hatchkit 0.1.29 → 0.1.31

package/dist/provision/s3-buckets.js

@@ -44,7 +44,7 @@ import ora from "ora";
 import { getDnsConfig } from "../config.js";
 import { MANIFEST_FILENAME, readManifest, writeManifest, } from "../scaffold/manifest.js";
 import { CloudflareApi } from "../utils/cloudflare-api.js";
-import { SECRET_KEYS, getSecret, setSecret } from "../utils/secrets.js";
+import { SECRET_KEYS, deleteSecret, getSecret } from "../utils/secrets.js";
 /** Account ID = the subdomain in the S3 endpoint
  *  `https://<accountId>.r2.cloudflarestorage.com`. */
 export function accountIdFromR2Endpoint(endpoint) {
@@ -268,34 +268,96 @@ export async function provisionS3ForProject(opts) {
             throw err;
         }
     }
-    // 3. Mint a per-project R2 API token scoped to whichever buckets we
-    //    just created (one or two). Returns the S3-style access/secret
-    //    pair (access = token id, secret = sha256(token value)). Re-mint
-    //    on every re-run — keychain holds the canonical copy and
-    //    idempotency on the CF side is good enough that the worst case
-    //    is a few orphaned old tokens (cleaned up by `hatchkit destroy`).
+    // 3. Mint a per-project R2 **Account** API token scoped to the
+    //    buckets above. Lives in `R2 → Manage R2 API Tokens` in the
+    //    Cloudflare dashboard (account scope, not user) and the manifest
+    //    records its id so `hatchkit destroy` can revoke it alongside
+    //    the buckets.
     //
-    //    If a token already exists in keychain for this project, REUSE
-    //    it instead of re-minting. This keeps `hatchkit provision s3`
-    //    idempotent w/r/t the user's CF account (no token churn) and
-    //    means rotating credentials is an explicit `--rotate` step
-    //    rather than a side effect.
-    const existingProjectAccess = await getSecret(SECRET_KEYS.s3ProjectAccessKey(provider, projectName));
-    const existingProjectSecret = await getSecret(SECRET_KEYS.s3ProjectSecretKey(provider, projectName));
+    //    Idempotency / re-run policy:
+    //      a. Manifest already has an `s3Buckets.tokenId` AND that token
+    //         is alive in CF AND `.env.production` already has the
+    //         encrypted access/secret values → REUSE (skip mint).
+    //         Keeps re-runs of `hatchkit provision s3` no-op when
+    //         nothing's actually changed.
+    //      b. Otherwise → mint a fresh account-token. Revoke the stale
+    //         manifest token first if any (so we don't leave orphans).
+    //      c. Migration: if the OS keychain still has a legacy
+    //         user-token from the pre-account-tokens era, revoke it and
+    //         wipe the keychain entries — manifest is now the source of
+    //         truth, not the keychain.
+    const existingTokenId = manifest.s3Buckets?.tokenId;
+    const existingAccountId = manifest.s3Buckets?.accountId;
+    const envPathForCheck = join(opts.projectDir, ".env.production");
+    const existingEnvKeysSet = existingEnvKeys(envPathForCheck);
+    const envPrefixForCheck = opts.envPrefix ?? detectEnvPrefix(opts.projectDir);
+    const keysForCheck = envKeysForPrefix(envPrefixForCheck);
+    const envHasCreds = existingEnvKeysSet.has(keysForCheck.accessKey) &&
+        existingEnvKeysSet.has(keysForCheck.secretKey);
+    let canReuseExisting = false;
+    if (existingTokenId && existingAccountId && envHasCreds) {
+        try {
+            const tok = await cf.getAccountToken(existingAccountId, existingTokenId);
+            if (tok && tok.status === "active") {
+                canReuseExisting = true;
+                console.log(chalk.dim(`  · Reusing R2 account token ${existingTokenId.slice(0, 8)}… (alive in CF; creds in .env.production)`));
+            }
+            else if (tok) {
+                console.log(chalk.yellow(`  · Existing R2 token ${existingTokenId.slice(0, 8)}… is ${tok.status}. Minting a fresh one.`));
+            }
+            else {
+                console.log(chalk.yellow(`  · Existing R2 token ${existingTokenId.slice(0, 8)}… is gone from Cloudflare. Minting a fresh one.`));
+            }
+        }
+        catch (err) {
+            // Probe failure (network / permissions) — fail open + mint
+            // fresh. The orphan (if any) is recoverable manually; better
+            // than continuing with stale creds.
+            console.log(chalk.dim(`  · Couldn't verify R2 token ${existingTokenId.slice(0, 8)}… (${err.message.split("\n")[0]}). Minting a fresh one.`));
+        }
+    }
+    // Migration: revoke + wipe legacy user-token entries from the
+    // keychain. Best-effort — a CF revoke failure logs and continues.
+    let legacyUserTokenMigrated = false;
+    const legacyAccessKey = await getSecret(SECRET_KEYS.s3ProjectAccessKey(provider, projectName));
+    const legacySecretKey = await getSecret(SECRET_KEYS.s3ProjectSecretKey(provider, projectName));
+    const legacyTokenId = await getSecret(SECRET_KEYS.s3ProjectTokenId(provider, projectName));
+    if (legacyAccessKey || legacySecretKey || legacyTokenId) {
+        legacyUserTokenMigrated = true;
+        if (legacyTokenId) {
+            try {
+                const result = await cf.deleteApiToken(legacyTokenId);
+                if (result === "deleted") {
+                    console.log(chalk.dim(`  · Revoked legacy user-token ${legacyTokenId.slice(0, 8)}… (migration)`));
+                }
+            }
+            catch (err) {
+                console.log(chalk.yellow(`  · Couldn't revoke legacy user-token ${legacyTokenId.slice(0, 8)}…: ${err.message.split("\n")[0]}`));
+                console.log(chalk.dim(`    Revoke manually at https://dash.cloudflare.com/profile/api-tokens (search for "hatchkit-${projectName}").`));
+            }
+        }
+        await deleteSecret(SECRET_KEYS.s3ProjectAccessKey(provider, projectName));
+        await deleteSecret(SECRET_KEYS.s3ProjectSecretKey(provider, projectName));
+        await deleteSecret(SECRET_KEYS.s3ProjectTokenId(provider, projectName));
+    }
     let projectAccessKey;
     let projectSecretKey;
-    let projectTokenId;
-    if (existingProjectAccess && existingProjectSecret) {
-        projectAccessKey = existingProjectAccess;
-        projectSecretKey = existingProjectSecret;
-        projectTokenId =
-            (await getSecret(SECRET_KEYS.s3ProjectTokenId(provider, projectName))) ?? undefined;
-        console.log(chalk.dim(`  · Reusing existing per-project R2 credentials (keychain ${SECRET_KEYS.s3ProjectAccessKey(provider, projectName)})`));
-    }
-    else {
-        const tokenSpinner = ora(`Minting per-project R2 API token (scoped to those 2 buckets)`).start();
+    let projectTokenId = canReuseExisting ? existingTokenId : undefined;
+    let tokenCreated = null;
+    if (!canReuseExisting) {
+        // Revoke a stale manifest token (status disabled/expired/404)
+        // before minting its replacement so we don't pile up orphans.
+        if (existingTokenId && existingAccountId) {
+            try {
+                await cf.deleteAccountToken(existingAccountId, existingTokenId);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        const tokenSpinner = ora(`Minting R2 account API token (scoped to ${includeStateBucket ? `${assetsBucketName} + ${stateBucketName}` : assetsBucketName})`).start();
         try {
-            const minted = await cf.createR2ApiToken({
+            const minted = await cf.createR2AccountToken({
                 accountId,
                 name: `hatchkit-${projectName}`,
                 bucketNames: includeStateBucket ? [assetsBucketName, stateBucketName] : [assetsBucketName],
@@ -304,16 +366,14 @@ export async function provisionS3ForProject(opts) {
             projectAccessKey = minted.accessKeyId;
             projectSecretKey = minted.secretAccessKey;
             projectTokenId = minted.tokenId;
-            await setSecret(SECRET_KEYS.s3ProjectAccessKey(provider, projectName), minted.accessKeyId);
-            await setSecret(SECRET_KEYS.s3ProjectSecretKey(provider, projectName), minted.secretAccessKey);
-            await setSecret(SECRET_KEYS.s3ProjectTokenId(provider, projectName), minted.tokenId);
-            tokenSpinner.succeed(`Minted scoped R2 API token (id ${minted.tokenId.slice(0, 8)}…, stored in keychain)`);
+            tokenCreated = { tokenId: minted.tokenId, audience: "account" };
+            tokenSpinner.succeed(`Minted R2 account token (id ${minted.tokenId.slice(0, 8)}…, visible in R2 → Manage R2 API Tokens)`);
         }
         catch (err) {
-            tokenSpinner.fail("Failed to mint per-project R2 API token");
+            tokenSpinner.fail("Failed to mint R2 account API token");
             const msg = err.message;
-            if (/9109|10000|403|invalid api token/i.test(msg)) {
-                throw new Error(`${msg}\n\n  → Your admin token (s3:r2:admin-token) needs BOTH:\n    · Account > Workers R2 Storage > Edit\n    · User > API Tokens > Edit  (this is what's missing)\n  → Edit at https://dash.cloudflare.com/profile/api-tokens, save, re-run.`);
+            if (/9109|10000|10001|403|invalid api token/i.test(msg)) {
+                throw new Error(`${msg}\n\n  → Your admin token (s3:r2:admin-token) needs:\n    · Account > Workers R2 Storage > Edit  (create buckets / list them)\n    · Account Settings > Edit               (mint per-project account tokens — was missing)\n  → Edit at https://dash.cloudflare.com/profile/api-tokens, save, re-run.`);
             }
             throw err;
         }
@@ -327,14 +387,21 @@ export async function provisionS3ForProject(opts) {
     const existingKeys = existingEnvKeys(envPath);
     const toWrite = [];
     const skip = (key) => existingKeys.has(key);
-    // ENDPOINT, ACCESS_KEY, SECRET_KEY, REGION are credentials that
-    // the runtime always needs. Re-write on every run (cheap, and the
-    // user might've rotated keys). REGION is "auto" for R2 — the SDK
-    // ignores it anyway when an explicit endpoint is given, but
-    // setting it suppresses an `AWS_REGION` warning at runtime.
+    // ENDPOINT and REGION re-write on every run (cheap; values are
+    // stable). REGION is "auto" for R2 — the SDK ignores it anyway when
+    // an explicit endpoint is given, but setting it suppresses an
+    // `AWS_REGION` warning at runtime.
+    //
+    // ACCESS_KEY + SECRET_KEY are the freshly-minted token's S3 derivation
+    // — only present when we actually minted (i.e. !canReuseExisting).
+    // On reuse, we leave the existing encrypted values in .env.production
+    // alone (Cloudflare doesn't expose the secret-access-key after
+    // creation, so the file IS the source of truth for these two).
     toWrite.push({ key: keys.endpoint, value: meta.endpoint });
-    toWrite.push({ key: keys.accessKey, value: projectAccessKey });
-    toWrite.push({ key: keys.secretKey, value: projectSecretKey });
+    if (projectAccessKey && projectSecretKey) {
+        toWrite.push({ key: keys.accessKey, value: projectAccessKey });
+        toWrite.push({ key: keys.secretKey, value: projectSecretKey });
+    }
     toWrite.push({ key: keys.region, value: meta.region ?? "auto" });
     // BUCKET name — keys.bucket is "<PREFIX>_STATE_BUCKET" for R2 (the
     // private bucket is the only one a server lib reads through env;
@@ -397,11 +464,21 @@ export async function provisionS3ForProject(opts) {
         envSpinner.fail("Could not write .env.production");
         throw err;
     }
-    // 4. Record bucket names + public URL in the manifest so re-runs
-    //    don't have to re-derive them and a future `hatchkit destroy`
-    //    knows what to clean up. Preserve a previously-recorded `state`
-    //    entry when the current run didn't create one — the bucket may
-    //    still exist from an earlier `--with-state-bucket` provision.
+    // 4. Record bucket names + public URL + token id in the manifest so
+    //    re-runs don't have to re-derive them and a future
+    //    `hatchkit destroy` knows what to clean up. Preserve a
+    //    previously-recorded `state` entry when the current run didn't
+    //    create one — the bucket may still exist from an earlier
+    //    `--with-state-bucket` provision. Always pin the token id +
+    //    accountId so destroy can revoke even after credentials get
+    //    rotated.
+    if (!projectTokenId) {
+        // Defensive: every code path above either reuses a known token
+        // (`canReuseExisting === true`, sets projectTokenId) or mints
+        // (also sets projectTokenId). If we got here without one, we'd
+        // write a manifest with no token id and no clean way to recover.
+        throw new Error("Internal: provisionS3ForProject ended without a token id. This is a bug — please file an issue.");
+    }
     const updated = {
         ...manifest,
         s3Buckets: {
@@ -411,6 +488,8 @@ export async function provisionS3ForProject(opts) {
                 : manifest.s3Buckets?.state
                     ? { state: manifest.s3Buckets.state }
                     : {}),
+            tokenId: projectTokenId,
+            accountId,
         },
     };
     writeManifest(opts.projectDir, updated);
@@ -422,6 +501,9 @@ export async function provisionS3ForProject(opts) {
             : null,
         envWritten,
         envKept,
+        accountId,
+        tokenCreated,
+        legacyUserTokenMigrated,
     };
 }
 /** Pick the registrable zone name for a hostname. Cloudflare keeps

package/dist/provision/s3-buckets.js.map

@@ -1 +1 @@
-{"version":3,"file":"s3-buckets.js","sourceRoot":"","sources":["../../src/provision/s3-buckets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,iBAAiB,EAEjB,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA+CxE;sDACsD;AACtD,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,uCAAuC,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;wCAIwC;AACxC,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACpC,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/F,CAAC;IACD,2DAA2D;IAC3D,MAAM,KAAK,GAA+B;QACxC,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,KAAK,EAAE,GAAG,CAAC;KACb,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAQhD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,6BAA6B;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,kBAAkB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,eAAe;KAC3B,CAAC;AACJ,CAAC;AAED;;;kDAGkD;AAClD,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,UAAU,iCAAiC,CAAC,CAAC;IAClG,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,iEAAiE;IACjE,mEAAmE;IACnE,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,QAAQ,iBAAiB,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAEzC,CAAC;IACd,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,gEAAgE,QAAQ,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IAEjC,mEAAmE;IACnE,sEAAsE;IACtE,8DAA8D;IAC9D,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,WAAW,SAAS,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,WAAW,QAAQ,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAEjD,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAE5D,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,CACjB,kBAAkB;QAChB,CAAC,CAAC,wBAAwB,gBAAgB,KAAK,eAAe,GAAG;QACjE,CAAC,CAAC,uBAAuB,gBAAgB,GAAG,CAC/C,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,YAAkC,CAAC;IACvC,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,kBAAkB,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,OAAO,CACb,sBAAsB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,MAAM,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAC9J,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,CACb,qBAAqB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,6JAA6J,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAA6B,CAAC;IAClC,IAAI,eAA8D,CAAC;IAEnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpF,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,8DAA8D;IAC9D,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,aAAa,GAAG,GAAG,CAAC,2BAA2B,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC/E,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACjE,MAAM,EAAE,cAAc;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;oBACnC,eAAe,GAAG,eAAe,CAAC;oBAClC,aAAa,CAAC,OAAO,CACnB,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,CAAC,IAAI,CAChB,yBAA0B,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wCAAwC,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,8BAA8B,QAAQ,sCAAsC,CAAC,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uBAAuB,QAAQ,YAAa,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,GAAG,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;YACnC,eAAe,GAAG,eAAe,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,6DAA6D;IAC7D,mEAAmE;IACnE,sEAAsE;IACtE,EAAE;IACF,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CACtD,CAAC;IACF,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CACtD,CAAC;IACF,IAAI,gBAAwB,CAAC;IAC7B,IAAI,gBAAwB,CAAC;IAC7B,IAAI,cAAkC,CAAC;IACvC,IAAI,qBAAqB,IAAI,qBAAqB,EAAE,CAAC;QACnD,gBAAgB,GAAG,qBAAqB,CAAC;QACzC,gBAAgB,GAAG,qBAAqB,CAAC;QACzC,cAAc;YACZ,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACtF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,6DAA6D,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,CACtH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,GAAG,CACtB,8DAA8D,CAC/D,CAAC,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC;gBACvC,SAAS;gBACT,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC1F,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC;YACtC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC;YAChC,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3F,MAAM,SAAS,CACb,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACrD,MAAM,CAAC,eAAe,CACvB,CAAC;YACF,MAAM,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACrF,YAAY,CAAC,OAAO,CAClB,kCAAkC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,wBAAwB,CACrF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,0OAA0O,CACjP,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7D,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,4DAA4D;IAC5D,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;IAEjE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,4BAA4B;IAC5B,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,uCAAuC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4DAA4D;IAC5D,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,0DAA0D;IAC1D,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,8DAA8D;IAC9D,IACE,IAAI,CAAC,kBAAkB,KAAK,KAAK;QACjC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EACpB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,MAAM,OAAO,GAAoB;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;YAC7C,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAY,EAAE,EAAE;gBAC/D,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK;oBACzB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;SACV;KACF,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE;QAC7E,KAAK,EACH,kBAAkB,IAAI,WAAW;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,IAAI;QACV,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;+DAI+D;AAC/D,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;yDAGyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"s3-buckets.js","sourceRoot":"","sources":["../../src/provision/s3-buckets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,iBAAiB,EAEjB,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA4D3E;sDACsD;AACtD,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,uCAAuC,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;wCAIwC;AACxC,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACpC,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/F,CAAC;IACD,2DAA2D;IAC3D,MAAM,KAAK,GAA+B;QACxC,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,KAAK,EAAE,GAAG,CAAC;KACb,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAQhD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,6BAA6B;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,kBAAkB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,eAAe;KAC3B,CAAC;AACJ,CAAC;AAED;;;kDAGkD;AAClD,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,UAAU,iCAAiC,CAAC,CAAC;IAClG,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,iEAAiE;IACjE,mEAAmE;IACnE,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,QAAQ,iBAAiB,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAEzC,CAAC;IACd,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,gEAAgE,QAAQ,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IAEjC,mEAAmE;IACnE,sEAAsE;IACtE,8DAA8D;IAC9D,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,WAAW,SAAS,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,WAAW,QAAQ,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAEjD,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAE5D,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,CACjB,kBAAkB;QAChB,CAAC,CAAC,wBAAwB,gBAAgB,KAAK,eAAe,GAAG;QACjE,CAAC,CAAC,uBAAuB,gBAAgB,GAAG,CAC/C,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,YAAkC,CAAC;IACvC,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,kBAAkB,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,OAAO,CACb,sBAAsB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,MAAM,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAC9J,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,CACb,qBAAqB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,6JAA6J,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAA6B,CAAC;IAClC,IAAI,eAA8D,CAAC;IAEnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpF,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,8DAA8D;IAC9D,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,aAAa,GAAG,GAAG,CAAC,2BAA2B,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC/E,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACjE,MAAM,EAAE,cAAc;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;oBACnC,eAAe,GAAG,eAAe,CAAC;oBAClC,aAAa,CAAC,OAAO,CACnB,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,CAAC,IAAI,CAChB,yBAA0B,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wCAAwC,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,8BAA8B,QAAQ,sCAAsC,CAAC,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uBAAuB,QAAQ,YAAa,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,GAAG,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;YACnC,eAAe,GAAG,eAAe,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,kBAAkB;IAClB,EAAE;IACF,kCAAkC;IAClC,qEAAqE;IACrE,+DAA+D;IAC/D,8DAA8D;IAC9D,8DAA8D;IAC9D,sCAAsC;IACtC,mEAAmE;IACnE,mEAAmE;IACnE,2DAA2D;IAC3D,oEAAoE;IACpE,oEAAoE;IACpE,mCAAmC;IACnC,MAAM,eAAe,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,eAAe,IAAI,iBAAiB,IAAI,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YACzE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,gBAAgB,GAAG,IAAI,CAAC;gBACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2CAA2C,CACvG,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,wBAAwB,CAC/F,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iDAAiD,CACtG,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,6DAA6D;YAC7D,oCAAoC;YACpC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAChI,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,IAAI,eAAe,IAAI,aAAa,EAAE,CAAC;QACxD,uBAAuB,GAAG,IAAI,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,iCAAiC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yCAAyC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAChH,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,+FAA+F,WAAW,KAAK,CAChH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,gBAAoC,CAAC;IACzC,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAc,GAAuB,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,YAAY,GAAoD,IAAI,CAAC;IAEzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,8DAA8D;QAC9D,8DAA8D;QAC9D,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CACtB,2CAA2C,kBAAkB,CAAC,CAAC,CAAC,GAAG,gBAAgB,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CACjI,CAAC,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC;gBAC3C,SAAS;gBACT,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC1F,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC;YACtC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC;YAChC,YAAY,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YAChE,YAAY,CAAC,OAAO,CAClB,+BAA+B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sSAAsS,CAC7S,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7D,+DAA+D;IAC/D,oEAAoE;IACpE,8DAA8D;IAC9D,mCAAmC;IACnC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,+DAA+D;IAC/D,+DAA+D;IAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;IAEjE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,4BAA4B;IAC5B,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,uCAAuC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4DAA4D;IAC5D,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,0DAA0D;IAC1D,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,8DAA8D;IAC9D,IACE,IAAI,CAAC,kBAAkB,KAAK,KAAK;QACjC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EACpB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,2DAA2D;IAC3D,mEAAmE;IACnE,6DAA6D;IAC7D,gEAAgE;IAChE,gEAAgE;IAChE,cAAc;IACd,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;YAC7C,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAY,EAAE,EAAE;gBAC/D,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK;oBACzB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,cAAc;YACvB,SAAS;SACV;KACF,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE;QAC7E,KAAK,EACH,kBAAkB,IAAI,WAAW;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,IAAI;QACV,UAAU;QACV,OAAO;QACP,SAAS;QACT,YAAY;QACZ,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;;;+DAI+D;AAC/D,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;yDAGyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/provision/s3.d.ts

@@ -0,0 +1,77 @@
+/** One bucket entry from `.hatchkit.json` paired with its minted creds. */
+export interface R2BucketToken {
+    /** Manifest key, e.g. "assets". Drives the env-var name prefix. */
+    bucketKey: string;
+    /** Actual R2 bucket name, e.g. "collection-of-beauty-assets". */
+    bucketName: string;
+    /** S3 Access Key ID (= the CF API token id). */
+    accessKeyId: string;
+    /** S3 Secret Access Key (= sha256 of the CF token value). */
+    secretAccessKey: string;
+    /** CF API token id, kept so destroy can DELETE it. */
+    tokenId: string;
+    /** Cloudflare account that owns the token + bucket — pinned in the
+     *  manifest so destroy can address the right account-tokens endpoint. */
+    accountId: string;
+    /** True if the token was minted on this run; false if the manifest
+     *  already had a verified-alive token id we reused. */
+    minted: boolean;
+}
+export interface ProvisionR2TokensResult {
+    /** Account-wide R2 S3 endpoint (`https://<id>.r2.cloudflarestorage.com`). */
+    endpoint: string;
+    /** Per-bucket minted (or reused) creds. Order follows the manifest's
+     *  alphabetical bucket-key order so re-runs produce stable diffs. */
+    bucketTokens: R2BucketToken[];
+}
+export interface ProvisionR2TokensOpts {
+    /** Project name. Used for the token's CF display name. */
+    projectName: string;
+    /** Project directory. Manifest is read from `<projectDir>/.hatchkit.json`. */
+    projectDir: string;
+}
+/** Mint (or reuse) a per-bucket scoped R2 Account API token for every
+ *  bucket declared in `.hatchkit.json` → `s3Buckets`. Returns the
+ *  endpoint + per-bucket S3-style credential pairs ready for the env
+ *  writer. The token id of every minted token is persisted into the
+ *  manifest so re-runs are idempotent and destroy can clean up. */
+export declare function provisionR2BucketTokens(opts: ProvisionR2TokensOpts): Promise<ProvisionR2TokensResult>;
+/** Convert a `provisionR2BucketTokens` result into the KEY=VALUE lines
+ *  the orchestrator writes to `.env.production`. Names follow the
+ *  R2_ prefix convention; for projects with a single bucket we ALSO
+ *  emit unprefixed `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` aliases
+ *  so existing single-bucket runtimes (which expect the unprefixed
+ *  form) keep working without code changes.
+ *
+ *  Reused tokens (where we don't know the secret-access-key; CF
+ *  doesn't expose it after creation) emit only the bucket-name +
+ *  endpoint lines — the existing encrypted .env.production is the
+ *  source of truth for the credentials, and we don't want to overwrite
+ *  it with a placeholder. */
+export declare function renderR2BucketTokensEnv(result: ProvisionR2TokensResult): string[];
+export type DeleteResult = "deleted" | "not-found";
+export interface UnprovisionR2TokensResult {
+    /** Per-bucket teardown outcome (one entry per declared bucket key). */
+    buckets: Array<{
+        bucketKey: string;
+        outcome: DeleteResult;
+    }>;
+}
+/** Delete every per-bucket scoped R2 account token minted for this
+ *  project, both upstream (CF API) and locally (manifest). Idempotent
+ *  — missing upstream tokens count as `not-found`.
+ *
+ *  Source of truth: the manifest's `s3Buckets[bucketKey].tokenId`
+ *  fields. When the manifest is missing or unreadable, returns an
+ *  empty result — the user must manually revoke tokens via the CF
+ *  dashboard. (No keychain fallback exists for the per-bucket model;
+ *  unlike the legacy single-token-per-project flow, tokens are never
+ *  written to the OS keychain in the new design.) */
+export declare function unprovisionR2BucketTokens(opts: {
+    projectName: string;
+    /** Optional — when known, the manifest at `<projectDir>/.hatchkit.json`
+     *  is consulted to enumerate buckets. Pass `null` to skip the
+     *  manifest read entirely (e.g. project dir already deleted). */
+    projectDir?: string | null;
+}): Promise<UnprovisionR2TokensResult>;
+//# sourceMappingURL=s3.d.ts.map

package/dist/provision/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/provision/s3.ts"],"names":[],"mappings":"AA2CA,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB;6EACyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;2DACuD;IACvD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB;yEACqE;IACrE,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;mEAImE;AACnE,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CA0KlC;AAED;;;;;;;;;;;6BAW6B;AAC7B,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAwBjF;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED;;;;;;;;;qDASqD;AACrD,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB;;qEAEiE;IACjE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAgErC"}