headroom-cms 0.1.11 → 0.2.1

package/dist/backup.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Backup Infrastructure
+ *
+ * A single Go Lambda that handles both backup export and restore import.
+ * The API service invokes it synchronously via lambda:InvokeFunction for the
+ * "scheduled" entry point this will gain a daily EventBridge cron (Phase 4).
+ *
+ * The Lambda links every site-scoped table plus the content + backup buckets.
+ * Deliberately NOT linked: Collab, collabStateBucket, SchedulerLock,
+ * WebhookDeliveries — these are transient / operational and excluded from
+ * backup payloads (see steering doc "What's in scope vs. out of scope").
+ */
+import type { StorageResources } from "./storage.js";
+import type { WebhookResources } from "./webhooks.js";
+export interface BackupArgs {
+    storage: StorageResources;
+    webhooks: WebhookResources;
+    pkgRoot: string;
+    dev?: {
+        /** Go source path, e.g. "packages/backup-worker" */
+        handler: string;
+    };
+}
+export declare function createBackup(name: string, args: BackupArgs): {
+    backupWorker: sst.aws.Function;
+    backupCron: sst.aws.Cron;
+};
+export type BackupResources = ReturnType<typeof createBackup>;
+//# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,oDAAoD;QACpD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;;;EAoF1D;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/backup.js

@@ -0,0 +1,95 @@
+/**
+ * Backup Infrastructure
+ *
+ * A single Go Lambda that handles both backup export and restore import.
+ * The API service invokes it synchronously via lambda:InvokeFunction for the
+ * "scheduled" entry point this will gain a daily EventBridge cron (Phase 4).
+ *
+ * The Lambda links every site-scoped table plus the content + backup buckets.
+ * Deliberately NOT linked: Collab, collabStateBucket, SchedulerLock,
+ * WebhookDeliveries — these are transient / operational and excluded from
+ * backup payloads (see steering doc "What's in scope vs. out of scope").
+ */
+import path from "path";
+export function createBackup(name, args) {
+    const { storage, webhooks } = args;
+    const workerConfig = args.dev
+        ? {
+            handler: args.dev.handler,
+            runtime: "go",
+        }
+        : {
+            bundle: path.join(args.pkgRoot, "lambda/backup-worker"),
+            handler: "bootstrap",
+            runtime: "provided.al2023",
+            architecture: "arm64",
+        };
+    const backupWorker = new sst.aws.Function(`${name}BackupWorker`, {
+        ...workerConfig,
+        // 15-minute Lambda budget. Large sites with many media files may bump up
+        // against this; see Deferred "Step Functions for very large sites" for
+        // the escape hatch.
+        timeout: "15 minutes",
+        // Higher than default — the worker holds tar/gzip pipes, an in-memory
+        // 25-row BatchWriteItem buffer, and parallel S3 GetObject buffers.
+        memory: "1024 MB",
+        environment: {
+            SITES_TABLE: storage.sites.name,
+            CONTENT_TABLE: storage.content.name,
+            DRAFT_CONTENT_TABLE: storage.draftContent.name,
+            BLOCKS_TABLE: storage.blocks.name,
+            MEDIA_TABLE: storage.media.name,
+            COLLECTIONS_TABLE: storage.collections.name,
+            BLOCK_TYPES_TABLE: storage.blockTypes.name,
+            ADMIN_AUDIT_TABLE: storage.adminAudit.name,
+            RELATIONSHIPS_TABLE: storage.relationships.name,
+            SITE_USERS_TABLE: storage.siteUsers.name,
+            WEBHOOKS_TABLE: webhooks.webhooks.name,
+            CONTENT_BUCKET: storage.contentBucket.name,
+            BACKUP_BUCKET: storage.backupBucket.name,
+            KVS_ARN: storage.kvs.arn,
+            AWS_REGION_NAME: aws.getRegionOutput().name,
+        },
+        link: [
+            storage.sites,
+            storage.content,
+            storage.draftContent,
+            storage.blocks,
+            storage.media,
+            storage.collections,
+            storage.blockTypes,
+            storage.adminAudit,
+            storage.relationships,
+            storage.siteUsers,
+            webhooks.webhooks,
+            storage.contentBucket,
+            storage.backupBucket,
+        ],
+        permissions: [
+            {
+                // CloudFront KVS resync on restore: re-publish API key hashes so the
+                // edge function recognizes them. Fail-loud per steering §2.1 step 18.
+                actions: [
+                    "cloudfront-keyvaluestore:DescribeKeyValueStore",
+                    "cloudfront-keyvaluestore:PutKey",
+                    "cloudfront-keyvaluestore:DeleteKey",
+                    "cloudfront-keyvaluestore:GetKey",
+                ],
+                resources: [storage.kvs.arn],
+            },
+        ],
+    });
+    // Phase 4 — daily EventBridge cron that invokes the worker with a
+    // "scheduled" event. The handler scans the Sites table, runs backup +
+    // retention cleanup for every site with backupSchedule.enabled. 02:00
+    // UTC is a low-traffic window for most public sites; tune in the
+    // steering doc if needed. Cost is one Lambda invocation per day per
+    // stack, regardless of site count.
+    const backupCron = new sst.aws.Cron(`${name}BackupSchedule`, {
+        schedule: "cron(0 2 * * ? *)",
+        function: backupWorker.arn,
+        event: { type: "scheduled" },
+    });
+    return { backupWorker, backupCron };
+}
+//# sourceMappingURL=backup.js.map

package/dist/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAcxB,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAgB;IACzD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC;YACvD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,cAAc,EAAE;QAC/D,GAAG,YAAY;QACf,yEAAyE;QACzE,uEAAuE;QACvE,oBAAoB;QACpB,OAAO,EAAE,YAAY;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE;YACX,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC/B,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YACnC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;YAC9C,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YACjC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC/B,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;YAC3C,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YAC1C,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YAC1C,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI;YAC/C,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YACxC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YACtC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI;YAC1C,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;YACxC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;YACxB,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI;SAC5C;QACD,IAAI,EAAE;YACJ,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,YAAY;YACpB,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,SAAS;YACjB,QAAQ,CAAC,QAAQ;YACjB,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,YAAY;SACrB;QACD,WAAW,EAAE;YACX;gBACE,qEAAqE;gBACrE,sEAAsE;gBACtE,OAAO,EAAE;oBACP,gDAAgD;oBAChD,iCAAiC;oBACjC,oCAAoC;oBACpC,iCAAiC;iBAClC;gBACD,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;aAC7B;SACF;KACF,CAAC,CAAC;IAEH,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,oEAAoE;IACpE,mCAAmC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE;QAC3D,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,YAAY,CAAC,GAAG;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC"}

package/dist/cdn-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cdn-api.d.ts","sourceRoot":"","sources":["../src/cdn-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;;;EAob1D;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"cdn-api.d.ts","sourceRoot":"","sources":["../src/cdn-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;;;EAkb1D;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/cdn-api.js

@@ -119,20 +119,14 @@ export function createApiCdn(name, args) {
             enableAcceptEncodingGzip: true,
         },
     });
-    const versionCachePolicy = new aws.cloudfront.CachePolicy(`${name}VersionCachePolicy`, {
-        name: $interpolate `${$app.name}-${$app.stage}-version-cache`,
-        comment: "Short-TTL cache for /version to absorb client polling",
-        minTtl: 0,
-        defaultTtl: 2,
-        maxTtl: 2,
-        parametersInCacheKeyAndForwardedToOrigin: {
-            cookiesConfig: { cookieBehavior: "none" },
-            headersConfig: { headerBehavior: "none" },
-            queryStringsConfig: { queryStringBehavior: "none" },
-            enableAcceptEncodingBrotli: true,
-            enableAcceptEncodingGzip: true,
-        },
-    });
+    // NOTE: the old `versionCachePolicy` (custom 2-second TTL) was deleted
+    // when /version began returning the per-site image signing secret.
+    // CloudFront custom cache policies do not honor `Cache-Control: private`
+    // from the origin — the explicit TTLs would win and the response (with
+    // the secret) would be edge-cached for 2s. We now use the AWS-managed
+    // `CachingDisabled` policy below for /v1/*/version, so the origin's
+    // `Cache-Control: private, max-age=2` is what reaches the browser
+    // (short-window in-browser cache) while the edge bypasses caching.
     // =========================================================================
     // Origin Request Policy
     // =========================================================================
@@ -276,10 +270,17 @@ export function createApiCdn(name, args) {
                     },
                 ],
             },
-            // Version endpoint: short-TTL cache (2s) shared across all consumers
-            // for a given site. The edge function still runs for API key
-            // validation. Placed before /v1/*/users/* and the default behavior
-            // because CloudFront evaluates path patterns in order, first match wins.
+            // Version endpoint: caching DISABLED at the edge. /version now
+            // carries a per-site image signing secret in the body, so the
+            // shared edge cache must not hold it. The origin sets
+            // `Cache-Control: private, max-age=2` so browsers may still cache
+            // for the 2-second window — that absorbs single-flight contention
+            // from the same client without exposing the secret to any other
+            // viewer.
+            //
+            // Tradeoff: origin Lambda invocations on /version are now one per
+            // client poll instead of one per 2-second edge window. The SDK
+            // polls every 10s by default, so the impact is bounded.
             //
             // NOTE: pathPattern "/v1/*/version" matches exact "/version" only.
             // CloudFront's `*` wildcard does not span path segments, so any
@@ -291,7 +292,7 @@ export function createApiCdn(name, args) {
                 allowedMethods: ["GET", "HEAD", "OPTIONS"],
                 cachedMethods: ["GET", "HEAD", "OPTIONS"],
                 compress: true,
-                cachePolicyId: versionCachePolicy.id,
+                cachePolicyId: cachingDisabledPolicyId,
                 originRequestPolicyId: originRequestPolicy.id,
                 functionAssociations: [
                     {

package/dist/cdn-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"cdn-api.js","sourceRoot":"","sources":["../src/cdn-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAgB;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;aAC3C;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,6DAA6D;oBAC7D,2DAA2D;oBAC3D,uDAAuD;oBACvD,8DAA8D;oBAC9D,qDAAqD;oBACrD,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;iBAC9G;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACvD,GAAG,IAAI,oBAAoB,EAC3B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,oBAAoB;oBACpB,cAAc;oBACd,QAAQ;oBACR,oBAAoB;iBACrB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,0EAA0E;IAC1E,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,wCAAwC,GAC5C,sCAAsC,CAAC;IAEzC,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;IAEvE,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;aAChE;YACD,qEAAqE;YACrE,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,0BAA0B;YAC1B;gBACE,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,yEAAyE;YACzE,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,kBAAkB,CAAC,EAAE;gBACpC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,2DAA2D;YAC3D,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,6BAA6B;YAC7B;gBACE,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,qBAAqB;gBAClC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"cdn-api.js","sourceRoot":"","sources":["../src/cdn-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAgB;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;aAC3C;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,6DAA6D;oBAC7D,2DAA2D;oBAC3D,uDAAuD;oBACvD,8DAA8D;oBAC9D,qDAAqD;oBACrD,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;iBAC9G;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IAEnE,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,oBAAoB;oBACpB,cAAc;oBACd,QAAQ;oBACR,oBAAoB;iBACrB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,0EAA0E;IAC1E,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,wCAAwC,GAC5C,sCAAsC,CAAC;IAEzC,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;IAEvE,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;aAChE;YACD,qEAAqE;YACrE,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,0BAA0B;YAC1B;gBACE,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,+DAA+D;YAC/D,8DAA8D;YAC9D,sDAAsD;YACtD,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,UAAU;YACV,EAAE;YACF,kEAAkE;YAClE,+DAA+D;YAC/D,wDAAwD;YACxD,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,2DAA2D;YAC3D,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,6BAA6B;YAC7B;gBACE,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,qBAAqB;gBAClC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}

package/dist/cron.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Cron Infrastructure
+ *
+ * EventBridge-driven scheduled Lambdas for periodic CMS maintenance. Today
+ * this is just the trash sweeper (Phase 2b of `steering/TRASH_CAN.md`); other
+ * cron-shaped workers (backup retention, etc.) live in their own modules.
+ *
+ * The trash sweeper Lambda walks every site, every collection, and purges
+ * content trashed more than `model.TrashRetentionDays` (30) days ago via the
+ * service-layer `Purge` — which fans out to drafts, slug lookups, tag counts,
+ * relationships, audit, and a `content.deleted` webhook per item. See
+ * `packages/api/cmd/trash_sweeper/main.go` for the entrypoint.
+ *
+ * Mass-delete protection is a per-run circuit breaker inside the sweeper
+ * (`TRASH_PURGE_RUN_CAP`), not a CloudWatch alarm: a run that would purge at
+ * least the cap aborts and logs at ERROR instead of completing. This keeps the
+ * feature at $0-at-rest (no custom CloudWatch metric, no alarm, no SNS topic)
+ * while actively *preventing* a runaway purge rather than alerting after the
+ * fact. The abort is visible in the sweeper's daily CloudWatch Logs line.
+ */
+import type { StorageResources } from "./storage.js";
+import type { WebhookResources } from "./webhooks.js";
+export interface CronArgs {
+    storage: StorageResources;
+    webhooks: WebhookResources;
+    pkgRoot: string;
+    /**
+     * Stage name (`$app.stage`). Used to tune per-stage alarm thresholds: prod
+     * is tight (1000 purges/day signals mass-delete), dev/PR stages are loose
+     * to absorb manual testing without paging.
+     */
+    stage: string;
+    dev?: {
+        /** Go source path for the trash sweeper, e.g. "packages/api/cmd/trash_sweeper" */
+        handler: string;
+    };
+}
+export declare function createCron(name: string, args: CronArgs): {
+    trashSweeperCron: sst.aws.Cron;
+};
+export type CronResources = ReturnType<typeof createCron>;
+//# sourceMappingURL=cron.d.ts.map

package/dist/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../src/cron.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE;QACJ,kFAAkF;QAClF,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAcD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;;EAiGtD;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/cron.js

@@ -0,0 +1,128 @@
+/**
+ * Cron Infrastructure
+ *
+ * EventBridge-driven scheduled Lambdas for periodic CMS maintenance. Today
+ * this is just the trash sweeper (Phase 2b of `steering/TRASH_CAN.md`); other
+ * cron-shaped workers (backup retention, etc.) live in their own modules.
+ *
+ * The trash sweeper Lambda walks every site, every collection, and purges
+ * content trashed more than `model.TrashRetentionDays` (30) days ago via the
+ * service-layer `Purge` — which fans out to drafts, slug lookups, tag counts,
+ * relationships, audit, and a `content.deleted` webhook per item. See
+ * `packages/api/cmd/trash_sweeper/main.go` for the entrypoint.
+ *
+ * Mass-delete protection is a per-run circuit breaker inside the sweeper
+ * (`TRASH_PURGE_RUN_CAP`), not a CloudWatch alarm: a run that would purge at
+ * least the cap aborts and logs at ERROR instead of completing. This keeps the
+ * feature at $0-at-rest (no custom CloudWatch metric, no alarm, no SNS topic)
+ * while actively *preventing* a runaway purge rather than alerting after the
+ * fact. The abort is visible in the sweeper's daily CloudWatch Logs line.
+ */
+import path from "path";
+/**
+ * Per-stage value for the sweeper's per-run purge circuit breaker
+ * (`TRASH_PURGE_RUN_CAP`). A run that would purge at least this many items
+ * aborts instead of completing — the cheap, $0 replacement for the old
+ * CloudWatch mass-delete alarm. Production is tight (1000/run signals a likely
+ * mass-delete); dev/PR stages are loose so manual testing doesn't trip it.
+ * Read by `packages/api/cmd/trash_sweeper/main.go`.
+ */
+function trashPurgeRunCap(stage) {
+    return stage === "production" ? 1000 : 10000;
+}
+export function createCron(name, args) {
+    const { storage, webhooks } = args;
+    const trashSweeperConfig = args.dev
+        ? {
+            handler: args.dev.handler,
+            runtime: "go",
+        }
+        : {
+            bundle: path.join(args.pkgRoot, "lambda/trash-sweeper"),
+            handler: "bootstrap",
+            runtime: "provided.al2023",
+            architecture: "arm64",
+        };
+    // Daily at 03:00 UTC. Cron syntax: minute hour day-of-month month day-of-week year.
+    // EventBridge requires either day-of-month or day-of-week to be `?`.
+    const trashSweeperCron = new sst.aws.Cron(`${name}TrashSweeper`, {
+        schedule: "cron(0 3 * * ? *)",
+        job: {
+            ...trashSweeperConfig,
+            // The sweeper pages through every site × every collection. 5 minutes
+            // is generous; a single site rarely has > 100 trashed items per
+            // collection per day. If we ever hit the timeout, the next run will
+            // pick up where we left off (items remain in the trash partition).
+            timeout: "5 minutes",
+            memory: "512 MB",
+            environment: {
+                // DynamoDB tables. NOTE: The sweeper's only entry point is
+                // AdminContentService.Purge, which touches content + drafts + audit
+                // + relationships + (indirectly via tagsRepo) ContentTable's
+                // tag-count items. blocksRepo and mediaRepo are passed to
+                // NewAdminContentService for symmetry with the API, but Purge's
+                // call graph never reaches them — so BLOCKS_TABLE / MEDIA_TABLE
+                // are deliberately omitted. If the sweeper ever grows a second
+                // entry point (Trash / Restore / Publish), revisit.
+                SITES_TABLE: storage.sites.name,
+                CONTENT_TABLE: storage.content.name,
+                DRAFT_CONTENT_TABLE: storage.draftContent.name,
+                COLLECTIONS_TABLE: storage.collections.name,
+                BLOCK_TYPES_TABLE: storage.blockTypes.name,
+                ADMIN_AUDIT_TABLE: storage.adminAudit.name,
+                RELATIONSHIPS_TABLE: storage.relationships.name,
+                WEBHOOKS_TABLE: webhooks.webhooks.name,
+                WEBHOOK_DELIVERIES_TABLE: webhooks.webhookDeliveries.name,
+                // Purge bumps the CDN site-version on published items, so the
+                // sweeper needs to write into the KVS just like the API Lambda.
+                KVS_ARN: storage.kvs.arn,
+                // Webhook fan-out async-invokes this Lambda per subscribed webhook.
+                WEBHOOK_WORKER_FUNCTION_NAME: webhooks.webhookWorker.name,
+                AWS_REGION_NAME: aws.getRegionOutput().name,
+                // Per-run purge circuit breaker. A sweep that would purge at least
+                // this many items aborts (and logs at ERROR) instead of completing —
+                // a $0 guard against a mass-delete / runaway, replacing the old
+                // CloudWatch mass-delete alarm. See trashPurgeRunCap above.
+                TRASH_PURGE_RUN_CAP: String(trashPurgeRunCap(args.stage)),
+            },
+            link: [
+                // Read/write — Purge mutates content (incl. tag-count items and
+                // slug-lookup rows) + drafts + audit + relationships, and emits
+                // per-item webhook delivery rows. Sites/collections/blockTypes are
+                // read-only for the sweep loop (ListAll + GetCollections).
+                // storage.blocks and storage.media are deliberately NOT linked —
+                // see env comment above.
+                storage.sites,
+                storage.content,
+                storage.draftContent,
+                storage.collections,
+                storage.blockTypes,
+                storage.adminAudit,
+                storage.relationships,
+                webhooks.webhooks,
+                webhooks.webhookDeliveries,
+            ],
+            permissions: [
+                {
+                    // CloudFront KVS bump on Purge of a published item — mirrors the
+                    // API Lambda's KVS permission set.
+                    actions: [
+                        "cloudfront-keyvaluestore:DescribeKeyValueStore",
+                        "cloudfront-keyvaluestore:PutKey",
+                        "cloudfront-keyvaluestore:DeleteKey",
+                        "cloudfront-keyvaluestore:GetKey",
+                    ],
+                    resources: [storage.kvs.arn],
+                },
+                {
+                    // Async invoke of the webhook worker. Same grant pattern as the
+                    // API Lambda (`webhooks.webhookWorker.arn` in `api.ts`).
+                    actions: ["lambda:InvokeFunction"],
+                    resources: [webhooks.webhookWorker.arn],
+                },
+            ],
+        },
+    });
+    return { trashSweeperCron };
+}
+//# sourceMappingURL=cron.js.map

package/dist/cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.js","sourceRoot":"","sources":["../src/cron.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAoBxB;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAc;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG;QACjC,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC;YACvD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,cAAc,EAAE;QAC/D,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,EAAE;YACH,GAAG,kBAAkB;YACrB,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE;gBACX,2DAA2D;gBAC3D,oEAAoE;gBACpE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,gEAAgE;gBAChE,gEAAgE;gBAChE,+DAA+D;gBAC/D,oDAAoD;gBACpD,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC/B,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBACnC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;gBAC9C,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBAC3C,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;gBAC1C,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;gBAC1C,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI;gBAC/C,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBACtC,wBAAwB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI;gBACzD,8DAA8D;gBAC9D,gEAAgE;gBAChE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;gBACxB,oEAAoE;gBACpE,4BAA4B,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI;gBACzD,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI;gBAC3C,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,4DAA4D;gBAC5D,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC1D;YACD,IAAI,EAAE;gBACJ,gEAAgE;gBAChE,gEAAgE;gBAChE,mEAAmE;gBACnE,2DAA2D;gBAC3D,iEAAiE;gBACjE,yBAAyB;gBACzB,OAAO,CAAC,KAAK;gBACb,OAAO,CAAC,OAAO;gBACf,OAAO,CAAC,YAAY;gBACpB,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,UAAU;gBAClB,OAAO,CAAC,UAAU;gBAClB,OAAO,CAAC,aAAa;gBACrB,QAAQ,CAAC,QAAQ;gBACjB,QAAQ,CAAC,iBAAiB;aAC3B;YACD,WAAW,EAAE;gBACX;oBACE,iEAAiE;oBACjE,mCAAmC;oBACnC,OAAO,EAAE;wBACP,gDAAgD;wBAChD,iCAAiC;wBACjC,oCAAoC;wBACpC,iCAAiC;qBAClC;oBACD,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;iBAC7B;gBACD;oBACE,gEAAgE;oBAChE,yDAAyD;oBACzD,OAAO,EAAE,CAAC,uBAAuB,CAAC;oBAClC,SAAS,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC;iBACxC;aACF;SACF;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9B,CAAC"}

package/dist/image.d.ts

@@ -3,6 +3,12 @@
  *
  * Sharp-based image transformation Lambda with HMAC-signed URLs.
  * Supports dev mode (Node.js source) and package mode (pre-bundled handler).
+ *
+ * The signing key is per-site: the Lambda derives it from a master KDF
+ * input (HMAC-SHA256(master, site)) so leaking one site's key cannot be
+ * used to forge URLs for another site. The OLD master is an opt-in
+ * fallback for smooth rotation — the Sharp Lambda accepts either, the Go
+ * API only signs with the primary.
  */
 import type { StorageResources } from "./storage.js";
 export interface ImageArgs {
@@ -14,7 +20,8 @@ export interface ImageArgs {
     };
 }
 export declare function createImage(name: string, args: ImageArgs): {
-    imageSigningSecret: sst.Secret;
+    imageSigningMasterSecret: sst.Secret;
+    imageSigningMasterSecretOld: sst.Secret;
     imageLambda: sst.aws.Function;
 };
 export type ImageResources = ReturnType<typeof createImage>;

package/dist/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qEAAqE;QACrE,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS;;;EA2CxD;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qEAAqE;QACrE,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS;;;;EA6DxD;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/image.js

@@ -3,10 +3,20 @@
  *
  * Sharp-based image transformation Lambda with HMAC-signed URLs.
  * Supports dev mode (Node.js source) and package mode (pre-bundled handler).
+ *
+ * The signing key is per-site: the Lambda derives it from a master KDF
+ * input (HMAC-SHA256(master, site)) so leaking one site's key cannot be
+ * used to forge URLs for another site. The OLD master is an opt-in
+ * fallback for smooth rotation — the Sharp Lambda accepts either, the Go
+ * API only signs with the primary.
  */
 import path from "path";
 export function createImage(name, args) {
-    const imageSigningSecret = new sst.Secret(`${name}ImageSigningSecret`);
+    const imageSigningMasterSecret = new sst.Secret(`${name}ImageSigningMasterSecret`);
+    // Optional fallback master used during rotation. SST treats unset
+    // secrets as empty strings, which the Lambda's deriveSiteSecret turns
+    // into a null per-site key — disabling the fallback path entirely.
+    const imageSigningMasterSecretOld = new sst.Secret(`${name}ImageSigningMasterSecretOld`);
     let imageLambda;
     if (args.dev) {
         imageLambda = new sst.aws.Function(`${name}ImageLambda`, {
@@ -23,9 +33,14 @@ export function createImage(name, args) {
             },
             environment: {
                 CONTENT_BUCKET: args.contentBucket.name,
-                IMAGE_SIGNING_SECRET: imageSigningSecret.value,
+                IMAGE_SIGNING_MASTER_SECRET: imageSigningMasterSecret.value,
+                IMAGE_SIGNING_MASTER_SECRET_OLD: imageSigningMasterSecretOld.value,
             },
-            link: [args.contentBucket, imageSigningSecret],
+            link: [
+                args.contentBucket,
+                imageSigningMasterSecret,
+                imageSigningMasterSecretOld,
+            ],
         });
     }
     else {
@@ -41,11 +56,16 @@ export function createImage(name, args) {
             },
             environment: {
                 CONTENT_BUCKET: args.contentBucket.name,
-                IMAGE_SIGNING_SECRET: imageSigningSecret.value,
+                IMAGE_SIGNING_MASTER_SECRET: imageSigningMasterSecret.value,
+                IMAGE_SIGNING_MASTER_SECRET_OLD: imageSigningMasterSecretOld.value,
             },
-            link: [args.contentBucket, imageSigningSecret],
+            link: [
+                args.contentBucket,
+                imageSigningMasterSecret,
+                imageSigningMasterSecretOld,
+            ],
         });
     }
-    return { imageSigningSecret, imageLambda };
+    return { imageSigningMasterSecret, imageSigningMasterSecretOld, imageLambda };
 }
 //# sourceMappingURL=image.js.map

package/dist/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAe;IACvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAEvE,IAAI,WAA6B,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,oBAAoB,EAAE,kBAAkB,CAAC,KAAK;aAC/C;YACD,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACtD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,oBAAoB,EAAE,kBAAkB,CAAC,KAAK;aAC/C;YACD,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAe;IACvD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,MAAM,CAC7C,GAAG,IAAI,0BAA0B,CAClC,CAAC;IACF,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,MAAM,CAChD,GAAG,IAAI,6BAA6B,CACrC,CAAC;IAEF,IAAI,WAA6B,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,2BAA2B,EAAE,wBAAwB,CAAC,KAAK;gBAC3D,+BAA+B,EAAE,2BAA2B,CAAC,KAAK;aACnE;YACD,IAAI,EAAE;gBACJ,IAAI,CAAC,aAAa;gBAClB,wBAAwB;gBACxB,2BAA2B;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACtD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,2BAA2B,EAAE,wBAAwB,CAAC,KAAK;gBAC3D,+BAA+B,EAAE,2BAA2B,CAAC,KAAK;aACnE;YACD,IAAI,EAAE;gBACJ,IAAI,CAAC,aAAa;gBAClB,wBAAwB;gBACxB,2BAA2B;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,WAAW,EAAE,CAAC;AAChF,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,7 @@
 export type { StorageResources } from "./storage.js";
 export type { AuthResources } from "./auth.js";
 export type { WebhookResources } from "./webhooks.js";
+export type { BackupResources } from "./backup.js";
 export type { ImageResources } from "./image.js";
 export type { ApiResources } from "./api.js";
 export type { ApiCdnResources } from "./cdn-api.js";
@@ -14,6 +15,7 @@ export type { MediaCdnResources } from "./cdn-media.js";
 export type { SchedulerResources } from "./scheduler.js";
 export type { CollaborationResources } from "./collaboration.js";
 export type { AdminSiteResources } from "./admin-site.js";
+export type { CronResources } from "./cron.js";
 export interface HeadroomCMSArgs {
     /**
      * Email address for sending admin invitations and password resets.
@@ -78,6 +80,8 @@ export interface HeadroomCMSArgs {
         apiHandler: string;
         /** Go source path for webhook worker, e.g. "packages/webhook-worker" */
         webhookWorkerHandler: string;
+        /** Go source path for backup worker, e.g. "packages/backup-worker" */
+        backupWorkerHandler: string;
         /** SST handler for custom message function, e.g. "packages/functions/custom-message.handler" */
         customMessageHandler: string;
         /** SST handler for image Lambda, e.g. "packages/image-lambda/index.handler" */
@@ -88,6 +92,8 @@ export interface HeadroomCMSArgs {
         schedulerHandler?: string;
         /** SST handler for collab Lambda, e.g. "packages/collab/src/index.handler" */
         collabHandler?: string;
+        /** Go source path for trash sweeper Lambda, e.g. "packages/api/cmd/trash_sweeper" */
+        trashSweeperHandler?: string;
     };
     /**
      * Build-time toggle for the collaboration feature in the admin UI.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA0CH,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gGAAgG;QAChG,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,8EAA8E;QAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,SAAgB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,SAAgB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,SAAgB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,SAAgB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,SAAgB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAElD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe;CAmIhD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4CH,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,sEAAsE;QACtE,mBAAmB,EAAE,MAAM,CAAC;QAC5B,gGAAgG;QAChG,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,8EAA8E;QAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,qFAAqF;QACrF,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IAEF;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,SAAgB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,SAAgB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,SAAgB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,SAAgB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,SAAgB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAElD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe;CAoLhD"}