periodic quota check, useless for gating an individual upload.\n//\n// `dimensions { datetime }` is required, not decorative: ordering by a field that is neither aggregated nor selected\n// as a dimension is rejected. Keep the query free of `#` comments too — Cloudflare's parser rejects them.\nconst QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {\n  viewer {\n    accounts(filter: { accountTag: $accountTag }) {\n      r2StorageAdaptiveGroups(\n        limit: 1\n        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }\n        orderBy: [datetime_DESC]\n      ) {\n        max { objectCount payloadSize metadataSize }\n        dimensions { datetime }\n      }\n    }\n  }\n}`;\n\ninterface UsageResponse {\n  errors?: { message: string }[];\n  data?: {\n    viewer?: {\n      accounts?: {\n        r2StorageAdaptiveGroups?: {\n          max?: { objectCount?: number; payloadSize?: number; metadataSize?: number };\n        }[];\n      }[];\n    };\n  };\n}\n\n// Reads how much an org's bucket actually holds, straight from the provider — the authoritative figure a locally\n// maintained counter would only ever approximate.\nexport class BucketUsageReader {\n  private readonly logger = new Logger(BucketUsageReader.name);\n\n  constructor(private readonly config: BucketUsageReaderConfig) {}\n\n  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or\n  // empty bucket produces no rows at all rather than a row of zeroes)\n  async getBucketUsage(bucketName: string, windowHours = 24): Promise<BucketUsage> {\n    const end = new Date();\n    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1000);\n\n    const response = await fetch(CF_GRAPHQL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.analyticsToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        query: QUERY,\n        variables: {\n          accountTag: this.config.accountId,\n          bucketName,\n          start: start.toISOString(),\n          end: end.toISOString(),\n        },\n      }),\n    });\n\n    const body = (await response.json()) as UsageResponse;\n    if (body.errors?.length) {\n      throw new Error(\n        `Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join('; ')}`,\n      );\n    }\n\n    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;\n    if (!sample) {\n      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);\n      return { bytes: 0, objectCount: 0 };\n    }\n\n    // Billed storage is payload plus per-object metadata, so both count against a quota\n    return {\n      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),\n      objectCount: sample.objectCount ?? 0,\n    };\n  }\n}\n","// Config may be a value or a thunk. Servers pass a thunk when the credentials come from required-only-if-selected\n// env keys, so reading them is deferred to the first resolve() instead of running at module construction.\nexport type StorageConfigSource<T> = T | (() => T);\n\n// A backend configured nowhere is a deployment asking for something it was never given credentials for\nexport function readConfigSource<T>(source: StorageConfigSource<T> | undefined, provider: string): T {\n  if (source === undefined) {\n    throw new Error(`Storage provider '${provider}' is not configured.`);\n  }\n  return typeof source === 'function' ? (source as () => T)() : source;\n}\n","import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  ListObjectsV2Command,\n  PutObjectCommand,\n  S3Client,\n} from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Logger } from '@nestjs/common';\nimport { NotFoundException } from '../../exceptions';\nimport type { ListObjectsPage, R2StorageConfig, StorageProvider, UploadParams } from '../types';\n\nexport class R2StorageProvider implements StorageProvider {\n  private readonly logger = new Logger(R2StorageProvider.name);\n  private readonly client: S3Client;\n\n  constructor(private readonly config: R2StorageConfig) {\n    this.client = new S3Client({\n      region: 'auto',\n      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,\n      credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },\n    });\n  }\n\n  // Uploads a file buffer or stream\n  async upload(params: UploadParams): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),\n        Key: params.key,\n        Body: params.body,\n        ContentType: params.contentType,\n      }),\n    );\n\n    this.logger.log(`Uploaded file to R2: ${params.key}`);\n    return params.key;\n  }\n\n  // Uploads a file to a public bucket and returns its permanent URL\n  async uploadPublic(key: string, body: Buffer, contentType: string, bucket?: string): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(bucket, this.config.publicBucket),\n        Key: key,\n        Body: body,\n        ContentType: contentType,\n      }),\n    );\n\n    const url = this.getPublicUrl(key);\n    this.logger.log(`Uploaded public file to R2: ${key} → ${url}`);\n    return url;\n  }\n\n  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,\n  // so a multi-tenant caller with a bucket per org cannot build one at all\n  getPublicUrl(key: string): string {\n    if (!this.config.publicUrl) {\n      throw new Error('R2 storage has no publicUrl configured; public URLs cannot be built.');\n    }\n    return `${this.config.publicUrl}/${key}`;\n  }\n\n  // Deletes a file\n  async delete(key: string, bucket?: string): Promise<void> {\n    await this.client.send(new DeleteObjectCommand({ Bucket: bucket ?? this.config.defaultBucket, Key: key }));\n\n    this.logger.log(`Deleted file from R2: ${key}`);\n  }\n\n  // Generates a presigned download URL (default 1 hour)\n  async getSignedUrl(key: string, expiresInSeconds = 3600, bucket?: string): Promise<string> {\n    const command = new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key });\n    return getSignedUrl(this.client, command, { expiresIn: expiresInSeconds });\n  }\n\n  // Returns a readable stream\n  async getStream(key: string, bucket?: string): Promise<Readable> {\n    const response = await this.client.send(\n      new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key }),\n    );\n\n    if (!response.Body) {\n      throw new NotFoundException('File not found in storage.');\n    }\n\n    return response.Body as Readable;\n  }\n\n  // One page of a bucket's contents. S3 has no \"list everything\" call and no bucket-size call — a full inventory is\n  // this looped until nextToken is absent, and each page is a Class A request.\n  async listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage> {\n    const response = await this.client.send(\n      new ListObjectsV2Command({ Bucket: bucket, ContinuationToken: continuationToken }),\n    );\n\n    return {\n      objects: (response.Contents ?? []).map((o) => ({\n        key: o.Key ?? '',\n        size: o.Size ?? 0,\n        lastModified: o.LastModified ?? new Date(0),\n      })),\n      nextToken: response.NextContinuationToken,\n    };\n  }\n\n  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default\n  private requireBucket(bucket: string | undefined, fallback: string | undefined): string {\n    const resolved = bucket ?? fallback;\n    if (!resolved) {\n      throw new Error('No bucket supplied and R2 storage has no default bucket configured.');\n    }\n    return resolved;\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadGatewayException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Gateway', HttpStatus.BAD_GATEWAY);\n  }\n}\n","import { HttpException, HttpStatus } from '@nestjs/common';\nimport type { FieldError } from '../types/error-response.types';\n\n// Re-export FieldError for backwards compatibility\nexport type { FieldError } from '../types/error-response.types';\n\nexport interface ProblemOptions {\n  type?: string;\n  label?: string;\n  detail?: string;\n  errors?: FieldError[];\n}\n\nexport abstract class HttpProblemException extends HttpException {\n  constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus) {\n    const options = typeof detailOrOptions === 'string' ? { detail: detailOrOptions } : detailOrOptions;\n\n    super(\n      {\n        type: options.type ?? 'about:blank',\n        label: options.label,\n        detail: options.detail,\n        errors: options.errors ?? [],\n      },\n      httpStatus,\n    );\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadRequestException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Request', HttpStatus.BAD_REQUEST);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ConflictException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Conflict', HttpStatus.CONFLICT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ForbiddenException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Forbidden', HttpStatus.FORBIDDEN);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class GoneException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Gone', HttpStatus.GONE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class InternalServerErrorException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Internal Server Error', HttpStatus.INTERNAL_SERVER_ERROR);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class MethodNotAllowedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Method Not Allowed', HttpStatus.METHOD_NOT_ALLOWED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotAcceptableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Acceptable', HttpStatus.NOT_ACCEPTABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotFoundException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Found', HttpStatus.NOT_FOUND);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotImplementedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Implemented', HttpStatus.NOT_IMPLEMENTED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class PayloadTooLargeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Payload Too Large', HttpStatus.PAYLOAD_TOO_LARGE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class RequestTimeoutException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Request Timeout', HttpStatus.REQUEST_TIMEOUT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ServiceUnavailableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Service Unavailable', HttpStatus.SERVICE_UNAVAILABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class TooManyRequestsException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnauthorizedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unauthorized', HttpStatus.UNAUTHORIZED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnprocessableEntityException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unprocessable Entity', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnsupportedMediaTypeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unsupported Media Type', HttpStatus.UNSUPPORTED_MEDIA_TYPE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ValidationException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Validation Failed', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { Logger } from '@nestjs/common';\nimport type { R2ProvisionerConfig } from '../types';\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\n\n// Bucket-level group: read/write/list objects in named buckets. Deliberately NOT 'Workers R2 Storage Write', which is\n// account-level and can create and delete buckets — exactly what a tenant credential must never do.\nconst BUCKET_ITEM_WRITE = 'Workers R2 Storage Bucket Item Write';\n\ninterface CloudflareEnvelope<T> {\n  success: boolean;\n  errors: { code: number; message: string }[];\n  result: T;\n}\n\n// Generic R2 admin client: create/delete buckets, toggle a bucket's Cloudflare-managed public domain, and mint/revoke\n// bucket-scoped credentials. It has NO notion of organizations — bucket naming, which buckets a tenant gets, and how\n// the stored descriptor is assembled all live in the caller. Every operation is a Cloudflare REST call.\nexport class R2BucketProvisioner {\n  private readonly logger = new Logger(R2BucketProvisioner.name);\n  private readonly jurisdiction: string;\n  private bucketItemWriteGroupId: string | null = null;\n\n  constructor(private readonly config: R2ProvisionerConfig) {\n    this.jurisdiction = config.jurisdiction ?? 'default';\n  }\n\n  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile\n  async createBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.config.adminToken}`,\n        'Content-Type': 'application/json',\n        'cf-r2-jurisdiction': this.jurisdiction,\n      },\n      body: JSON.stringify({\n        name,\n        ...(this.config.locationHint && { locationHint: this.config.locationHint }),\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (body.success) {\n      this.logger.log(`Created bucket ${name}`);\n      return;\n    }\n\n    // 10004 is \"bucket already exists\" — two provisioning attempts racing, or a reconcile pass\n    if (body.errors?.some((e) => e.code === 10004)) return;\n    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Deletes one bucket. R2 refuses to delete a bucket that still holds objects, so the caller must have emptied it\n  // first — a 'not empty' failure here means that step did not finish. A missing bucket counts as success.\n  async deleteBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${name}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.adminToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    // 10006 is \"bucket not found\" — already gone, which is the state we wanted\n    if (body.success || body.errors?.some((e) => e.code === 10006)) {\n      this.logger.log(`Deleted bucket ${name}`);\n      return;\n    }\n    throw new Error(`Cloudflare bucket delete failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Turns on the bucket's Cloudflare-managed domain and returns its https URL. NOTE: r2.dev is rate limited and\n  // documented as non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer,\n  // and drops into this same field. Throws on failure; the caller decides whether that is fatal.\n  async enablePublicAccess(bucket: string): Promise<string> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {\n      method: 'PUT',\n      headers: { Authorization: `Bearer ${this.config.adminToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ enabled: true }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ domain?: string; enabled?: boolean }>;\n    if (!body.success || !body.result?.domain) {\n      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Enabled public access for ${bucket} → ${body.result.domain}`);\n    return `https://${body.result.domain}`;\n  }\n\n  // Mints an ACCOUNT-owned token that can only touch the named buckets. Account-owned rather than user-owned so a\n  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the\n  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.\n  // `name` is the token's display label; the value is returned by R2 exactly once.\n  async createScopedToken(name: string, buckets: string[]): Promise<{ id: string; value: string }> {\n    const permissionGroupId = await this.resolveBucketItemWriteGroupId();\n\n    // The jurisdiction is embedded in the resource key and must match the bucket's, or the token authenticates fine\n    // and then 403s on every object because it is scoped to a bucket that does not exist\n    const resources = Object.fromEntries(\n      buckets.map((bucket) => [\n        `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,\n        '*',\n      ]),\n    );\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        name,\n        policies: [{ effect: 'allow', permission_groups: [{ id: permissionGroupId }], resources }],\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; value: string }>;\n    if (!body.success || !body.result?.value) {\n      throw new Error(`Cloudflare token create failed for ${name}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Minted storage credential ${name} scoped to ${buckets.length} bucket(s)`);\n    return body.result;\n  }\n\n  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id\n  async deleteCredential(accessKeyId: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (!body.success) {\n      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Revoked storage credential ${accessKeyId}`);\n  }\n\n  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied\n  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.\n  private async resolveBucketItemWriteGroupId(): Promise<string> {\n    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; name: string }[]>;\n    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);\n    if (!group) {\n      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);\n    }\n\n    this.bucketItemWriteGroupId = group.id;\n    return group.id;\n  }\n\n  private describe(body: CloudflareEnvelope<unknown>): string {\n    return body.errors?.map((e) => `${e.code} ${e.message}`).join('; ') || 'unknown error';\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2StorageProvider } from './providers/r2-storage.provider';\nimport type { R2StorageConfig, StorageProvider } from './types';\n\nexport interface StorageFactoryOptions {\n  r2?: StorageConfigSource<R2StorageConfig>;\n}\n\nexport class StorageFactory {\n  private readonly cache = new Map<string, StorageProvider>();\n\n  constructor(private readonly options: StorageFactoryOptions) {}\n\n  // Resolves a provider by name, constructing it once on first use\n  resolve(provider: string): StorageProvider {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): StorageProvider {\n    switch (provider) {\n      case 'r2':\n        return new R2StorageProvider(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n"],"mappings":";;;;AAAA,SAASA,cAAc;AAEvB,IAAMC,aAAa;AAmBnB,IAAMC,QAAQ;;;;;;;;;;;;;;AA8BP,IAAMC,oBAAN,MAAMA,mBAAAA;EAnDb,OAmDaA;;;;EACMC,SAAS,IAAIC,OAAOF,mBAAkBG,IAAI;EAE3D,YAA6BC,QAAiC;SAAjCA,SAAAA;EAAkC;;;EAI/D,MAAMC,eAAeC,YAAoBC,cAAc,IAA0B;AAC/E,UAAMC,MAAM,oBAAIC,KAAAA;AAChB,UAAMC,QAAQ,IAAID,KAAKD,IAAIG,QAAO,IAAKJ,cAAc,KAAK,KAAK,GAAA;AAE/D,UAAMK,WAAW,MAAMC,MAAMf,YAAY;MACvCgB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKZ,OAAOa,cAAc;QAAI,gBAAgB;MAAmB;MACrGC,MAAMC,KAAKC,UAAU;QACnBC,OAAOtB;QACPuB,WAAW;UACTC,YAAY,KAAKnB,OAAOoB;UACxBlB;UACAI,OAAOA,MAAMe,YAAW;UACxBjB,KAAKA,IAAIiB,YAAW;QACtB;MACF,CAAA;IACF,CAAA;AAEA,UAAMP,OAAQ,MAAMN,SAASc,KAAI;AACjC,QAAIR,KAAKS,QAAQC,QAAQ;AACvB,YAAM,IAAIC,MACR,qCAAqCvB,UAAAA,KAAeY,KAAKS,OAAOG,IAAI,CAACC,MAAMA,EAAEC,OAAO,EAAEC,KAAK,IAAA,CAAA,EAAO;IAEtG;AAEA,UAAMC,SAAShB,KAAKiB,MAAMC,QAAQC,WAAW,CAAA,GAAIC,0BAA0B,CAAA,GAAIC;AAC/E,QAAI,CAACL,QAAQ;AACX,WAAKjC,OAAOuC,MAAM,mCAAmClC,UAAAA,EAAY;AACjE,aAAO;QAAEmC,OAAO;QAAGC,aAAa;MAAE;IACpC;AAGA,WAAO;MACLD,QAAQP,OAAOS,eAAe,MAAMT,OAAOU,gBAAgB;MAC3DF,aAAaR,OAAOQ,eAAe;IACrC;EACF;AACF;;;AC1FO,SAASG,iBAAoBC,QAA4CC,UAAgB;AAC9F,MAAID,WAAWE,QAAW;AACxB,UAAM,IAAIC,MAAM,qBAAqBF,QAAAA,sBAA8B;EACrE;AACA,SAAO,OAAOD,WAAW,aAAcA,OAAAA,IAAuBA;AAChE;AALgBD;;;ACJhB,SACEK,qBACAC,kBACAC,sBACAC,kBACAC,gBACK;AACP,SAASC,oBAAoB;AAC7B,SAASC,UAAAA,eAAc;;;ACTvB,SAASC,kBAAkB;;;ACA3B,SAASC,qBAAiC;AAanC,IAAeC,uBAAf,cAA4CC,cAAAA;EAbnD,OAamDA;;;EACjD,YAAYC,iBAA0CC,YAAwB;AAC5E,UAAMC,UAAU,OAAOF,oBAAoB,WAAW;MAAEG,QAAQH;IAAgB,IAAIA;AAEpF,UACE;MACEI,MAAMF,QAAQE,QAAQ;MACtBC,OAAOH,QAAQG;MACfF,QAAQD,QAAQC;MAChBG,QAAQJ,QAAQI,UAAU,CAAA;IAC5B,GACAL,UAAAA;EAEJ;AACF;;;AC3BA,SAASM,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;;;ACA3B,SAASC,cAAAA,mBAAkB;AAGpB,IAAMC,oBAAN,cAAgCC,qBAAAA;EAHvC,OAGuCA;;;EACrC,YAAYC,iBAA2C;AACrD,UAAMA,mBAAmB,aAAaC,YAAWC,SAAS;EAC5D;AACF;;;ACPA,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;ACA3B,SAASC,cAAAA,oBAAkB;;;AnBapB,IAAMC,oBAAN,MAAMA,mBAAAA;EAZb,OAYaA;;;;EACMC,SAAS,IAAIC,QAAOF,mBAAkBG,IAAI;EAC1CC;EAEjB,YAA6BC,QAAyB;SAAzBA,SAAAA;AAC3B,SAAKD,SAAS,IAAIE,SAAS;MACzBC,QAAQ;MACRC,UAAU,WAAWH,OAAOI,SAAS;MACrCC,aAAa;QAAEC,aAAaN,OAAOM;QAAaC,iBAAiBP,OAAOO;MAAgB;IAC1F,CAAA;EACF;;EAGA,MAAMC,OAAOC,QAAuC;AAClD,UAAM,KAAKV,OAAOW,KAChB,IAAIC,iBAAiB;MACnBC,QAAQ,KAAKC,cAAcJ,OAAOK,QAAQ,KAAKd,OAAOe,aAAa;MACnEC,KAAKP,OAAOQ;MACZC,MAAMT,OAAOU;MACbC,aAAaX,OAAOY;IACtB,CAAA,CAAA;AAGF,SAAKzB,OAAO0B,IAAI,wBAAwBb,OAAOQ,GAAG,EAAE;AACpD,WAAOR,OAAOQ;EAChB;;EAGA,MAAMM,aAAaN,KAAaE,MAAcE,aAAqBP,QAAkC;AACnG,UAAM,KAAKf,OAAOW,KAChB,IAAIC,iBAAiB;MACnBC,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOwB,YAAY;MAC3DR,KAAKC;MACLC,MAAMC;MACNC,aAAaC;IACf,CAAA,CAAA;AAGF,UAAMI,MAAM,KAAKC,aAAaT,GAAAA;AAC9B,SAAKrB,OAAO0B,IAAI,+BAA+BL,GAAAA,WAASQ,GAAAA,EAAK;AAC7D,WAAOA;EACT;;;EAIAC,aAAaT,KAAqB;AAChC,QAAI,CAAC,KAAKjB,OAAO2B,WAAW;AAC1B,YAAM,IAAIC,MAAM,sEAAA;IAClB;AACA,WAAO,GAAG,KAAK5B,OAAO2B,SAAS,IAAIV,GAAAA;EACrC;;EAGA,MAAMY,OAAOZ,KAAaH,QAAgC;AACxD,UAAM,KAAKf,OAAOW,KAAK,IAAIoB,oBAAoB;MAAElB,QAAQE,UAAU,KAAKd,OAAOe;MAAeC,KAAKC;IAAI,CAAA,CAAA;AAEvG,SAAKrB,OAAO0B,IAAI,yBAAyBL,GAAAA,EAAK;EAChD;;EAGA,MAAMc,aAAad,KAAae,mBAAmB,MAAMlB,QAAkC;AACzF,UAAMmB,UAAU,IAAIC,iBAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA;AAC/G,WAAOc,aAAa,KAAKhC,QAAQkC,SAAS;MAAEE,WAAWH;IAAiB,CAAA;EAC1E;;EAGA,MAAMI,UAAUnB,KAAaH,QAAoC;AAC/D,UAAMuB,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAIwB,iBAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA,CAAA;AAGjG,QAAI,CAACoB,SAASnB,MAAM;AAClB,YAAM,IAAIoB,kBAAkB,4BAAA;IAC9B;AAEA,WAAOD,SAASnB;EAClB;;;EAIA,MAAMqB,YAAYzB,QAAgB0B,mBAAsD;AACtF,UAAMH,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAI+B,qBAAqB;MAAE7B,QAAQE;MAAQ4B,mBAAmBF;IAAkB,CAAA,CAAA;AAGlF,WAAO;MACLG,UAAUN,SAASO,YAAY,CAAA,GAAIC,IAAI,CAACC,OAAO;QAC7C7B,KAAK6B,EAAE9B,OAAO;QACd+B,MAAMD,EAAEE,QAAQ;QAChBC,cAAcH,EAAEI,gBAAgB,oBAAIC,KAAK,CAAA;MAC3C,EAAA;MACAC,WAAWf,SAASgB;IACtB;EACF;;EAGQxC,cAAcC,QAA4BwC,UAAsC;AACtF,UAAMC,WAAWzC,UAAUwC;AAC3B,QAAI,CAACC,UAAU;AACb,YAAM,IAAI3B,MAAM,qEAAA;IAClB;AACA,WAAO2B;EACT;AACF;;;AoBpHA,SAASC,UAAAA,eAAc;AAGvB,IAAMC,SAAS;AAIf,IAAMC,oBAAoB;AAWnB,IAAMC,sBAAN,MAAMA,qBAAAA;EAlBb,OAkBaA;;;;EACMC,SAAS,IAAIC,QAAOF,qBAAoBG,IAAI;EAC5CC;EACTC,yBAAwC;EAEhD,YAA6BC,QAA6B;SAA7BA,SAAAA;AAC3B,SAAKF,eAAeE,OAAOF,gBAAgB;EAC7C;;EAGA,MAAMG,aAAaJ,MAA6B;AAC9C,UAAMK,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAe;MACrFC,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;QAC/C,gBAAgB;QAChB,sBAAsB,KAAKV;MAC7B;MACAW,MAAMC,KAAKC,UAAU;QACnBd;QACA,GAAI,KAAKG,OAAOY,gBAAgB;UAAEA,cAAc,KAAKZ,OAAOY;QAAa;MAC3E,CAAA;IACF,CAAA;AAEA,UAAMH,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAIJ,KAAKK,SAAS;AAChB,WAAKnB,OAAOoB,IAAI,kBAAkBlB,IAAAA,EAAM;AACxC;IACF;AAGA,QAAIY,KAAKO,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,EAAQ;AAChD,UAAM,IAAIC,MAAM,uCAAuCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;EACvF;;;EAIA,MAAMa,aAAazB,MAA6B;AAC9C,UAAMK,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAeP,IAAAA,IAAQ;MAC7FQ,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;MAAG;IAC/D,CAAA;AAEA,UAAMC,OAAQ,MAAMP,SAASW,KAAI;AAEjC,QAAIJ,KAAKK,WAAWL,KAAKO,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,GAAQ;AAC9D,WAAKxB,OAAOoB,IAAI,kBAAkBlB,IAAAA,EAAM;AACxC;IACF;AACA,UAAM,IAAIuB,MAAM,uCAAuCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;EACvF;;;;EAKA,MAAMc,mBAAmBC,QAAiC;AACxD,UAAMtB,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,eAAeoB,MAAAA,oBAA0B;MAC/GnB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOQ,UAAU;QAAI,gBAAgB;MAAmB;MACjGC,MAAMC,KAAKC,UAAU;QAAEc,SAAS;MAAK,CAAA;IACvC,CAAA;AAEA,UAAMhB,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,WAAW,CAACL,KAAKiB,QAAQC,QAAQ;AACzC,YAAM,IAAIP,MAAM,8CAA8CI,MAAAA,KAAW,KAAKH,SAASZ,IAAAA,CAAAA,EAAO;IAChG;AAEA,SAAKd,OAAOoB,IAAI,6BAA6BS,MAAAA,WAAYf,KAAKiB,OAAOC,MAAM,EAAE;AAC7E,WAAO,WAAWlB,KAAKiB,OAAOC,MAAM;EACtC;;;;;EAMA,MAAMC,kBAAkB/B,MAAcgC,SAA2D;AAC/F,UAAMC,oBAAoB,MAAM,KAAKC,8BAA6B;AAIlE,UAAMC,YAAYC,OAAOC,YACvBL,QAAQM,IAAI,CAACX,WAAW;MACtB,iCAAiC,KAAKxB,OAAOI,SAAS,IAAI,KAAKN,YAAY,IAAI0B,MAAAA;MAC/E;KACD,CAAA;AAGH,UAAMtB,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,WAAW;MACjFC,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;QAAI,gBAAgB;MAAmB;MAClG3B,MAAMC,KAAKC,UAAU;QACnBd;QACAwC,UAAU;UAAC;YAAEC,QAAQ;YAASC,mBAAmB;cAAC;gBAAEC,IAAIV;cAAkB;;YAAIE;UAAU;;MAC1F,CAAA;IACF,CAAA;AAEA,UAAMvB,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,WAAW,CAACL,KAAKiB,QAAQe,OAAO;AACxC,YAAM,IAAIrB,MAAM,sCAAsCvB,IAAAA,KAAS,KAAKwB,SAASZ,IAAAA,CAAAA,EAAO;IACtF;AAEA,SAAKd,OAAOoB,IAAI,6BAA6BlB,IAAAA,cAAkBgC,QAAQa,MAAM,YAAY;AACzF,WAAOjC,KAAKiB;EACd;;EAGA,MAAMiB,iBAAiBC,aAAoC;AACzD,UAAM1C,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,WAAWwC,WAAAA,IAAe;MAChGvC,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;MAAG;IAChE,CAAA;AAEA,UAAM3B,OAAQ,MAAMP,SAASW,KAAI;AACjC,QAAI,CAACJ,KAAKK,SAAS;AACjB,YAAM,IAAIM,MAAM,sCAAsCwB,WAAAA,KAAgB,KAAKvB,SAASZ,IAAAA,CAAAA,EAAO;IAC7F;AAEA,SAAKd,OAAOoB,IAAI,8BAA8B6B,WAAAA,EAAa;EAC7D;;;EAIA,MAAcb,gCAAiD;AAC7D,QAAI,KAAKhC,uBAAwB,QAAO,KAAKA;AAE7C,UAAMG,WAAW,MAAMC,MAAM,GAAGX,MAAAA,aAAmB,KAAKQ,OAAOI,SAAS,6BAA6B;MACnGE,SAAS;QAAEC,eAAe,UAAU,KAAKP,OAAOoC,WAAW;MAAG;IAChE,CAAA;AAEA,UAAM3B,OAAQ,MAAMP,SAASW,KAAI;AACjC,UAAMgC,QAAQpC,KAAKiB,QAAQoB,KAAK,CAACC,MAAMA,EAAElD,SAASJ,iBAAAA;AAClD,QAAI,CAACoD,OAAO;AACV,YAAM,IAAIzB,MAAM,gCAAgC3B,iBAAAA,gBAAiC,KAAK4B,SAASZ,IAAAA,CAAAA,EAAO;IACxG;AAEA,SAAKV,yBAAyB8C,MAAML;AACpC,WAAOK,MAAML;EACf;EAEQnB,SAASZ,MAA2C;AAC1D,WAAOA,KAAKO,QAAQmB,IAAI,CAACjB,MAAM,GAAGA,EAAEC,IAAI,IAAID,EAAE8B,OAAO,EAAE,EAAEC,KAAK,IAAA,KAAS;EACzE;AACF;;;ACxJO,IAAMC,iBAAN,MAAMA;EARb,OAQaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAAgC;SAAhCA,UAAAA;EAAiC;;EAG9DC,QAAQC,UAAmC;AACzC,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAmC;AAChD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,kBAAkBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACjE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;","names":["Logger","CF_GRAPHQL","QUERY","BucketUsageReader","logger","Logger","name","config","getBucketUsage","bucketName","windowHours","end","Date","start","getTime","response","fetch","method","headers","Authorization","analyticsToken","body","JSON","stringify","query","variables","accountTag","accountId","toISOString","json","errors","length","Error","map","e","message","join","sample","data","viewer","accounts","r2StorageAdaptiveGroups","max","debug","bytes","objectCount","payloadSize","metadataSize","readConfigSource","source","provider","undefined","Error","DeleteObjectCommand","GetObjectCommand","ListObjectsV2Command","PutObjectCommand","S3Client","getSignedUrl","Logger","HttpStatus","HttpException","HttpProblemException","HttpException","detailOrOptions","httpStatus","options","detail","type","label","errors","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","NotFoundException","HttpProblemException","detailOrOptions","HttpStatus","NOT_FOUND","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","HttpStatus","R2StorageProvider","logger","Logger","name","client","config","S3Client","region","endpoint","accountId","credentials","accessKeyId","secretAccessKey","upload","params","send","PutObjectCommand","Bucket","requireBucket","bucket","defaultBucket","Key","key","Body","body","ContentType","contentType","log","uploadPublic","publicBucket","url","getPublicUrl","publicUrl","Error","delete","DeleteObjectCommand","getSignedUrl","expiresInSeconds","command","GetObjectCommand","expiresIn","getStream","response","NotFoundException","listObjects","continuationToken","ListObjectsV2Command","ContinuationToken","objects","Contents","map","o","size","Size","lastModified","LastModified","Date","nextToken","NextContinuationToken","fallback","resolved","Logger","CF_API","BUCKET_ITEM_WRITE","R2BucketProvisioner","logger","Logger","name","jurisdiction","bucketItemWriteGroupId","config","createBucket","response","fetch","accountId","method","headers","Authorization","adminToken","body","JSON","stringify","locationHint","json","success","log","errors","some","e","code","Error","describe","deleteBucket","enablePublicAccess","bucket","enabled","result","domain","createScopedToken","buckets","permissionGroupId","resolveBucketItemWriteGroupId","resources","Object","fromEntries","map","tokensToken","policies","effect","permission_groups","id","value","length","deleteCredential","accessKeyId","group","find","g","message","join","StorageFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2StorageProvider","readConfigSource","r2","Error"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vritti/api-sdk",
   "type": "module",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -106,6 +106,16 @@
         "default": "./dist/money.cjs"
       }
     },
+    "./pluralize": {
+      "import": {
+        "types": "./dist/pluralize.d.ts",
+        "default": "./dist/pluralize.js"
+      },
+      "require": {
+        "types": "./dist/pluralize.d.cts",
+        "default": "./dist/pluralize.cjs"
+      }
+    },
     "./countries": {
       "import": {
         "types": "./dist/countries.d.ts",
@@ -310,6 +320,7 @@
     "lru-cache": "^11.5.1",
     "nats": "^2.29.3",
     "pg": "^8.16.0",
+    "pluralize-esm": "^9.0.5",
     "winston": "^3.11.0",
     "winston-daily-rotate-file": "^5.0.0",
     "xlsx": "^0.18.5"
@@ -380,9 +391,9 @@
     "typescript": "^5.9.3"
   },
   "scripts": {
-    "dev": "tsc --noEmit && tsx --watch src/index.ts",
-    "build": "tsc --noEmit && tsup",
-    "type-check": "tsc --noEmit",
+    "dev": "tsc --noEmit -p tsconfig.src.json && tsx --watch src/index.ts",
+    "build": "tsc --noEmit -p tsconfig.src.json && tsup",
+    "type-check": "tsc --noEmit -p tsconfig.src.json",
     "test": "tsx --test 'src/**/*.test.ts'",
     "test:watch": "tsx --test --watch 'src/**/*.test.ts'",
     "check": "biome check --write .",