hatchkit 0.1.32 → 0.1.34

package/dist/provision/s3-buckets.js

@@ -268,7 +268,41 @@ export async function provisionS3ForProject(opts) {
             throw err;
         }
     }
-    // 3. Mint a per-project R2 **Account** API token scoped to the
+    // 3. Reconcile bucket CORS so browser fetch()/crossOrigin paths can
+    //    read assets cross-origin without the user fiddling in the
+    //    dashboard. Sits before token minting because CORS doesn't depend
+    //    on the token; putting it early keeps the spinner sequence
+    //    readable. Idempotent: GET first, only PUT when the desired set
+    //    differs from what's live.
+    //
+    //    Skip flag (`--no-cors`) and a previously-recorded `skipped: true`
+    //    in the manifest both opt out — caller stays in control if they're
+    //    managing CORS out-of-band (Worker rewrite, hand-curated dashboard
+    //    policy).
+    const corsSkipFromManifest = manifest.s3Buckets?.assets?.cors?.skipped === true;
+    const skipCors = opts.skipCors === true || (corsSkipFromManifest && opts.skipCors === undefined);
+    let appliedCors;
+    if (skipCors) {
+        appliedCors = { skipped: true };
+        console.log(chalk.dim(`  · Skipped CORS reconcile (manifest records cors.skipped). Re-run with --cors-origin or --cors-allow-all to opt back in.`));
+    }
+    else {
+        if (opts.corsAllowAll && opts.corsExtraOrigins && opts.corsExtraOrigins.length > 0) {
+            throw new Error("--cors-allow-all and --cors-origin are mutually exclusive (allow-all already covers every origin).");
+        }
+        const previousExtras = manifest.s3Buckets?.assets?.cors?.extraOrigins ?? [];
+        const extras = opts.corsExtraOrigins ?? previousExtras;
+        const desired = buildDesiredCors({
+            manifest,
+            extras,
+            allowAll: opts.corsAllowAll === true,
+        });
+        if (opts.corsAllowAll) {
+            console.log(chalk.yellow(`  · --cors-allow-all set: bucket CORS will allow * (any origin). Hotlinking is now possible — narrow the list with --cors-origin when convenient.`));
+        }
+        appliedCors = await reconcileBucketCors(cf, accountId, assetsBucketName, desired, extras);
+    }
+    // 4. Mint a per-project R2 **Account** API token scoped to the
     //    buckets above. Lives in `R2 → Manage R2 API Tokens` in the
     //    Cloudflare dashboard (account scope, not user) and the manifest
     //    records its id so `hatchkit destroy` can revoke it alongside
@@ -378,7 +412,7 @@ export async function provisionS3ForProject(opts) {
             throw err;
         }
     }
-    // 4. Seed `.env.production` with the credentials + URLs. Names are
+    // 5. Seed `.env.production` with the credentials + URLs. Names are
     //    chosen by the prefix the project's runtime actually reads —
     //    detected from `.env.example` etc.
     const envPrefix = opts.envPrefix ?? detectEnvPrefix(opts.projectDir);
@@ -464,7 +498,7 @@ export async function provisionS3ForProject(opts) {
         envSpinner.fail("Could not write .env.production");
         throw err;
     }
-    // 4. Record bucket names + public URL + token id in the manifest so
+    // 6. Record bucket names + public URL + token id in the manifest so
     //    re-runs don't have to re-derive them and a future
     //    `hatchkit destroy` knows what to clean up. Preserve a
     //    previously-recorded `state` entry when the current run didn't
@@ -482,7 +516,11 @@ export async function provisionS3ForProject(opts) {
     const updated = {
         ...manifest,
         s3Buckets: {
-            assets: { name: assetsBucketName, publicUrl },
+            assets: {
+                name: assetsBucketName,
+                publicUrl,
+                ...(appliedCors ? { cors: appliedCors } : {}),
+            },
             ...(includeStateBucket
                 ? { state: { name: stateBucketName, publicUrl: null } }
                 : manifest.s3Buckets?.state
@@ -495,7 +533,12 @@ export async function provisionS3ForProject(opts) {
     writeManifest(opts.projectDir, updated);
     console.log(chalk.dim(`  · Recorded bucket names in ${MANIFEST_FILENAME} (${publicUrlSource}).`));
     return {
-        assets: { name: assetsBucketName, publicUrl, created: !assetsBucket.existed },
+        assets: {
+            name: assetsBucketName,
+            publicUrl,
+            created: !assetsBucket.existed,
+            cors: appliedCors,
+        },
         state: includeStateBucket && stateBucket
             ? { name: stateBucketName, created: !stateBucket.existed }
             : null,
@@ -524,6 +567,180 @@ function pickClosestZoneName(hostname) {
 export function defaultBucketHostname(domain) {
     return `s3.${domain}`;
 }
+// ---------------------------------------------------------------------------
+// Bucket CORS — desired-state computation + reconcile
+// ---------------------------------------------------------------------------
+//
+// The single rule that lands on the bucket is the union of:
+//   1. https://<manifest.domain>            — production site
+//   2. http://localhost:<server>/<client>   — `pnpm dev` against prod assets
+//   3. extras passed in via --cors-origin   — staging/preview domains, etc.
+//
+// A `www.<domain>` entry is intentionally NOT added by default — hatchkit
+// doesn't ship a www-redirect by default, so most projects don't have a
+// `www.` host that ever issues fetch() against the bucket. Users who do
+// run a www variant should pass `--cors-origin https://www.<domain>`.
+//
+// Methods default to GET + HEAD because the assets bucket is read-only
+// from the browser's perspective (uploads, when added, would happen via
+// signed POSTs through the server, not direct browser PUT). ExposeHeaders
+// covers progress UIs (Content-Length / Content-Type) and ETag-based
+// service-worker / HTTP-cache flows. maxAgeSeconds=86400 means the
+// browser only re-OPTIONS the bucket once a day per origin — without
+// it, every fetched asset triggers a preflight.
+/** Build the desired CORS rule for the assets bucket from the manifest
+ *  state + caller-supplied extras. Pure function — no API calls. */
+export function buildDesiredCors(args) {
+    const methods = ["GET", "HEAD"];
+    const maxAgeSeconds = 86400;
+    if (args.allowAll) {
+        return {
+            rule: {
+                allowed: { origins: ["*"], methods, headers: ["*"] },
+                exposeHeaders: ["Content-Length", "Content-Type", "ETag"],
+                maxAgeSeconds,
+            },
+            origins: ["*"],
+            methods,
+            maxAgeSeconds,
+        };
+    }
+    const origins = new Set();
+    origins.add(`https://${args.manifest.domain}`);
+    // Localhost dev origins — only one of {server,client} is added when
+    // they're equal (e.g. a Next.js project that proxies /api/* through
+    // the same port). Avoids a redundant duplicate in the resolved list.
+    const ports = args.manifest.ports;
+    if (ports?.client) {
+        origins.add(`http://localhost:${ports.client}`);
+    }
+    if (ports?.server && ports.server !== ports.client) {
+        origins.add(`http://localhost:${ports.server}`);
+    }
+    for (const e of args.extras ?? []) {
+        const trimmed = e.trim();
+        if (trimmed)
+            origins.add(trimmed);
+    }
+    const sorted = [...origins].sort();
+    return {
+        rule: {
+            allowed: { origins: sorted, methods, headers: ["*"] },
+            exposeHeaders: ["Content-Length", "Content-Type", "ETag"],
+            maxAgeSeconds,
+        },
+        origins: sorted,
+        methods,
+        maxAgeSeconds,
+    };
+}
+/** GET → diff → PUT. Returns the BucketCors entry to record in the
+ *  manifest. Surfaces progress via ora — the caller has a spinner
+ *  context (provisionS3ForProject) where one extra line slots in
+ *  cleanly between bucket-create and token-mint. */
+export async function reconcileBucketCors(cf, accountId, bucketName, desired, extras) {
+    const spinner = ora(`Reconciling CORS on ${bucketName} (${desired.origins.length} origin(s))`).start();
+    try {
+        const live = await cf.getR2BucketCors(accountId, bucketName);
+        if (live && corsRuleMatches(live, desired.rule)) {
+            spinner.succeed(`CORS up to date on ${bucketName} (${desired.origins.length} origin(s))`);
+        }
+        else {
+            await cf.putR2BucketCors(accountId, bucketName, [desired.rule]);
+            spinner.succeed(live
+                ? `CORS updated on ${bucketName} (${desired.origins.length} origin(s))`
+                : `CORS applied to ${bucketName} (${desired.origins.length} origin(s))`);
+        }
+    }
+    catch (err) {
+        spinner.fail("CORS reconcile failed");
+        const msg = err.message;
+        if (/403|10001|permission|invalid/i.test(msg)) {
+            throw new Error(`${msg}\n\n  → Cloudflare token is missing the "Workers R2 Storage: Edit" permission for CORS.\n  → Edit it at https://dash.cloudflare.com/profile/api-tokens, then re-run.`);
+        }
+        throw err;
+    }
+    return {
+        origins: desired.origins,
+        methods: desired.methods,
+        maxAgeSeconds: desired.maxAgeSeconds,
+        ...(extras.length > 0 ? { extraOrigins: [...extras].sort() } : {}),
+    };
+}
+/** Stable comparison between the live rule list and a single desired
+ *  rule. Cloudflare echoes back exactly what was PUT, but order +
+ *  optional fields can drift, so we normalise both sides. */
+function corsRuleMatches(live, desired) {
+    if (live.length !== 1)
+        return false;
+    const a = normalizeCorsRule(live[0]);
+    const b = normalizeCorsRule(desired);
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+function normalizeCorsRule(r) {
+    return {
+        allowed: {
+            origins: [...(r.allowed.origins ?? [])].sort(),
+            methods: [...(r.allowed.methods ?? [])].sort(),
+            headers: [...(r.allowed.headers ?? [])].sort(),
+        },
+        exposeHeaders: [...(r.exposeHeaders ?? [])].sort(),
+        maxAgeSeconds: r.maxAgeSeconds ?? 0,
+    };
+}
+/** Reconcile bucket CORS using the state already in the manifest +
+ *  global config, without minting tokens or touching .env. Used by
+ *  `hatchkit rename-domain` after the manifest's `domain` has been
+ *  rewritten — the new `https://<domain>` belongs in the bucket's
+ *  origin list before the user redeploys.
+ *
+ *  Best-effort: returns null + logs a hint instead of throwing on
+ *  missing config / missing manifest fields. The rename-domain caller
+ *  only runs as a follow-up bonus to its file rewrites; failing the
+ *  whole rename because the keychain is empty would be over-eager. */
+export async function reconcileAssetsCorsFromManifest(projectDir) {
+    const manifest = readManifest(projectDir);
+    if (!manifest?.s3Buckets?.assets?.name)
+        return null;
+    if (manifest.s3Buckets.assets.cors?.skipped === true)
+        return null;
+    const accountId = manifest.s3Buckets.accountId ??
+        (await (async () => {
+            const { getStore } = await import("../config.js");
+            const meta = getStore().get("providers.s3.r2");
+            if (!meta?.endpoint)
+                return undefined;
+            try {
+                return accountIdFromR2Endpoint(meta.endpoint);
+            }
+            catch {
+                return undefined;
+            }
+        })());
+    if (!accountId)
+        return null;
+    const adminToken = await getSecret(SECRET_KEYS.r2AdminToken);
+    if (!adminToken)
+        return null;
+    const cf = new CloudflareApi({ token: adminToken });
+    const extras = manifest.s3Buckets.assets.cors?.extraOrigins ?? [];
+    const desired = buildDesiredCors({ manifest, extras });
+    const applied = await reconcileBucketCors(cf, accountId, manifest.s3Buckets.assets.name, desired, extras);
+    // Persist the new resolved origin list into the manifest so a
+    // subsequent `hatchkit doctor` doesn't immediately flag drift.
+    const next = {
+        ...manifest,
+        s3Buckets: {
+            ...manifest.s3Buckets,
+            assets: {
+                ...manifest.s3Buckets.assets,
+                cors: applied,
+            },
+        },
+    };
+    writeManifest(projectDir, next);
+    return applied;
+}
 /** If a previous run already attached a custom domain to the assets
  *  bucket, surface that hostname so re-runs can default the prompt
  *  to it (instead of the freshly-computed `s3.<domain>`). Returns

package/dist/provision/s3-buckets.js.map

@@ -1 +1 @@
-{"version":3,"file":"s3-buckets.js","sourceRoot":"","sources":["../../src/provision/s3-buckets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,iBAAiB,EAEjB,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA4D3E;sDACsD;AACtD,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,uCAAuC,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;wCAIwC;AACxC,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACpC,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/F,CAAC;IACD,2DAA2D;IAC3D,MAAM,KAAK,GAA+B;QACxC,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,KAAK,EAAE,GAAG,CAAC;KACb,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAQhD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,6BAA6B;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,kBAAkB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,eAAe;KAC3B,CAAC;AACJ,CAAC;AAED;;;kDAGkD;AAClD,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,UAAU,iCAAiC,CAAC,CAAC;IAClG,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,iEAAiE;IACjE,mEAAmE;IACnE,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,QAAQ,iBAAiB,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAEzC,CAAC;IACd,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,gEAAgE,QAAQ,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IAEjC,mEAAmE;IACnE,sEAAsE;IACtE,8DAA8D;IAC9D,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,WAAW,SAAS,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,WAAW,QAAQ,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAEjD,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAE5D,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,CACjB,kBAAkB;QAChB,CAAC,CAAC,wBAAwB,gBAAgB,KAAK,eAAe,GAAG;QACjE,CAAC,CAAC,uBAAuB,gBAAgB,GAAG,CAC/C,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,YAAkC,CAAC;IACvC,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,kBAAkB,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,OAAO,CACb,sBAAsB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,MAAM,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAC9J,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,CACb,qBAAqB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,6JAA6J,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAA6B,CAAC;IAClC,IAAI,eAA8D,CAAC;IAEnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpF,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,8DAA8D;IAC9D,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,aAAa,GAAG,GAAG,CAAC,2BAA2B,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC/E,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACjE,MAAM,EAAE,cAAc;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;oBACnC,eAAe,GAAG,eAAe,CAAC;oBAClC,aAAa,CAAC,OAAO,CACnB,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,CAAC,IAAI,CAChB,yBAA0B,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wCAAwC,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,8BAA8B,QAAQ,sCAAsC,CAAC,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uBAAuB,QAAQ,YAAa,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,GAAG,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;YACnC,eAAe,GAAG,eAAe,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,kBAAkB;IAClB,EAAE;IACF,kCAAkC;IAClC,qEAAqE;IACrE,+DAA+D;IAC/D,8DAA8D;IAC9D,8DAA8D;IAC9D,sCAAsC;IACtC,mEAAmE;IACnE,mEAAmE;IACnE,2DAA2D;IAC3D,oEAAoE;IACpE,oEAAoE;IACpE,mCAAmC;IACnC,MAAM,eAAe,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,eAAe,IAAI,iBAAiB,IAAI,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YACzE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,gBAAgB,GAAG,IAAI,CAAC;gBACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2CAA2C,CACvG,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,wBAAwB,CAC/F,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iDAAiD,CACtG,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,6DAA6D;YAC7D,oCAAoC;YACpC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAChI,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,IAAI,eAAe,IAAI,aAAa,EAAE,CAAC;QACxD,uBAAuB,GAAG,IAAI,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,iCAAiC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yCAAyC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAChH,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,+FAA+F,WAAW,KAAK,CAChH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,gBAAoC,CAAC;IACzC,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAc,GAAuB,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,YAAY,GAAoD,IAAI,CAAC;IAEzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,8DAA8D;QAC9D,8DAA8D;QAC9D,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CACtB,2CAA2C,kBAAkB,CAAC,CAAC,CAAC,GAAG,gBAAgB,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CACjI,CAAC,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC;gBAC3C,SAAS;gBACT,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC1F,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC;YACtC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC;YAChC,YAAY,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YAChE,YAAY,CAAC,OAAO,CAClB,+BAA+B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sSAAsS,CAC7S,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7D,+DAA+D;IAC/D,oEAAoE;IACpE,8DAA8D;IAC9D,mCAAmC;IACnC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,+DAA+D;IAC/D,+DAA+D;IAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;IAEjE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,4BAA4B;IAC5B,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,uCAAuC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4DAA4D;IAC5D,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,0DAA0D;IAC1D,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,8DAA8D;IAC9D,IACE,IAAI,CAAC,kBAAkB,KAAK,KAAK;QACjC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EACpB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,2DAA2D;IAC3D,mEAAmE;IACnE,6DAA6D;IAC7D,gEAAgE;IAChE,gEAAgE;IAChE,cAAc;IACd,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;YAC7C,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAY,EAAE,EAAE;gBAC/D,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK;oBACzB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,cAAc;YACvB,SAAS;SACV;KACF,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE;QAC7E,KAAK,EACH,kBAAkB,IAAI,WAAW;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,IAAI;QACV,UAAU;QACV,OAAO;QACP,SAAS;QACT,YAAY;QACZ,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;;;+DAI+D;AAC/D,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;yDAGyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"s3-buckets.js","sourceRoot":"","sources":["../../src/provision/s3-buckets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,iBAAiB,EAEjB,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAsE3E;sDACsD;AACtD,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,uCAAuC,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;wCAIwC;AACxC,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACpC,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1D,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/F,CAAC;IACD,2DAA2D;IAC3D,MAAM,KAAK,GAA+B;QACxC,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,KAAK,EAAE,GAAG,CAAC;KACb,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAQhD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,6BAA6B;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,kBAAkB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,eAAe;KAC3B,CAAC;AACJ,CAAC;AAED;;;kDAGkD;AAClD,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,UAAU,iCAAiC,CAAC,CAAC;IAClG,CAAC;IAED,iEAAiE;IACjE,6DAA6D;IAC7D,iEAAiE;IACjE,mEAAmE;IACnE,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE,QAAQ,iBAAiB,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAEzC,CAAC;IACd,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,gEAAgE,QAAQ,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IAEjC,mEAAmE;IACnE,sEAAsE;IACtE,8DAA8D;IAC9D,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,WAAW,SAAS,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,WAAW,QAAQ,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAEjD,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAE5D,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,CACjB,kBAAkB;QAChB,CAAC,CAAC,wBAAwB,gBAAgB,KAAK,eAAe,GAAG;QACjE,CAAC,CAAC,uBAAuB,gBAAgB,GAAG,CAC/C,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,YAAkC,CAAC;IACvC,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,kBAAkB,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,OAAO,CACb,sBAAsB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,MAAM,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAC9J,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,CACb,qBAAqB,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,6JAA6J,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAA6B,CAAC;IAClC,IAAI,eAA8D,CAAC;IAEnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpF,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5E,8DAA8D;IAC9D,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,aAAa,GAAG,GAAG,CAAC,2BAA2B,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC/E,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACjE,MAAM,EAAE,cAAc;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;oBACnC,eAAe,GAAG,eAAe,CAAC;oBAClC,aAAa,CAAC,OAAO,CACnB,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,MAAM,SAAS,EAAE,CAC/E,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,CAAC,IAAI,CAChB,yBAA0B,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wCAAwC,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,8BAA8B,QAAQ,sCAAsC,CAAC,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uBAAuB,QAAQ,YAAa,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,GAAG,CAAC,kCAAkC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,SAAS,GAAG,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC;YACnC,eAAe,GAAG,eAAe,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,+DAA+D;IAC/D,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,+BAA+B;IAC/B,EAAE;IACF,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,MAAM,oBAAoB,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACjG,IAAI,WAAmC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACb,WAAW,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,2HAA2H,CAC5H,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,cAAc,CAAC;QACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,QAAQ;YACR,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI;SACrC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,mJAAmJ,CACpJ,CACF,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5F,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,kBAAkB;IAClB,EAAE;IACF,kCAAkC;IAClC,qEAAqE;IACrE,+DAA+D;IAC/D,8DAA8D;IAC9D,8DAA8D;IAC9D,sCAAsC;IACtC,mEAAmE;IACnE,mEAAmE;IACnE,2DAA2D;IAC3D,oEAAoE;IACpE,oEAAoE;IACpE,mCAAmC;IACnC,MAAM,eAAe,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;QAC9C,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,eAAe,IAAI,iBAAiB,IAAI,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YACzE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,gBAAgB,GAAG,IAAI,CAAC;gBACxB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2CAA2C,CACvG,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,wBAAwB,CAC/F,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yBAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iDAAiD,CACtG,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,6DAA6D;YAC7D,oCAAoC;YACpC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,gCAAgC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAChI,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,IAAI,eAAe,IAAI,aAAa,EAAE,CAAC;QACxD,uBAAuB,GAAG,IAAI,CAAC;QAC/B,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,iCAAiC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yCAAyC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAO,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAChH,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,+FAA+F,WAAW,KAAK,CAChH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,gBAAoC,CAAC;IACzC,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAc,GAAuB,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,YAAY,GAAoD,IAAI,CAAC;IAEzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,8DAA8D;QAC9D,8DAA8D;QAC9D,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CACtB,2CAA2C,kBAAkB,CAAC,CAAC,CAAC,GAAG,gBAAgB,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CACjI,CAAC,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC;gBAC3C,SAAS;gBACT,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC1F,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC;YACtC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAC1C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC;YAChC,YAAY,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YAChE,YAAY,CAAC,OAAO,CAClB,+BAA+B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sSAAsS,CAC7S,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7D,+DAA+D;IAC/D,oEAAoE;IACpE,8DAA8D;IAC9D,mCAAmC;IACnC,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,+DAA+D;IAC/D,+DAA+D;IAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;IAEjE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,4BAA4B;IAC5B,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,uCAAuC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4DAA4D;IAC5D,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,0DAA0D;IAC1D,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,8DAA8D;IAC9D,IACE,IAAI,CAAC,kBAAkB,KAAK,KAAK;QACjC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EACpB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,2DAA2D;IAC3D,mEAAmE;IACnE,6DAA6D;IAC7D,gEAAgE;IAChE,gEAAgE;IAChE,cAAc;IACd,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,MAAM,EAAE;gBACN,IAAI,EAAE,gBAAgB;gBACtB,SAAS;gBACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C;YACD,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAY,EAAE,EAAE;gBAC/D,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK;oBACzB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,cAAc;YACvB,SAAS;SACV;KACF,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,iBAAiB,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,gBAAgB;YACtB,SAAS;YACT,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO;YAC9B,IAAI,EAAE,WAAW;SAClB;QACD,KAAK,EACH,kBAAkB,IAAI,WAAW;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,IAAI;QACV,UAAU;QACV,OAAO;QACP,SAAS;QACT,YAAY;QACZ,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;;;+DAI+D;AAC/D,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;yDAGyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,EAAE;AACF,4DAA4D;AAC5D,8DAA8D;AAC9D,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,gDAAgD;AAEhD;oEACoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,IAIhC;IACC,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;gBACpD,aAAa,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,MAAM,CAAC;gBACzD,aAAa;aACd;YACD,OAAO,EAAE,CAAC,GAAG,CAAC;YACd,OAAO;YACP,aAAa;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/C,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO;QACL,IAAI,EAAE;YACJ,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;YACrD,aAAa,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,MAAM,CAAC;YACzD,aAAa;SACd;QACD,OAAO,EAAE,MAAM;QACf,OAAO;QACP,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;oDAGoD;AACpD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAiB,EACjB,SAAiB,EACjB,UAAkB,EAClB,OAA0F,EAC1F,MAAgB;IAEhB,MAAM,OAAO,GAAG,GAAG,CACjB,uBAAuB,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,CAC1E,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,sBAAsB,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,OAAO,CACb,IAAI;gBACF,CAAC,CAAC,mBAAmB,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa;gBACvE,CAAC,CAAC,mBAAmB,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sKAAsK,CAC7K,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;6DAE6D;AAC7D,SAAS,eAAe,CAAC,IAAkB,EAAE,OAAmB;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa;IACtC,OAAO;QACL,OAAO,EAAE;YACP,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;SAC/C;QACD,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAClD,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;sEASsE;AACtE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAkB;IAElB,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElE,MAAM,SAAS,GACb,QAAQ,CAAC,SAAS,CAAC,SAAS;QAC5B,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAsC,CAAC;YACpF,IAAI,CAAC,IAAI,EAAE,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,EAAE,EACF,SAAS,EACT,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAC9B,OAAO,EACP,MAAM,CACP,CAAC;IAEF,8DAA8D;IAC9D,+DAA+D;IAC/D,MAAM,IAAI,GAAoB;QAC5B,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,MAAM,EAAE;gBACN,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM;gBAC5B,IAAI,EAAE,OAAO;aACd;SACF;KACF,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scaffold/manifest.d.ts

@@ -80,6 +80,7 @@ export interface ProjectManifest {
             name: string;
             publicUrl: string;
             tokenId?: string;
+            cors?: BucketCors;
         };
         state?: {
             name: string;
@@ -107,9 +108,41 @@ export interface ProjectManifest {
             name: string;
             publicUrl: string | null;
             tokenId?: string;
+            cors?: BucketCors;
         } | string | undefined;
     };
 }
+/** CORS policy applied to the public assets bucket. The single-rule
+ *  shape mirrors Cloudflare's R2 limitation (one rule per bucket, not
+ *  per-prefix). When `skipped` is true the user explicitly opted out
+ *  via `--no-cors` and re-runs of `provision s3` should leave the live
+ *  bucket policy alone — useful for projects that manage CORS
+ *  out-of-band (e.g. via a Cloudflare Worker rewrite or a manually-
+ *  curated dashboard policy).
+ *
+ *  `origins` records the *resolved* set actually applied — the union
+ *  of the manifest defaults (production domain + localhost dev ports)
+ *  and `extraOrigins`. The doctor drift check compares this against
+ *  the live bucket policy. `extraOrigins` records the user-supplied
+ *  inputs separately so a re-run can recompute the resolved list when
+ *  the project domain changes (`hatchkit rename-domain`) without
+ *  losing the user's explicit additions. */
+export interface BucketCors {
+    /** Resolved list of origins applied to the bucket. Sorted +
+     *  deduplicated by `provisionS3ForProject` so re-runs are stable. */
+    origins?: string[];
+    /** Allowed methods. Default ["GET","HEAD"] when omitted. */
+    methods?: string[];
+    /** Preflight cache TTL. Default 86400 (one day) when omitted. */
+    maxAgeSeconds?: number;
+    /** Extra origins the user passed via `--cors-origin <url>` or in the
+     *  manifest. Folded into `origins` on the next run. */
+    extraOrigins?: string[];
+    /** True when the user opted out of CORS provisioning entirely
+     *  (`--no-cors`). `provision s3` skips the CORS step on re-runs;
+     *  `doctor` skips drift detection. */
+    skipped?: boolean;
+}
 /** Build a manifest from the internal ProjectConfig, explicitly
  *  whitelisting only the safe fields. Any new field on ProjectConfig
  *  will NOT leak into the manifest unless added here on purpose. */

package/dist/scaffold/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/scaffold/manifest.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAClD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,OAAO,EAAE,OAAO,gBAAgB,CAAC;IACjC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,0CAA0C;IAC1C,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;6DACyD;IACzD,UAAU,EAAE,UAAU,CAAC;IACvB;qDACiD;IACjD,YAAY,EAAE,UAAU,GAAG,KAAK,CAAC;IACjC;;mDAE+C;IAC/C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;oEACgE;IAChE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D;;;;;gEAK4D;IAC5D,QAAQ,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,MAAM,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6BoB;IACpB,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/D,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;;uCAK+B;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;;;;;wDAOgD;QAChD,CAAC,GAAG,EAAE,MAAM,GACR;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,GAC5D,MAAM,GACN,SAAS,CAAC;KACf,CAAC;CACH;AAED;;oEAEoE;AACpE,wBAAgB,UAAU,CACxB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,MAAM,GACjB,eAAe,CAoBjB;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAGhF;AAED;;;gCAGgC;AAChC,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAiBvE"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/scaffold/manifest.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAClD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,OAAO,EAAE,OAAO,gBAAgB,CAAC;IACjC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,0CAA0C;IAC1C,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;6DACyD;IACzD,UAAU,EAAE,UAAU,CAAC;IACvB;qDACiD;IACjD,YAAY,EAAE,UAAU,GAAG,KAAK,CAAC;IACjC;;mDAE+C;IAC/C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;oEACgE;IAChE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D;;;;;gEAK4D;IAC5D,QAAQ,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,MAAM,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6BoB;IACpB,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,UAAU,CAAA;SAAE,CAAC;QAClF,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;;uCAK+B;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;;;;;wDAOgD;QAChD,CAAC,GAAG,EAAE,MAAM,GACR;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,UAAU,CAAA;SAAE,GAC/E,MAAM,GACN,SAAS,CAAC;KACf,CAAC;CACH;AAED;;;;;;;;;;;;;;4CAc4C;AAC5C,MAAM,WAAW,UAAU;IACzB;yEACqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;2DACuD;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;0CAEsC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;oEAEoE;AACpE,wBAAgB,UAAU,CACxB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,MAAM,GACjB,eAAe,CAoBjB;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAGhF;AAED;;;gCAGgC;AAChC,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAiBvE"}

package/dist/scaffold/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/scaffold/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAkGlC;;oEAEoE;AACpE,MAAM,UAAU,UAAU,CACxB,MAAqB,EACrB,KAAmB,EACnB,UAAkB;IAElB,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,UAAU;QACV,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,KAAK,EAAE;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,QAAyB;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;gCAGgC;AAChC,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QACzB,MAAgC,CAAC,OAAO,KAAK,gBAAgB,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,kCAAkC,gBAAgB,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/scaffold/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAkIlC;;oEAEoE;AACpE,MAAM,UAAU,UAAU,CACxB,MAAqB,EACrB,KAAmB,EACnB,UAAkB;IAElB,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,UAAU;QACV,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,KAAK,EAAE;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,QAAyB;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;gCAGgC;AAChC,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QACzB,MAAgC,CAAC,OAAO,KAAK,gBAAgB,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,kCAAkC,gBAAgB,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC"}

package/dist/templates/build-pipeline/Dockerfile.client.hbs

@@ -32,16 +32,24 @@ RUN corepack enable && pnpm install --frozen-lockfile
 COPY . .
 # `--mount=type=secret,id=dotenvx_private_key,env=DOTENV_PRIVATE_KEY_PRODUCTION`
 # exposes the secret value as the env var the wrapped command reads,
-# only for the duration of this RUN. dotenvx picks it up, decrypts
-# .env.production in memory, and re-exports each KEY=VALUE for
-# `pnpm build`. If the secret isn't supplied, dotenvx silently skips
-# decryption and the build would bake `encrypted:...` strings into
-# asset URLs — fail fast instead.
+# only for the duration of each RUN it's mounted into. dotenvx picks
+# it up, decrypts .env.production in memory, and re-exports each
+# KEY=VALUE for `pnpm build`. If the secret is missing, dotenvx
+# silently skips decryption and the build would bake `encrypted:...`
+# strings into asset URLs — fail fast instead.
+#
+# Two separate RUN steps on purpose: BuildKit dumps the entire RUN
+# command into the build error when ANY step in a chained `&&` fails,
+# echo strings included. Splitting the secret check off means the
+# "secret not supplied" message only shows up when that's actually
+# what failed — a downstream `pnpm build` failure won't drag the
+# misleading echo into its error context.
 RUN --mount=type=secret,id=dotenvx_private_key,env=DOTENV_PRIVATE_KEY_PRODUCTION \
-    if [ -z "$DOTENV_PRIVATE_KEY_PRODUCTION" ]; then \
+    test -n "$DOTENV_PRIVATE_KEY_PRODUCTION" || { \
       echo "ERROR: dotenvx_private_key build secret not supplied. The workflow at .github/workflows/deploy.yml should pass it via 'secrets:' from the GH Actions secret DOTENV_PRIVATE_KEY_PRODUCTION." >&2; \
       exit 1; \
-    fi && \
+    }
+RUN --mount=type=secret,id=dotenvx_private_key,env=DOTENV_PRIVATE_KEY_PRODUCTION \
     pnpm dlx @dotenvx/dotenvx run -- pnpm build
 
 FROM nginx:alpine AS runner

package/dist/templates/build-pipeline/Dockerfile.server.hbs

@@ -31,15 +31,18 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 # Build-time decryption — see the header comment for the rationale.
-# `if [ -z "$DOTENV_PRIVATE_KEY_PRODUCTION" ]` fails fast when the
-# workflow forgot to pass the secret; without it dotenvx would
-# silently export zero env vars and the build would bake broken
-# `encrypted:...` strings into the static bundle.
+# Two separate RUN steps on purpose: BuildKit dumps the entire RUN
+# command into the build error when ANY step in a chained `&&` fails,
+# echo strings included. Splitting the secret-presence check off means
+# "secret not supplied" only shows up when that's actually what failed —
+# a downstream `pnpm build` failure won't drag the misleading echo
+# into its error context.
 RUN --mount=type=secret,id=dotenvx_private_key,env=DOTENV_PRIVATE_KEY_PRODUCTION \
-    if [ -z "$DOTENV_PRIVATE_KEY_PRODUCTION" ]; then \
+    test -n "$DOTENV_PRIVATE_KEY_PRODUCTION" || { \
       echo "ERROR: dotenvx_private_key build secret not supplied. The workflow at .github/workflows/deploy.yml should pass it via 'secrets:' from the GH Actions secret DOTENV_PRIVATE_KEY_PRODUCTION." >&2; \
       exit 1; \
-    fi && \
+    }
+RUN --mount=type=secret,id=dotenvx_private_key,env=DOTENV_PRIVATE_KEY_PRODUCTION \
     corepack enable && \
     pnpm dlx @dotenvx/dotenvx run -- pnpm build
 

package/dist/utils/cloudflare-api.d.ts

@@ -4,6 +4,19 @@ export interface CloudflareZone {
     name_servers: string[];
     status: string;
 }
+/** A single Cloudflare R2 CORS rule. Mirrors the shape Cloudflare's
+ *  PUT/GET `/r2/buckets/<bucket>/cors` endpoint accepts and returns —
+ *  only the fields hatchkit actually sets are listed. The bucket policy
+ *  is single-rule (Cloudflare doesn't support per-prefix rules). */
+export interface R2CorsRule {
+    allowed: {
+        origins: string[];
+        methods: string[];
+        headers?: string[];
+    };
+    exposeHeaders?: string[];
+    maxAgeSeconds?: number;
+}
 export interface CloudflareApiOptions {
     token: string;
     /** Optional: filter to one account. Useful if the token spans multiple. */
@@ -226,6 +239,13 @@ export declare class CloudflareApi {
      *  migration to clean up the legacy user-tokens hatchkit minted
      *  before we switched provisioning to account tokens. Idempotent. */
     deleteApiToken(tokenId: string): Promise<"deleted" | "not-found">;
+    /** Read the bucket's CORS rules. Returns null on 404 (no policy set). */
+    getR2BucketCors(accountId: string, bucket: string): Promise<R2CorsRule[] | null>;
+    /** Replace the bucket's CORS rules (PUT semantics — overwrites the
+     *  whole policy). */
+    putR2BucketCors(accountId: string, bucket: string, rules: R2CorsRule[]): Promise<R2CorsRule[]>;
+    /** Remove every CORS rule on the bucket. Idempotent: 404 → "not-found". */
+    deleteR2BucketCors(accountId: string, bucket: string): Promise<"deleted" | "not-found">;
     /** Attach a custom domain (a hostname on a Cloudflare zone you own)
      *  to an R2 bucket. Idempotent — duplicates short-circuit via list. */
     addR2CustomDomain(accountId: string, bucket: string, params: {

package/dist/utils/cloudflare-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,kCAAkC;AAClC,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,EAAE,oBAAoB;YAK3B,OAAO;IAoBrB,iDAAiD;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAKpC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B5C,gEAAgE;IAC1D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjE,6DAA6D;IACvD,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAQhG;;;qEAGiE;IAC3D,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GACA,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B9D;4EACwE;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IA0BtF;;;gEAG4D;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE,0DAA0D;IACpD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IASzF;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAoB3D;sEACkE;IAC5D,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;KAAO,GACnF,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAwBF,gDAAgD;IAC1C,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAST;;;;;;;;OAQG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;IAYjD;uEACmE;IAC7D,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,UAAO,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMlE;iDAC6C;IACvC,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CACR,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAC3F;IAeD;;;;;;;;;;;;;;;;;;oEAkBgE;IAC1D,gBAAgB,CAAC,MAAM,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB;kCAC0B;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,uEAAuE;QACvE,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB;8EACsE;QACtE,YAAY,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;QAC5C,wEAAwE;QACxE,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,6DAA6D;QAC7D,OAAO,EAAE,MAAM,CAAC;QAChB,+CAA+C;QAC/C,UAAU,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;QACpB,sDAAsD;QACtD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAkDF;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;QAC5C,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAmDF;;;gDAG4C;IACtC,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAY/D;;wDAEoD;IAC9C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IAU9F;;;;;;;;8DAQ0D;IAC1D,OAAO,CAAC,qBAAqB,CAA+D;YAC9E,qBAAqB;IAwBnC;;;yEAGqE;IAC/D,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IAUvE;2EACuE;IACjE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;KAAE,GACjF,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAoB5E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,OAAO,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9C,CAAC;CAkDH"}
+{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;oEAGoE;AACpE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,kCAAkC;AAClC,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,EAAE,oBAAoB;YAK3B,OAAO;IAoBrB,iDAAiD;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAKpC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B5C,gEAAgE;IAC1D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjE,6DAA6D;IACvD,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAC3B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAQhG;;;qEAGiE;IAC3D,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GACA,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B9D;4EACwE;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IA0BtF;;;gEAG4D;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE,0DAA0D;IACpD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IASzF;;;;;;;;;;;;;;;;;;;;+DAoB2D;IAoB3D;sEACkE;IAC5D,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;KAAO,GACnF,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAwBF,gDAAgD;IAC1C,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;IAST;;;;;;;;OAQG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;IAYjD;uEACmE;IAC7D,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,UAAO,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMlE;iDAC6C;IACvC,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CACR,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAC3F;IAeD;;;;;;;;;;;;;;;;;;oEAkBgE;IAC1D,gBAAgB,CAAC,MAAM,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB;kCAC0B;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,uEAAuE;QACvE,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB;8EACsE;QACtE,YAAY,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;QAC5C,wEAAwE;QACxE,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,6DAA6D;QAC7D,OAAO,EAAE,MAAM,CAAC;QAChB,+CAA+C;QAC/C,UAAU,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;QACpB,sDAAsD;QACtD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAkDF;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;QAC5C,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KACrC,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAmDF;;;gDAG4C;IACtC,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAY/D;;wDAEoD;IAC9C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IAU9F;;;;;;;;8DAQ0D;IAC1D,OAAO,CAAC,qBAAqB,CAA+D;YAC9E,qBAAqB;IAwBnC;;;yEAGqE;IAC/D,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IA6BvE,yEAAyE;IACnE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC;IAgBtF;yBACqB;IACf,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,UAAU,EAAE,CAAC;IASxB,2EAA2E;IACrE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;IAW7F;2EACuE;IACjE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;KAAE,GACjF,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAoB5E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,OAAO,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9C,CAAC;CAkDH"}

package/dist/utils/cloudflare-api.js

@@ -457,6 +457,58 @@ export class CloudflareApi {
             throw err;
         }
     }
+    // ---------------------------------------------------------------------
+    // R2 bucket CORS
+    // ---------------------------------------------------------------------
+    //
+    // CORS is global to the bucket (not per-prefix). Browser code paths
+    // that use fetch() / XHR / `crossOrigin="anonymous"` (WebGL TextureLoader,
+    // createImageBitmap, audio/video tags with crossOrigin, service-worker
+    // ETag flows) require an Access-Control-Allow-Origin header even on
+    // GETs that work fine for plain `<img>`. Without a CORS rule the
+    // browser blocks the response.
+    //
+    // Same `Workers R2 Storage:Edit` perm as bucket create. A token that
+    // got far enough to create the bucket but trips here is missing the
+    // CORS-specific privilege on a token that's been narrowed since —
+    // surface that hint at the call site.
+    //
+    // Idempotency: GET first, only PUT if the rules differ. Cloudflare
+    // doesn't expose a per-rule etag, so the caller compares rule shape.
+    /** Read the bucket's CORS rules. Returns null on 404 (no policy set). */
+    async getR2BucketCors(accountId, bucket) {
+        try {
+            const res = await this.request("GET", `/accounts/${accountId}/r2/buckets/${bucket}/cors`);
+            return res.rules ?? [];
+        }
+        catch (err) {
+            const msg = err.message;
+            // CF returns either a 404 or a "no CORS configuration found" body
+            // when the bucket has no policy yet — both should resolve to null.
+            if (/404|not\s*found|10059|no\s*cors/i.test(msg))
+                return null;
+            throw err;
+        }
+    }
+    /** Replace the bucket's CORS rules (PUT semantics — overwrites the
+     *  whole policy). */
+    async putR2BucketCors(accountId, bucket, rules) {
+        const res = await this.request("PUT", `/accounts/${accountId}/r2/buckets/${bucket}/cors`, { rules });
+        return res.rules ?? rules;
+    }
+    /** Remove every CORS rule on the bucket. Idempotent: 404 → "not-found". */
+    async deleteR2BucketCors(accountId, bucket) {
+        try {
+            await this.request("DELETE", `/accounts/${accountId}/r2/buckets/${bucket}/cors`);
+            return "deleted";
+        }
+        catch (err) {
+            const msg = err.message;
+            if (/404|not\s*found|10059|no\s*cors/i.test(msg))
+                return "not-found";
+            throw err;
+        }
+    }
     /** Attach a custom domain (a hostname on a Cloudflare zone you own)
      *  to an R2 bucket. Idempotent — duplicates short-circuit via list. */
     async addR2CustomDomain(accountId, bucket, params) {