hatchkit 0.1.24 → 0.1.26

package/dist/utils/cloudflare-api.d.ts

@@ -116,6 +116,54 @@ export declare class CloudflareApi {
             ssl?: string;
         };
     }>>;
+    /** Mint a per-bucket-scoped R2 API token. Returns the token's S3
+     *  access/secret derivation alongside the raw token id+value (the
+     *  caller can store the access/secret pair as the project's S3
+     *  credentials, or hold the token value to use as a Bearer for R2
+     *  admin calls scoped to those buckets).
+     *
+     *  The token resource scope follows Cloudflare's R2 format:
+     *    `com.cloudflare.edge.r2.bucket.<accountId>_<jurisdiction>_<bucketName>`
+     *  with jurisdiction = "default" for buckets created without an
+     *  explicit jurisdiction (which is what `createR2Bucket` does today).
+     *
+     *  Permission groups are looked up dynamically by name — Cloudflare
+     *  doesn't publish stable IDs, only stable names. We cache the result
+     *  on the instance so subsequent calls in the same process re-use it.
+     *
+     *  Note on the calling token: this hits `POST /user/tokens` which
+     *  requires the calling token to have `User > API Tokens > Edit`.
+     *  An R2-only admin token will 403 here. The caller should surface
+     *  that as a "add API Tokens:Edit to your admin token" hint. */
+    createR2ApiToken(params: {
+        accountId: string;
+        /** Display name for the token in the CF dashboard. Project name is
+         *  the natural choice. */
+        name: string;
+        /** Bucket names to scope the token to. Token can only access these. */
+        bucketNames: string[];
+        /** Bucket jurisdiction. Defaults to "default" — matches how
+         *  `createR2Bucket` creates buckets without explicit jurisdiction. */
+        jurisdiction?: "default" | "eu" | "fedramp";
+        /** Permissions scope for the resulting S3 keys. Default: read+write. */
+        permissions?: "read" | "read-write";
+    }): Promise<{
+        /** API token id — the same thing as the S3 Access Key ID. */
+        tokenId: string;
+        /** API token value (raw bearer). Sensitive. */
+        tokenValue: string;
+        /** S3 Access Key ID, derived per Cloudflare's docs (same as tokenId). */
+        accessKeyId: string;
+        /** S3 Secret Access Key — sha256(tokenValue), hex. */
+        secretAccessKey: string;
+    }>;
+    /** Cached lookup of /user/tokens/permission_groups filtered to R2
+     *  groups. Returns at minimum the entries hatchkit looks up by name
+     *  in `createR2ApiToken`. */
+    private permissionGroupsCache?;
+    private getR2PermissionGroups;
+    /** Delete a Cloudflare API token by id. Idempotent: 404 → "not-found". */
+    deleteApiToken(tokenId: string): Promise<"deleted" | "not-found">;
     /** Attach a custom domain (a hostname on a Cloudflare zone you own)
      *  to an R2 bucket. Idempotent — duplicates short-circuit via list. */
     addR2CustomDomain(accountId: string, bucket: string, params: {

package/dist/utils/cloudflare-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,kCAAkC;AAClC,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,EAAE,oBAAoB;YAK3B,OAAO;IAoBrB,iDAAiD;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAKpC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B5C,gEAAgE;IAC1D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjE,6DAA6D;IACvD,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAQhG;;;qEAGiE;IAC3D,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GACA,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B9D;4EACwE;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IA0BtF;;;gEAG4D;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE,0DAA0D;IACpD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IASzF;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAoB3D;sEACkE;IAC5D,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;KAAO,GACnF,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAwBF,gDAAgD;IAC1C,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAST;uEACmE;IAC7D,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,UAAO,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMlE;iDAC6C;IACvC,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CACR,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAC3F;IAeD;2EACuE;IACjE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;KAAE,GACjF,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAoB5E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,OAAO,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9C,CAAC;CAkDH"}
+{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,kCAAkC;AAClC,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,EAAE,oBAAoB;YAK3B,OAAO;IAoBrB,iDAAiD;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAKpC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B5C,gEAAgE;IAC1D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjE,6DAA6D;IACvD,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAQhG;;;qEAGiE;IAC3D,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GACA,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B9D;4EACwE;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IA0BtF;;;gEAG4D;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE,0DAA0D;IACpD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IASzF;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAoB3D;sEACkE;IAC5D,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;KAAO,GACnF,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAwBF,gDAAgD;IAC1C,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAST;uEACmE;IAC7D,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,UAAO,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMlE;iDAC6C;IACvC,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CACR,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAC3F;IAeD;;;;;;;;;;;;;;;;;;oEAkBgE;IAC1D,gBAAgB,CAAC,MAAM,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB;kCAC0B;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,uEAAuE;QACvE,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB;8EACsE;QACtE,YAAY,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;QAC5C,wEAAwE;QACxE,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,6DAA6D;QAC7D,OAAO,EAAE,MAAM,CAAC;QAChB,+CAA+C;QAC/C,UAAU,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;QACpB,sDAAsD;QACtD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAkDF;;iCAE6B;IAC7B,OAAO,CAAC,qBAAqB,CAAC,CAAsC;YACtD,qBAAqB;IAiBnC,0EAA0E;IACpE,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IAUvE;2EACuE;IACjE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;KAAE,GACjF,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAoB5E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,OAAO,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9C,CAAC;CAkDH"}

package/dist/utils/cloudflare-api.js

@@ -241,6 +241,99 @@ export class CloudflareApi {
         const res = await this.request("GET", `/accounts/${accountId}/r2/buckets/${bucket}/domains/custom`);
         return res.domains ?? [];
     }
+    /** Mint a per-bucket-scoped R2 API token. Returns the token's S3
+     *  access/secret derivation alongside the raw token id+value (the
+     *  caller can store the access/secret pair as the project's S3
+     *  credentials, or hold the token value to use as a Bearer for R2
+     *  admin calls scoped to those buckets).
+     *
+     *  The token resource scope follows Cloudflare's R2 format:
+     *    `com.cloudflare.edge.r2.bucket.<accountId>_<jurisdiction>_<bucketName>`
+     *  with jurisdiction = "default" for buckets created without an
+     *  explicit jurisdiction (which is what `createR2Bucket` does today).
+     *
+     *  Permission groups are looked up dynamically by name — Cloudflare
+     *  doesn't publish stable IDs, only stable names. We cache the result
+     *  on the instance so subsequent calls in the same process re-use it.
+     *
+     *  Note on the calling token: this hits `POST /user/tokens` which
+     *  requires the calling token to have `User > API Tokens > Edit`.
+     *  An R2-only admin token will 403 here. The caller should surface
+     *  that as a "add API Tokens:Edit to your admin token" hint. */
+    async createR2ApiToken(params) {
+        const jurisdiction = params.jurisdiction ?? "default";
+        const permissions = params.permissions ?? "read-write";
+        // Resolve permission groups by name. Cached on the instance so
+        // multi-bucket runs only pay the lookup once.
+        const wanted = permissions === "read"
+            ? ["Workers R2 Storage Bucket Item Read"]
+            : ["Workers R2 Storage Bucket Item Read", "Workers R2 Storage Bucket Item Write"];
+        const groups = await this.getR2PermissionGroups();
+        const groupIds = [];
+        for (const name of wanted) {
+            const found = groups.find((g) => g.name === name);
+            if (!found) {
+                throw new Error(`Permission group "${name}" not found in /user/tokens/permission_groups. The Cloudflare API may have renamed it; verify at https://dash.cloudflare.com/profile/api-tokens.`);
+            }
+            groupIds.push(found.id);
+        }
+        // Build the resources map: one entry per bucket, format per docs.
+        const resources = {};
+        for (const bucket of params.bucketNames) {
+            const key = `com.cloudflare.edge.r2.bucket.${params.accountId}_${jurisdiction}_${bucket}`;
+            resources[key] = "*";
+        }
+        const body = {
+            name: params.name,
+            policies: [
+                {
+                    effect: "allow",
+                    permission_groups: groupIds.map((id) => ({ id })),
+                    resources,
+                },
+            ],
+        };
+        const res = await this.request("POST", "/user/tokens", body);
+        const { createHash } = await import("node:crypto");
+        const secretAccessKey = createHash("sha256").update(res.value).digest("hex");
+        return {
+            tokenId: res.id,
+            tokenValue: res.value,
+            accessKeyId: res.id,
+            secretAccessKey,
+        };
+    }
+    /** Cached lookup of /user/tokens/permission_groups filtered to R2
+     *  groups. Returns at minimum the entries hatchkit looks up by name
+     *  in `createR2ApiToken`. */
+    permissionGroupsCache;
+    async getR2PermissionGroups() {
+        if (this.permissionGroupsCache)
+            return this.permissionGroupsCache;
+        const all = [];
+        let page = 1;
+        while (page <= 20) {
+            const data = await this.request("GET", `/user/tokens/permission_groups?per_page=200&page=${page}`);
+            all.push(...data);
+            if (data.length < 200)
+                break;
+            page += 1;
+        }
+        this.permissionGroupsCache = all;
+        return all;
+    }
+    /** Delete a Cloudflare API token by id. Idempotent: 404 → "not-found". */
+    async deleteApiToken(tokenId) {
+        try {
+            await this.request("DELETE", `/user/tokens/${tokenId}`);
+            return "deleted";
+        }
+        catch (err) {
+            if (/404|not\s*found/i.test(err.message))
+                return "not-found";
+            throw err;
+        }
+    }
     /** Attach a custom domain (a hostname on a Cloudflare zone you own)
      *  to an R2 bucket. Idempotent — duplicates short-circuit via list. */
     async addR2CustomDomain(accountId, bucket, params) {

package/dist/utils/cloudflare-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-api.js","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,WAAW;AACX,qEAAqE;AACrE,sEAAsE;AACtE,uDAAuD;AACvD,mEAAmE;AACnE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,4DAA4D;AA4B5D,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,kCAAkC;AAClC,MAAM,OAAO,aAAa;IAChB,KAAK,CAAS;IACd,SAAS,CAAU;IAE3B,YAAY,OAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;gBAC5C,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,IAAI,UAAU;gBAAE,MAAM;YAC9B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,UAAU,CACd,MAAc,EACd,IAAY,EACZ,IAA4B;QAE5B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAE7B,KAAK,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED;;;qEAGiE;IACjE,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,MAMC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,gBAAgB;SACvC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,MAAM,EACN,UAAU,MAAM,cAAc,EAC9B,IAAI,CACL,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GACR,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACxD,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,OAAO,EACP,UAAU,MAAM,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAC7C,IAAI,CACL,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;4EACwE;IACxE,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAU,QAAQ,EAAE,UAAU,MAAM,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAClF,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,wFAAwF;IACxF,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAElE;;;gEAG4D;IAC5D,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,UAAU,MAAM,aAAa,SAAS,EAAE,CACzC,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAc;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,OAAO,EACP,UAAU,MAAM,aAAa,SAAS,EAAE,EACxC,EAAE,KAAK,EAAE,CACV,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAC3D,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,EAAE;IACF,+DAA+D;IAC/D,6EAA6E;IAC7E,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,4DAA4D;IAC5D,iEAAiE;IACjE,+CAA+C;IAC/C,EAAE;IACF,eAAe;IACf,8DAA8D;IAC9D,6DAA6D;IAC7D,sEAAsE;IACtE,wCAAwC;IAExC;sEACkE;IAClE,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,IAAY,EACZ,OAAkF,EAAE;QAQpF,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAK3B,MAAM,EAAE,aAAa,SAAS,aAAa,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACzD,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,IAAY;QAOZ,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,SAAS,eAAe,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,wBAAwB,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;uEACmE;IACnE,KAAK,CAAC,qBAAqB,CACzB,SAAiB,EACjB,MAAc,EACd,OAAO,GAAG,IAAI;QAEd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,SAAS,eAAe,MAAM,kBAAkB,EAAE;YACxF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;iDAC6C;IAC7C,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,MAAc;QAWd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,aAAa,SAAS,eAAe,MAAM,iBAAiB,CAC7D,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,MAAc,EACd,MAAkF;QAElF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,MAAM,EACN,aAAa,SAAS,eAAe,MAAM,iBAAiB,EAC5D,IAAI,CACL,CAAC;QACF,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QAYtC,MAAM,QAAQ,GAAc;YAC1B,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YAC5E,oEAAoE;YACpE,8CAA8C;YAC9C;gBACE,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM;gBACd,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ;aACvD;YACD;gBACE,EAAE,EAAE,iBAAiB;gBACrB,MAAM,EAAE,KAAK;gBACb,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK;aAC5D;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,MAAM,EAAE,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;aACnC;SACF,CAAC;QAEF,MAAM,OAAO,GAAsD,EAAE,CAAC;QACtE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAyC,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"cloudflare-api.js","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,WAAW;AACX,qEAAqE;AACrE,sEAAsE;AACtE,uDAAuD;AACvD,mEAAmE;AACnE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,4DAA4D;AA4B5D,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,kCAAkC;AAClC,MAAM,OAAO,aAAa;IAChB,KAAK,CAAS;IACd,SAAS,CAAU;IAE3B,YAAY,OAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;gBAC5C,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,IAAI,UAAU;gBAAE,MAAM;YAC9B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,UAAU,CACd,MAAc,EACd,IAAY,EACZ,IAA4B;QAE5B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAE7B,KAAK,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED;;;qEAGiE;IACjE,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,MAMC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,gBAAgB;SACvC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,MAAM,EACN,UAAU,MAAM,cAAc,EAC9B,IAAI,CACL,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GACR,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACxD,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAChC,OAAO,EACP,UAAU,MAAM,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAC7C,IAAI,CACL,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;4EACwE;IACxE,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAU,QAAQ,EAAE,UAAU,MAAM,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAClF,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,wFAAwF;IACxF,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAElE;;;gEAG4D;IAC5D,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,UAAU,MAAM,aAAa,SAAS,EAAE,CACzC,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAc;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,OAAO,EACP,UAAU,MAAM,aAAa,SAAS,EAAE,EACxC,EAAE,KAAK,EAAE,CACV,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAC3D,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,EAAE;IACF,+DAA+D;IAC/D,6EAA6E;IAC7E,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,4DAA4D;IAC5D,iEAAiE;IACjE,+CAA+C;IAC/C,EAAE;IACF,eAAe;IACf,8DAA8D;IAC9D,6DAA6D;IAC7D,sEAAsE;IACtE,wCAAwC;IAExC;sEACkE;IAClE,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,IAAY,EACZ,OAAkF,EAAE;QAQpF,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAK3B,MAAM,EAAE,aAAa,SAAS,aAAa,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACzD,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,IAAY;QAOZ,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,SAAS,eAAe,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,wBAAwB,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;uEACmE;IACnE,KAAK,CAAC,qBAAqB,CACzB,SAAiB,EACjB,MAAc,EACd,OAAO,GAAG,IAAI;QAEd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,SAAS,eAAe,MAAM,kBAAkB,EAAE;YACxF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;iDAC6C;IAC7C,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,MAAc;QAWd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,aAAa,SAAS,eAAe,MAAM,iBAAiB,CAC7D,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;oEAkBgE;IAChE,KAAK,CAAC,gBAAgB,CAAC,MAYtB;QAUC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;QAEvD,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,MAAM,GACV,WAAW,KAAK,MAAM;YACpB,CAAC,CAAC,CAAC,qCAAqC,CAAC;YACzC,CAAC,CAAC,CAAC,qCAAqC,EAAE,sCAAsC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,kJAAkJ,CAC5K,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAED,kEAAkE;QAClE,MAAM,SAAS,GAAwB,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,iCAAiC,MAAM,CAAC,SAAS,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;YAC1F,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE;gBACR;oBACE,MAAM,EAAE,OAAgB;oBACxB,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACjD,SAAS;iBACV;aACF;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC5F,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,UAAU,EAAE,GAAG,CAAC,KAAK;YACrB,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,eAAe;SAChB,CAAC;IACJ,CAAC;IAED;;iCAE6B;IACrB,qBAAqB,CAAuC;IAC5D,KAAK,CAAC,qBAAqB;QACjC,IAAI,IAAI,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC;QAClE,MAAM,GAAG,GAAwC,EAAE,CAAC;QACpD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,oDAAoD,IAAI,EAAE,CAC3D,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM;YAC7B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAU,QAAQ,EAAE,gBAAgB,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC;gBAAE,OAAO,WAAW,CAAC;YACxE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,MAAc,EACd,MAAkF;QAElF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,MAAM,EACN,aAAa,SAAS,eAAe,MAAM,iBAAiB,EAC5D,IAAI,CACL,CAAC;QACF,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QAYtC,MAAM,QAAQ,GAAc;YAC1B,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YAC5E,oEAAoE;YACpE,8CAA8C;YAC9C;gBACE,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM;gBACd,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ;aACvD;YACD;gBACE,EAAE,EAAE,iBAAiB;gBACrB,MAAM,EAAE,KAAK;gBACb,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK;aAC5D;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,MAAM,EAAE,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;aACnC;SACF,CAAC;QAEF,MAAM,OAAO,GAAsD,EAAE,CAAC;QACtE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAyC,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/utils/secrets.d.ts

@@ -9,8 +9,30 @@ export declare const SECRET_KEYS: {
      *  registered at INWX. Used by the post-apply NS flip in deploy/terraform
      *  and by `hatchkit dns link-to-cloudflare`. */
     readonly dnsInwxRegistrarPassword: "dns:inwx-registrar:password";
+    /** @deprecated Account-wide S3 access/secret pair. Used by the
+     *  legacy single-project flow where every hatchkit-managed app
+     *  shared one credential against all buckets — bad blast radius
+     *  on leak. New code path is `s3ProjectAccessKey/secret` below:
+     *  per-project credentials minted by hatchkit at provision-time
+     *  and scoped to that project's buckets only.
+     *
+     *  Kept defined so the migration step in handleProvisionS3 can
+     *  detect + delete legacy entries. Don't WRITE these from new
+     *  code; reads are tolerated until the migration ships. */
     readonly s3AccessKey: (provider: string) => string;
     readonly s3SecretKey: (provider: string) => string;
+    /** Per-project S3 access/secret pair, scoped to that project's
+     *  buckets only. Created by hatchkit at provision-time via
+     *  CloudflareApi.createR2ApiToken (which calls POST /user/tokens
+     *  with bucket-scoped resources, derives access = token id +
+     *  secret = sha256(token value)). The user never pastes these. */
+    readonly s3ProjectAccessKey: (provider: string, project: string) => string;
+    readonly s3ProjectSecretKey: (provider: string, project: string) => string;
+    /** API token id of the per-project R2 token. Stored alongside
+     *  the access/secret pair so `hatchkit destroy <project>` can
+     *  delete the token (DELETE /user/tokens/<id>) instead of
+     *  leaving orphaned tokens in the user's CF account. */
+    readonly s3ProjectTokenId: (provider: string, project: string) => string;
     /** Cloudflare API token with `Account > Workers R2 Storage > Edit`
      *  permission. Used by `hatchkit provision s3` to create R2 buckets,
      *  enable the managed `r2.dev` URL, and attach custom domains. Kept

package/dist/utils/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAoBA;mEACmE;AACnE,eAAO,MAAM,WAAW;;;;;IAKtB;;oDAEgD;;qCAExB,MAAM;qCACN,MAAM;IAC9B;;;;;;2EAMuE;;mCAEjD,MAAM;;IAE5B;wEACoE;;;2CAGtC,MAAM;;;;IAIpC;;+DAE2D;8CAC1B,MAAM;IACvC;;;;6DAIyD;;CAEjD,CAAC;AAEX,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhE;AAED,iEAAiE;AACjE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAoBA;mEACmE;AACnE,eAAO,MAAM,WAAW;;;;;IAKtB;;oDAEgD;;IAEhD;;;;;;;;;+DAS2D;qCACnC,MAAM;qCACN,MAAM;IAC9B;;;;sEAIkE;4CACnC,MAAM,WAAW,MAAM;4CACvB,MAAM,WAAW,MAAM;IACtD;;;4DAGwD;0CAC3B,MAAM,WAAW,MAAM;IACpD;;;;;;2EAMuE;;mCAEjD,MAAM;;IAE5B;wEACoE;;;2CAGtC,MAAM;;;;IAIpC;;+DAE2D;8CAC1B,MAAM;IACvC;;;;6DAIyD;;CAEjD,CAAC;AAEX,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhE;AAED,iEAAiE;AACjE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}

package/dist/utils/secrets.js

@@ -26,8 +26,30 @@ export const SECRET_KEYS = {
      *  registered at INWX. Used by the post-apply NS flip in deploy/terraform
      *  and by `hatchkit dns link-to-cloudflare`. */
     dnsInwxRegistrarPassword: "dns:inwx-registrar:password",
+    /** @deprecated Account-wide S3 access/secret pair. Used by the
+     *  legacy single-project flow where every hatchkit-managed app
+     *  shared one credential against all buckets — bad blast radius
+     *  on leak. New code path is `s3ProjectAccessKey/secret` below:
+     *  per-project credentials minted by hatchkit at provision-time
+     *  and scoped to that project's buckets only.
+     *
+     *  Kept defined so the migration step in handleProvisionS3 can
+     *  detect + delete legacy entries. Don't WRITE these from new
+     *  code; reads are tolerated until the migration ships. */
     s3AccessKey: (provider) => `s3:${provider}:access-key`,
     s3SecretKey: (provider) => `s3:${provider}:secret-key`,
+    /** Per-project S3 access/secret pair, scoped to that project's
+     *  buckets only. Created by hatchkit at provision-time via
+     *  CloudflareApi.createR2ApiToken (which calls POST /user/tokens
+     *  with bucket-scoped resources, derives access = token id +
+     *  secret = sha256(token value)). The user never pastes these. */
+    s3ProjectAccessKey: (provider, project) => `s3:${provider}:${project}:access-key`,
+    s3ProjectSecretKey: (provider, project) => `s3:${provider}:${project}:secret-key`,
+    /** API token id of the per-project R2 token. Stored alongside
+     *  the access/secret pair so `hatchkit destroy <project>` can
+     *  delete the token (DELETE /user/tokens/<id>) instead of
+     *  leaving orphaned tokens in the user's CF account. */
+    s3ProjectTokenId: (provider, project) => `s3:${provider}:${project}:token-id`,
     /** Cloudflare API token with `Account > Workers R2 Storage > Edit`
      *  permission. Used by `hatchkit provision s3` to create R2 buckets,
      *  enable the managed `r2.dev` URL, and attach custom domains. Kept

package/dist/utils/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iEAAiE;AACjE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,UAAU,CAAC;AAElE;mEACmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C;;oDAEgD;IAChD,wBAAwB,EAAE,6BAA6B;IACvD,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D;;;;;;2EAMuE;IACvE,YAAY,EAAE,mBAAmB;IACjC,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,QAAQ,UAAU;IAC1D,cAAc,EAAE,sBAAsB;IACtC;wEACoE;IACpE,qBAAqB,EAAE,0BAA0B;IACjD,yBAAyB,EAAE,8BAA8B;IACzD,qBAAqB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,gBAAgB;IAC1E,YAAY,EAAE,gBAAgB;IAC9B,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C;;+DAE2D;IAC3D,iBAAiB,EAAE,CAAC,WAAmB,EAAE,EAAE,CAAC,WAAW,WAAW,yBAAyB;IAC3F;;;;6DAIyD;IACzD,aAAa,EAAE,iBAAiB;CACxB,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iEAAiE;AACjE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,UAAU,CAAC;AAElE;mEACmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C;;oDAEgD;IAChD,wBAAwB,EAAE,6BAA6B;IACvD;;;;;;;;;+DAS2D;IAC3D,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D;;;;sEAIkE;IAClE,kBAAkB,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,QAAQ,IAAI,OAAO,aAAa;IACjG,kBAAkB,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,QAAQ,IAAI,OAAO,aAAa;IACjG;;;4DAGwD;IACxD,gBAAgB,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,QAAQ,IAAI,OAAO,WAAW;IAC7F;;;;;;2EAMuE;IACvE,YAAY,EAAE,mBAAmB;IACjC,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,QAAQ,UAAU;IAC1D,cAAc,EAAE,sBAAsB;IACtC;wEACoE;IACpE,qBAAqB,EAAE,0BAA0B;IACjD,yBAAyB,EAAE,8BAA8B;IACzD,qBAAqB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,gBAAgB;IAC1E,YAAY,EAAE,gBAAgB;IAC9B,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C;;+DAE2D;IAC3D,iBAAiB,EAAE,CAAC,WAAmB,EAAE,EAAE,CAAC,WAAW,WAAW,yBAAyB;IAC3F;;;;6DAIyD;IACzD,aAAa,EAAE,iBAAiB;CACxB,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hatchkit",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "packageManager": "pnpm@10.33.2",
   "description": "Interactive CLI for scaffolding full-stack projects and provisioning observability/email clients",
   "type": "module",