headroom-cms 0.1.6 → 0.1.8

package/dist/cdn.js

@@ -71,14 +71,8 @@ export function createCdn(name, args) {
       var keyHash = crypto.createHash('sha256').update(apiKeyHeader.value).digest('hex');
       var hashPrefix = keyHash.substring(0, 8);
 
-      // Fetch API key hash and version in parallel
-      var results = await Promise.all([
-        kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; }),
-        kvsHandle.get('site:' + site + ':version').catch(function() { return '0'; }),
-      ]);
-
-      var storedHash = results[0];
-      var versionResult = results[1];
+      // Fetch the stored API key hash from KVS
+      var storedHash = await kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; });
 
       // Validate API key - compare full hash
       if (!storedHash || storedHash !== keyHash) {
@@ -90,9 +84,6 @@ export function createCdn(name, args) {
         };
       }
 
-      // Add version header for cache key discrimination
-      request.headers['x-site-version'] = { value: versionResult || '0' };
-
       return request;
     }
   `,
@@ -136,12 +127,17 @@ export function createCdn(name, args) {
             cookiesConfig: { cookieBehavior: "none" },
             headersConfig: {
                 headerBehavior: "whitelist",
-                headers: { items: ["x-site-version"] },
+                headers: { items: ["x-headroom-version"] },
             },
             queryStringsConfig: {
                 queryStringBehavior: "whitelist",
                 queryStrings: {
-                    items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort"],
+                    // `select` MUST be in the cache key — without it, CloudFront
+                    // will serve whichever variant (meta / full / title,cover)
+                    // populated the cache entry first for every subsequent
+                    // variant on the same URL, silently corrupting SDK consumers.
+                    // See the single-item GET fix in handler/content.go.
+                    items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort", "select"],
                 },
             },
             enableAcceptEncodingBrotli: true,
@@ -181,6 +177,20 @@ export function createCdn(name, args) {
             enableAcceptEncodingGzip: true,
         },
     });
+    const versionCachePolicy = new aws.cloudfront.CachePolicy(`${name}VersionCachePolicy`, {
+        name: $interpolate `${$app.name}-${$app.stage}-version-cache`,
+        comment: "Short-TTL cache for /version to absorb client polling",
+        minTtl: 0,
+        defaultTtl: 2,
+        maxTtl: 2,
+        parametersInCacheKeyAndForwardedToOrigin: {
+            cookiesConfig: { cookieBehavior: "none" },
+            headersConfig: { headerBehavior: "none" },
+            queryStringsConfig: { queryStringBehavior: "none" },
+            enableAcceptEncodingBrotli: true,
+            enableAcceptEncodingGzip: true,
+        },
+    });
     // =========================================================================
     // Origin Request Policy
     // =========================================================================
@@ -193,16 +203,27 @@ export function createCdn(name, args) {
             headers: {
                 items: [
                     "x-headroom-key",
+                    "x-headroom-session",
                     "content-type",
                     "accept",
-                    "x-site-version",
+                    "x-headroom-version",
                 ],
             },
         },
         queryStringsConfig: { queryStringBehavior: "all" },
     });
-    // Managed AllViewerExceptHostHeader policy for admin paths
-    const adminOriginRequestPolicyId = "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    // Managed AllViewerExceptHostHeader policy — forwards every viewer header
+    // except Host, including `Authorization`. CloudFront reserves certain
+    // headers (notably `Authorization`) and refuses to include them in a
+    // *custom* origin request policy, so paths that need bearer tokens at the
+    // origin must use this managed policy. It's used by `/v1/admin/*` as well
+    // as the site-user authenticated `/v1/*/auth/*` and `/v1/*/users/*`
+    // behaviors below. Safe to pair with the CachingDisabled policy — no cache
+    // key means no cross-user response leakage.
+    const allViewerExceptHostOriginRequestPolicyId = "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    // Managed CachingDisabled policy ID — used by admin and the site-user
+    // authenticated behaviors below.
+    const cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
     // =========================================================================
     // Origin Access Controls (OAC)
     // =========================================================================
@@ -321,8 +342,147 @@ export function createCdn(name, args) {
                 ],
                 cachedMethods: ["GET", "HEAD", "OPTIONS"],
                 compress: true,
-                cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
-                originRequestPolicyId: adminOriginRequestPolicyId,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+            },
+            // Site-user authenticated paths: no caching, forwards Authorization.
+            // Covers OTP request/verify, GET/refresh session, and PATCH
+            // /v1/{site}/users/me. Caching is disabled because the cache key
+            // does not include user identity — caching authenticated responses
+            // here would leak data between users. The edge function still runs
+            // for API key validation.
+            {
+                pathPattern: "/v1/*/auth/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            // Version endpoint: short-TTL cache (2s) shared across all consumers
+            // for a given site. The edge function still runs for API key
+            // validation. Placed before /v1/*/users/* and the default behavior
+            // because CloudFront evaluates path patterns in order, first match wins.
+            //
+            // NOTE: pathPattern "/v1/*/version" matches exact "/version" only.
+            // CloudFront's `*` wildcard does not span path segments, so any
+            // future /version/* sub-routes need their own behavior.
+            {
+                pathPattern: "/v1/*/version",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: ["GET", "HEAD", "OPTIONS"],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: versionCachePolicy.id,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            {
+                pathPattern: "/v1/*/users/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            // Submissions: never cached. The full lifecycle lives here
+            // (GET list/get/mine/batch, POST create/batch, PUT update), so the
+            // allowedMethods list is full. Writes go through CloudFront now that
+            // Phase 2 moved create/update off the old /submit/* verb routes.
+            // Uses the custom originRequestPolicy (not AllViewerExceptHost)
+            // because x-headroom-key and x-headroom-session are the trust
+            // boundary here — no Authorization header is involved.
+            //
+            // Two path patterns are registered because CloudFront pattern matching
+            // does not treat `/v1/*/submissions/*` as matching the bare
+            // `/v1/{site}/submissions` (no trailing slash) — which is where POST
+            // create and GET list land. Both entries share the same policies and
+            // edge function association.
+            {
+                pathPattern: "/v1/*/submissions",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            {
+                pathPattern: "/v1/*/submissions/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
             },
             // Media originals: served directly from S3 via OAC
             {
@@ -358,7 +518,7 @@ export function createCdn(name, args) {
                 allowedMethods: ["GET", "HEAD"],
                 cachedMethods: ["GET", "HEAD"],
                 compress: true,
-                cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+                cachePolicyId: cachingDisabledPolicyId,
                 originRequestPolicyId: originRequestPolicy.id,
             },
         ],

package/dist/cdn.js.map

@@ -1 +1 @@
-{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../src/cdn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CACtD,GAAG,IAAI,cAAc,EACrB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;;;;;;;;;;;;;;;;;GAiBT;KACE,CACF,CAAC;IAEF,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;aACvC;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;iBACpG;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;iBAC/C;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,cAAc;oBACd,QAAQ;oBACR,gBAAgB;iBACjB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,2DAA2D;IAC3D,MAAM,0BAA0B,GAC9B,sCAAsC,CAAC;IAEzC,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,yBAAyB;QACtC,6BAA6B,EAAE,IAAI;QACnC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,uCAAuC;QACpD,6BAA6B,EAAE,QAAQ;QACvC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,YAAY,CAAA,GAAG,aAAa,CAAC,IAAI,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,gBAAgB,CAAC;IAE5G,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;YACD;gBACE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,gBAAgB;gBAC5B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,cAAc,EAAE;oBACd,oBAAoB,EAAE,EAAE;iBACzB;aACF;YACD;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,iBAAiB;gBAC7B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,sCAAsC;gBACrD,qBAAqB,EAAE,0BAA0B;aAClD;YACD,mDAAmD;YACnD;gBACE,WAAW,EAAE,UAAU;gBACvB,cAAc,EAAE,UAAU;gBAC1B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;gBAClC,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,oBAAoB,CAAC,GAAG;qBACtC;iBACF;aACF;YACD,4CAA4C;YAC5C;gBACE,WAAW,EAAE,QAAQ;gBACrB,cAAc,EAAE,cAAc;gBAC9B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;aACnC;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,sCAAsC;gBACrD,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,yBAAyB,EAAE;QAC1D,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;QAChC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,YAAY,CAAC,GAAG;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../src/cdn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CACtD,GAAG,IAAI,cAAc,EACrB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;;;;;;;;;;;;;;;;;GAiBT;KACE,CACF,CAAC;IAEF,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;aAC3C;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,6DAA6D;oBAC7D,2DAA2D;oBAC3D,uDAAuD;oBACvD,8DAA8D;oBAC9D,qDAAqD;oBACrD,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;iBAC9G;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;iBAC/C;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACvD,GAAG,IAAI,oBAAoB,EAC3B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,oBAAoB;oBACpB,cAAc;oBACd,QAAQ;oBACR,oBAAoB;iBACrB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,0EAA0E;IAC1E,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,wCAAwC,GAC5C,sCAAsC,CAAC;IAEzC,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;IAEvE,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,yBAAyB;QACtC,6BAA6B,EAAE,IAAI;QACnC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,uCAAuC;QACpD,6BAA6B,EAAE,QAAQ;QACvC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,YAAY,CAAA,GAAG,aAAa,CAAC,IAAI,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,gBAAgB,CAAC;IAE5G,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;YACD;gBACE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,gBAAgB;gBAC5B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,cAAc,EAAE;oBACd,oBAAoB,EAAE,EAAE;iBACzB;aACF;YACD;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,iBAAiB;gBAC7B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;aAChE;YACD,qEAAqE;YACrE,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,0BAA0B;YAC1B;gBACE,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,yEAAyE;YACzE,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,kBAAkB,CAAC,EAAE;gBACpC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,2DAA2D;YAC3D,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,6BAA6B;YAC7B;gBACE,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,qBAAqB;gBAClC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,mDAAmD;YACnD;gBACE,WAAW,EAAE,UAAU;gBACvB,cAAc,EAAE,UAAU;gBAC1B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;gBAClC,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,oBAAoB,CAAC,GAAG;qBACtC;iBACF;aACF;YACD,4CAA4C;YAC5C;gBACE,WAAW,EAAE,QAAQ;gBACrB,cAAc,EAAE,cAAc;gBAC9B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;aACnC;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,yBAAyB,EAAE;QAC1D,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;QAChC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,YAAY,CAAC,GAAG;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "headroom-cms",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Headroom CMS — Serverless headless CMS for AWS, deployed with SST",
   "type": "module",
   "main": "dist/index.js",
@@ -17,14 +17,6 @@
     "admin",
     "src"
   ],
-  "scripts": {
-    "build": "tsc",
-    "build:lambdas": "./scripts/build-lambdas.sh",
-    "build:admin": "./scripts/build-admin.sh",
-    "build:functions": "./scripts/build-functions.sh",
-    "build:image-lambda": "./scripts/build-image-lambda.sh",
-    "build:all": "pnpm build:lambdas && pnpm build:admin && pnpm build:functions && pnpm build:image-lambda && pnpm build"
-  },
   "peerDependencies": {
     "sst": "^4.0.0"
   },
@@ -46,5 +38,13 @@
     "@types/node": "^25.3.2",
     "esbuild": "^0.25.0",
     "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "build": "tsc",
+    "build:lambdas": "./scripts/build-lambdas.sh",
+    "build:admin": "./scripts/build-admin.sh",
+    "build:functions": "./scripts/build-functions.sh",
+    "build:image-lambda": "./scripts/build-image-lambda.sh",
+    "build:all": "pnpm build:lambdas && pnpm build:admin && pnpm build:functions && pnpm build:image-lambda && pnpm build"
   }
-}
+}

package/src/cdn.ts

@@ -91,14 +91,8 @@ export function createCdn(name: string, args: CdnArgs) {
       var keyHash = crypto.createHash('sha256').update(apiKeyHeader.value).digest('hex');
       var hashPrefix = keyHash.substring(0, 8);
 
-      // Fetch API key hash and version in parallel
-      var results = await Promise.all([
-        kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; }),
-        kvsHandle.get('site:' + site + ':version').catch(function() { return '0'; }),
-      ]);
-
-      var storedHash = results[0];
-      var versionResult = results[1];
+      // Fetch the stored API key hash from KVS
+      var storedHash = await kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; });
 
       // Validate API key - compare full hash
       if (!storedHash || storedHash !== keyHash) {
@@ -110,9 +104,6 @@ export function createCdn(name: string, args: CdnArgs) {
         };
       }
 
-      // Add version header for cache key discrimination
-      request.headers['x-site-version'] = { value: versionResult || '0' };
-
       return request;
     }
   `,
@@ -165,12 +156,17 @@ export function createCdn(name: string, args: CdnArgs) {
         cookiesConfig: { cookieBehavior: "none" },
         headersConfig: {
           headerBehavior: "whitelist",
-          headers: { items: ["x-site-version"] },
+          headers: { items: ["x-headroom-version"] },
         },
         queryStringsConfig: {
           queryStringBehavior: "whitelist",
           queryStrings: {
-            items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort"],
+            // `select` MUST be in the cache key — without it, CloudFront
+            // will serve whichever variant (meta / full / title,cover)
+            // populated the cache entry first for every subsequent
+            // variant on the same URL, silently corrupting SDK consumers.
+            // See the single-item GET fix in handler/content.go.
+            items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort", "select"],
           },
         },
         enableAcceptEncodingBrotli: true,
@@ -220,6 +216,24 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
+  const versionCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}VersionCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-version-cache`,
+      comment: "Short-TTL cache for /version to absorb client polling",
+      minTtl: 0,
+      defaultTtl: 2,
+      maxTtl: 2,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: { queryStringBehavior: "none" },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
   // =========================================================================
   // Origin Request Policy
   // =========================================================================
@@ -235,9 +249,10 @@ export function createCdn(name: string, args: CdnArgs) {
         headers: {
           items: [
             "x-headroom-key",
+            "x-headroom-session",
             "content-type",
             "accept",
-            "x-site-version",
+            "x-headroom-version",
           ],
         },
       },
@@ -245,10 +260,21 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
-  // Managed AllViewerExceptHostHeader policy for admin paths
-  const adminOriginRequestPolicyId =
+  // Managed AllViewerExceptHostHeader policy — forwards every viewer header
+  // except Host, including `Authorization`. CloudFront reserves certain
+  // headers (notably `Authorization`) and refuses to include them in a
+  // *custom* origin request policy, so paths that need bearer tokens at the
+  // origin must use this managed policy. It's used by `/v1/admin/*` as well
+  // as the site-user authenticated `/v1/*/auth/*` and `/v1/*/users/*`
+  // behaviors below. Safe to pair with the CachingDisabled policy — no cache
+  // key means no cross-user response leakage.
+  const allViewerExceptHostOriginRequestPolicyId =
     "b689b0a8-53d0-40ab-baf2-68738e2966ac";
 
+  // Managed CachingDisabled policy ID — used by admin and the site-user
+  // authenticated behaviors below.
+  const cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+
   // =========================================================================
   // Origin Access Controls (OAC)
   // =========================================================================
@@ -381,8 +407,147 @@ export function createCdn(name: string, args: CdnArgs) {
           ],
           cachedMethods: ["GET", "HEAD", "OPTIONS"],
           compress: true,
-          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
-          originRequestPolicyId: adminOriginRequestPolicyId,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+        },
+        // Site-user authenticated paths: no caching, forwards Authorization.
+        // Covers OTP request/verify, GET/refresh session, and PATCH
+        // /v1/{site}/users/me. Caching is disabled because the cache key
+        // does not include user identity — caching authenticated responses
+        // here would leak data between users. The edge function still runs
+        // for API key validation.
+        {
+          pathPattern: "/v1/*/auth/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        // Version endpoint: short-TTL cache (2s) shared across all consumers
+        // for a given site. The edge function still runs for API key
+        // validation. Placed before /v1/*/users/* and the default behavior
+        // because CloudFront evaluates path patterns in order, first match wins.
+        //
+        // NOTE: pathPattern "/v1/*/version" matches exact "/version" only.
+        // CloudFront's `*` wildcard does not span path segments, so any
+        // future /version/* sub-routes need their own behavior.
+        {
+          pathPattern: "/v1/*/version",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: versionCachePolicy.id,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        {
+          pathPattern: "/v1/*/users/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        // Submissions: never cached. The full lifecycle lives here
+        // (GET list/get/mine/batch, POST create/batch, PUT update), so the
+        // allowedMethods list is full. Writes go through CloudFront now that
+        // Phase 2 moved create/update off the old /submit/* verb routes.
+        // Uses the custom originRequestPolicy (not AllViewerExceptHost)
+        // because x-headroom-key and x-headroom-session are the trust
+        // boundary here — no Authorization header is involved.
+        //
+        // Two path patterns are registered because CloudFront pattern matching
+        // does not treat `/v1/*/submissions/*` as matching the bare
+        // `/v1/{site}/submissions` (no trailing slash) — which is where POST
+        // create and GET list land. Both entries share the same policies and
+        // edge function association.
+        {
+          pathPattern: "/v1/*/submissions",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        {
+          pathPattern: "/v1/*/submissions/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
         },
         // Media originals: served directly from S3 via OAC
         {
@@ -418,7 +583,7 @@ export function createCdn(name: string, args: CdnArgs) {
           allowedMethods: ["GET", "HEAD"],
           cachedMethods: ["GET", "HEAD"],
           compress: true,
-          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+          cachePolicyId: cachingDisabledPolicyId,
           originRequestPolicyId: originRequestPolicy.id,
         },
       ],

package/admin/assets/AllContentPage-C11eeRMt.js

@@ -1 +0,0 @@
-import{j as s}from"./tanstack-Bs3zYPPV.js";import{u as T,f as D,r as w}from"./react-vendor-C2CvUxFh.js";import{u as M,a as R,b as L,c as z}from"./useContent-D8yDRTTy.js";import{m as k}from"./media-url-DIg_vSyf.js";import{w as E,x as H,v as r,S as F,j as h,y as V,B as _}from"./index-wYNPRVrc.js";import{u as q}from"./usePageTitle-Bwf-MpTD.js";import{C as G,c as J}from"./card-10FqkZPA.js";import{C as m}from"./checkbox-fC1QPb_4.js";import{T as K,a as O,b as S,c as i,d as Q,e as d}from"./table-WkEcC9MH.js";import{f as y}from"./format-C88SDH8g.js";import{B as W}from"./BulkActionBar-CastJGEP.js";import"./radix-C1kb_NqW.js";function ie(){const{host:c}=T(),p=D(),{collections:A}=E(),f=H();q({title:"Recent"});const[$,P]=w.useState(),[n,a]=w.useState(new Set),{data:o,isLoading:I}=M(c,$),j=R(c),g=L(c),b=z(c),N=new Map(A.map(e=>[e.name,e.label])),x=o?.items.map(e=>e.contentId)??[],v=x.length>0&&x.every(e=>n.has(e));function C(e){a(l=>{const t=new Set(l);return t.has(e)?t.delete(e):t.add(e),t})}function U(){a(v?new Set:new Set(x))}const B=j.isPending||g.isPending||b.isPending;return s.jsxs("div",{children:[!f&&s.jsxs("div",{className:"mb-6",children:[s.jsx("h1",{className:"text-2xl font-semibold",children:"All Content"}),s.jsx("p",{className:"text-muted-foreground text-sm",children:"Recently updated content across all collections."})]}),n.size>0&&s.jsx(W,{selectedCount:n.size,onPublish:async()=>{const e=[...n],t=(await j.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to publish`):r.success(`${e.length} item(s) published`),a(new Set)},onUnpublish:async()=>{const e=[...n],t=(await g.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to unpublish`):r.success(`${e.length} item(s) unpublished`),a(new Set)},onDelete:async()=>{const e=[...n],t=(await b.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to delete`):r.success(`${e.length} item(s) deleted`),a(new Set)},onClear:()=>a(new Set),isPending:B}),I?s.jsx("div",{className:"space-y-2",children:Array.from({length:5}).map((e,l)=>s.jsx(F,{className:"h-12 w-full"},l))}):o?.items.length?s.jsxs(s.Fragment,{children:[f?s.jsx("div",{className:"grid gap-3","data-testid":"all-content-card-view",children:o.items.map(e=>{const l=e.coverUrl;return s.jsx(G,{className:V("cursor-pointer gap-0 overflow-hidden py-0 transition-shadow hover:shadow-md",n.has(e.contentId)&&"ring-2 ring-primary"),onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:s.jsx(J,{className:"p-3",children:s.jsxs("div",{className:"flex items-start gap-3 min-w-0",children:[l&&s.jsx("img",{src:k(l),alt:"",className:"h-12 w-12 rounded object-cover flex-shrink-0"}),s.jsxs("div",{className:"min-w-0 flex-1",children:[s.jsxs("div",{className:"flex items-center gap-2 min-w-0",children:[s.jsx("span",{className:"font-medium truncate",children:e.title||"Untitled"}),s.jsx(h,{variant:e.publishedAt?"default":"secondary",className:"shrink-0",children:e.publishedAt?"Published":"Draft"})]}),e.slug&&s.jsxs("p",{className:"text-xs text-muted-foreground truncate mt-0.5",children:["/",e.slug]}),s.jsxs("div",{className:"flex items-center gap-2 mt-1",children:[s.jsx(h,{variant:"outline",className:"text-[10px] px-1.5 py-0",children:N.get(e.collection)??e.collection}),s.jsx("span",{className:"text-xs text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]})]}),s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),onClick:t=>t.stopPropagation(),className:"mt-1"})]})})},e.contentId)})}):s.jsxs(K,{children:[s.jsx(O,{children:s.jsxs(S,{children:[s.jsx(i,{className:"w-10",children:s.jsx(m,{checked:v,onCheckedChange:U,"aria-label":"Select all"})}),s.jsx(i,{children:"Title"}),s.jsx(i,{children:"Slug"}),s.jsx(i,{children:"Collection"}),s.jsx(i,{children:"Status"}),s.jsx(i,{children:"Updated"})]})}),s.jsx(Q,{children:o.items.map(e=>s.jsxs(S,{className:"cursor-pointer",onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:[s.jsx(d,{onClick:l=>l.stopPropagation(),children:s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),"aria-label":`Select ${e.title||"Untitled"}`})}),s.jsx(d,{className:"font-medium",children:s.jsxs("div",{className:"flex items-center gap-3",children:[!!e.coverUrl&&s.jsx("img",{src:k(e.coverUrl),alt:"",className:"h-8 w-8 rounded object-cover flex-shrink-0"}),s.jsx("span",{children:e.title||"Untitled"})]})}),s.jsx(d,{className:"text-muted-foreground text-sm",children:e.slug||"—"}),s.jsx(d,{children:s.jsx(h,{variant:"outline",children:N.get(e.collection)??e.collection})}),s.jsx(d,{children:s.jsx(h,{variant:e.publishedAt?"default":"secondary",children:e.publishedAt?"Published":"Draft"})}),s.jsx(d,{className:"text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]},e.contentId))})]}),o.hasMore&&s.jsx("div",{className:"mt-4 flex justify-center",children:s.jsx(_,{variant:"outline",onClick:()=>P(o.cursor??void 0),children:"Load More"})})]}):s.jsx("p",{className:"text-muted-foreground",children:"No content yet."})]})}export{ie as AllContentPage};