headroom-cms 0.1.7 → 0.1.9

package/dist/cdn.js

@@ -71,14 +71,8 @@ export function createCdn(name, args) {
       var keyHash = crypto.createHash('sha256').update(apiKeyHeader.value).digest('hex');
       var hashPrefix = keyHash.substring(0, 8);
 
-      // Fetch API key hash and version in parallel
-      var results = await Promise.all([
-        kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; }),
-        kvsHandle.get('site:' + site + ':version').catch(function() { return '0'; }),
-      ]);
-
-      var storedHash = results[0];
-      var versionResult = results[1];
+      // Fetch the stored API key hash from KVS
+      var storedHash = await kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; });
 
       // Validate API key - compare full hash
       if (!storedHash || storedHash !== keyHash) {
@@ -90,9 +84,6 @@ export function createCdn(name, args) {
         };
       }
 
-      // Add version header for cache key discrimination
-      request.headers['x-site-version'] = { value: versionResult || '0' };
-
       return request;
     }
   `,
@@ -136,12 +127,17 @@ export function createCdn(name, args) {
             cookiesConfig: { cookieBehavior: "none" },
             headersConfig: {
                 headerBehavior: "whitelist",
-                headers: { items: ["x-site-version"] },
+                headers: { items: ["x-headroom-version"] },
             },
             queryStringsConfig: {
                 queryStringBehavior: "whitelist",
                 queryStrings: {
-                    items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort"],
+                    // `select` MUST be in the cache key — without it, CloudFront
+                    // will serve whichever variant (meta / full / title,cover)
+                    // populated the cache entry first for every subsequent
+                    // variant on the same URL, silently corrupting SDK consumers.
+                    // See the single-item GET fix in handler/content.go.
+                    items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort", "select"],
                 },
             },
             enableAcceptEncodingBrotli: true,
@@ -181,6 +177,20 @@ export function createCdn(name, args) {
             enableAcceptEncodingGzip: true,
         },
     });
+    const versionCachePolicy = new aws.cloudfront.CachePolicy(`${name}VersionCachePolicy`, {
+        name: $interpolate `${$app.name}-${$app.stage}-version-cache`,
+        comment: "Short-TTL cache for /version to absorb client polling",
+        minTtl: 0,
+        defaultTtl: 2,
+        maxTtl: 2,
+        parametersInCacheKeyAndForwardedToOrigin: {
+            cookiesConfig: { cookieBehavior: "none" },
+            headersConfig: { headerBehavior: "none" },
+            queryStringsConfig: { queryStringBehavior: "none" },
+            enableAcceptEncodingBrotli: true,
+            enableAcceptEncodingGzip: true,
+        },
+    });
     // =========================================================================
     // Origin Request Policy
     // =========================================================================
@@ -193,16 +203,27 @@ export function createCdn(name, args) {
             headers: {
                 items: [
                     "x-headroom-key",
+                    "x-headroom-session",
                     "content-type",
                     "accept",
-                    "x-site-version",
+                    "x-headroom-version",
                 ],
             },
         },
         queryStringsConfig: { queryStringBehavior: "all" },
     });
-    // Managed AllViewerExceptHostHeader policy for admin paths
-    const adminOriginRequestPolicyId = "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    // Managed AllViewerExceptHostHeader policy — forwards every viewer header
+    // except Host, including `Authorization`. CloudFront reserves certain
+    // headers (notably `Authorization`) and refuses to include them in a
+    // *custom* origin request policy, so paths that need bearer tokens at the
+    // origin must use this managed policy. It's used by `/v1/admin/*` as well
+    // as the site-user authenticated `/v1/*/auth/*` and `/v1/*/users/*`
+    // behaviors below. Safe to pair with the CachingDisabled policy — no cache
+    // key means no cross-user response leakage.
+    const allViewerExceptHostOriginRequestPolicyId = "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    // Managed CachingDisabled policy ID — used by admin and the site-user
+    // authenticated behaviors below.
+    const cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
     // =========================================================================
     // Origin Access Controls (OAC)
     // =========================================================================
@@ -321,8 +342,147 @@ export function createCdn(name, args) {
                 ],
                 cachedMethods: ["GET", "HEAD", "OPTIONS"],
                 compress: true,
-                cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
-                originRequestPolicyId: adminOriginRequestPolicyId,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+            },
+            // Site-user authenticated paths: no caching, forwards Authorization.
+            // Covers OTP request/verify, GET/refresh session, and PATCH
+            // /v1/{site}/users/me. Caching is disabled because the cache key
+            // does not include user identity — caching authenticated responses
+            // here would leak data between users. The edge function still runs
+            // for API key validation.
+            {
+                pathPattern: "/v1/*/auth/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            // Version endpoint: short-TTL cache (2s) shared across all consumers
+            // for a given site. The edge function still runs for API key
+            // validation. Placed before /v1/*/users/* and the default behavior
+            // because CloudFront evaluates path patterns in order, first match wins.
+            //
+            // NOTE: pathPattern "/v1/*/version" matches exact "/version" only.
+            // CloudFront's `*` wildcard does not span path segments, so any
+            // future /version/* sub-routes need their own behavior.
+            {
+                pathPattern: "/v1/*/version",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: ["GET", "HEAD", "OPTIONS"],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: versionCachePolicy.id,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            {
+                pathPattern: "/v1/*/users/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            // Submissions: never cached. The full lifecycle lives here
+            // (GET list/get/mine/batch, POST create/batch, PUT update), so the
+            // allowedMethods list is full. Writes go through CloudFront now that
+            // Phase 2 moved create/update off the old /submit/* verb routes.
+            // Uses the custom originRequestPolicy (not AllViewerExceptHost)
+            // because x-headroom-key and x-headroom-session are the trust
+            // boundary here — no Authorization header is involved.
+            //
+            // Two path patterns are registered because CloudFront pattern matching
+            // does not treat `/v1/*/submissions/*` as matching the bare
+            // `/v1/{site}/submissions` (no trailing slash) — which is where POST
+            // create and GET list land. Both entries share the same policies and
+            // edge function association.
+            {
+                pathPattern: "/v1/*/submissions",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
+            },
+            {
+                pathPattern: "/v1/*/submissions/*",
+                targetOriginId: "api",
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: [
+                    "GET",
+                    "HEAD",
+                    "OPTIONS",
+                    "PUT",
+                    "POST",
+                    "PATCH",
+                    "DELETE",
+                ],
+                cachedMethods: ["GET", "HEAD", "OPTIONS"],
+                compress: true,
+                cachePolicyId: cachingDisabledPolicyId,
+                originRequestPolicyId: originRequestPolicy.id,
+                functionAssociations: [
+                    {
+                        eventType: "viewer-request",
+                        functionArn: edgeFunction.arn,
+                    },
+                ],
             },
             // Media originals: served directly from S3 via OAC
             {
@@ -358,7 +518,7 @@ export function createCdn(name, args) {
                 allowedMethods: ["GET", "HEAD"],
                 cachedMethods: ["GET", "HEAD"],
                 compress: true,
-                cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+                cachePolicyId: cachingDisabledPolicyId,
                 originRequestPolicyId: originRequestPolicy.id,
             },
         ],

package/dist/cdn.js.map

@@ -1 +1 @@
-{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../src/cdn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CACtD,GAAG,IAAI,cAAc,EACrB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;;;;;;;;;;;;;;;;;GAiBT;KACE,CACF,CAAC;IAEF,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;aACvC;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;iBACpG;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;iBAC/C;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,cAAc;oBACd,QAAQ;oBACR,gBAAgB;iBACjB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,2DAA2D;IAC3D,MAAM,0BAA0B,GAC9B,sCAAsC,CAAC;IAEzC,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,yBAAyB;QACtC,6BAA6B,EAAE,IAAI;QACnC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,uCAAuC;QACpD,6BAA6B,EAAE,QAAQ;QACvC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,YAAY,CAAA,GAAG,aAAa,CAAC,IAAI,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,gBAAgB,CAAC;IAE5G,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;YACD;gBACE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,gBAAgB;gBAC5B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,cAAc,EAAE;oBACd,oBAAoB,EAAE,EAAE;iBACzB;aACF;YACD;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,iBAAiB;gBAC7B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,sCAAsC;gBACrD,qBAAqB,EAAE,0BAA0B;aAClD;YACD,mDAAmD;YACnD;gBACE,WAAW,EAAE,UAAU;gBACvB,cAAc,EAAE,UAAU;gBAC1B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;gBAClC,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,oBAAoB,CAAC,GAAG;qBACtC;iBACF;aACF;YACD,4CAA4C;YAC5C;gBACE,WAAW,EAAE,QAAQ;gBACrB,cAAc,EAAE,cAAc;gBAC9B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;aACnC;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,sCAAsC;gBACrD,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,yBAAyB,EAAE;QAC1D,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;QAChC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,YAAY,CAAC,GAAG;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../src/cdn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;IACnD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,UAAU,EAAE;QAClE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,yBAAyB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,YAAY,CAAA;;;;qBAID,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEzB;KACA,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CACtD,GAAG,IAAI,cAAc,EACrB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,mBAAmB;QAC5B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;;;;;;;;;;;;;;;;;GAiBT;KACE,CACF,CAAC;IAEF,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACnD,GAAG,IAAI,gBAAgB,EACvB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,OAAO,EACL,gEAAgE;QAClE,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE;gBACb,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;aAC3C;YACD,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,6DAA6D;oBAC7D,2DAA2D;oBAC3D,uDAAuD;oBACvD,8DAA8D;oBAC9D,qDAAqD;oBACrD,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;iBAC9G;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,YAAY,EAAE;oBACZ,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;iBAC/C;aACF;YACD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACrD,GAAG,IAAI,kBAAkB,EACzB;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,cAAc;QAC1D,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CACvD,GAAG,IAAI,oBAAoB,EAC3B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,gBAAgB;QAC5D,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,CAAC;QACT,wCAAwC,EAAE;YACxC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;YACzC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;YACnD,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;SAC/B;KACF,CACF,CAAC;IAEF,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAChE,GAAG,IAAI,qBAAqB,EAC5B;QACE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,iBAAiB;QAC7D,OAAO,EAAE,4CAA4C;QACrD,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;QACzC,aAAa,EAAE;YACb,cAAc,EAAE,WAAW;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE;oBACL,gBAAgB;oBAChB,oBAAoB;oBACpB,cAAc;oBACd,QAAQ;oBACR,oBAAoB;iBACrB;aACF;SACF;QACD,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;KACnD,CACF,CAAC;IAEF,0EAA0E;IAC1E,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,wCAAwC,GAC5C,sCAAsC,CAAC;IAEzC,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;IAEvE,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,yBAAyB;QACtC,6BAA6B,EAAE,IAAI;QACnC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,IAAI,UAAU,EAAE;QACzE,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,YAAY;QACxD,WAAW,EAAE,uCAAuC;QACpD,6BAA6B,EAAE,QAAQ;QACvC,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,YAAY,CAAA,GAAG,aAAa,CAAC,IAAI,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,gBAAgB,CAAC;IAE5G,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnC,CAAC,CAAC;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC7C,gBAAgB,EAAE,UAAmB;YACrC,sBAAsB,EAAE,cAAuB;SAChD;QACH,CAAC,CAAC;YACE,4BAA4B,EAAE,IAAI;SACnC,CAAC;IAEN,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAClD,GAAG,IAAI,cAAc,EACrB;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAA,sBAAsB,IAAI,CAAC,KAAK,EAAE;QACvD,WAAW,EAAE,WAAW;QACxB,UAAU;QACV,OAAO;QAEP,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,YAAY;gBACxB,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;YACD;gBACE,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,gBAAgB;gBAC5B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,cAAc,EAAE;oBACd,oBAAoB,EAAE,EAAE;iBACzB;aACF;YACD;gBACE,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,iBAAiB;gBAC7B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;gBAClC,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,GAAG;oBACd,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,CAAC,SAAS,CAAC;iBAChC;aACF;SACF;QAED,oBAAoB,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,oBAAoB,EAAE,mBAAmB;YACzC,cAAc,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,QAAQ;aACT;YACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,cAAc,CAAC,EAAE;YAChC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;YAC7C,oBAAoB,EAAE;gBACpB;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;iBAC9B;aACF;SACF;QAED,qBAAqB,EAAE;YACrB,yDAAyD;YACzD;gBACE,WAAW,EAAE,aAAa;gBAC1B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;aAChE;YACD,qEAAqE;YACrE,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,0BAA0B;YAC1B;gBACE,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,yEAAyE;YACzE,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,kBAAkB,CAAC,EAAE;gBACpC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,eAAe;gBAC5B,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,wCAAwC;gBAC/D,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,2DAA2D;YAC3D,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,6BAA6B;YAC7B;gBACE,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD;gBACE,WAAW,EAAE,qBAAqB;gBAClC,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE;oBACd,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,MAAM;oBACN,OAAO;oBACP,QAAQ;iBACT;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;gBAC7C,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,YAAY,CAAC,GAAG;qBAC9B;iBACF;aACF;YACD,mDAAmD;YACnD;gBACE,WAAW,EAAE,UAAU;gBACvB,cAAc,EAAE,UAAU;gBAC1B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;gBAClC,oBAAoB,EAAE;oBACpB;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,WAAW,EAAE,oBAAoB,CAAC,GAAG;qBACtC;iBACF;aACF;YACD,4CAA4C;YAC5C;gBACE,WAAW,EAAE,QAAQ;gBACrB,cAAc,EAAE,cAAc;gBAC9B,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBAC1C,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,gBAAgB,CAAC,EAAE;aACnC;YACD,uCAAuC;YACvC;gBACE,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,KAAK;gBACrB,oBAAoB,EAAE,mBAAmB;gBACzC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC/B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,qBAAqB,EAAE,mBAAmB,CAAC,EAAE;aAC9C;SACF;QAED,YAAY,EAAE;YACZ,cAAc,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;SAC5C;QAED,iBAAiB;KAClB,CACF,CAAC;IAEF,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,yBAAyB,EAAE;QAC1D,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;QAChC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,YAAY,CAAC,GAAG;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,YAAY,CAAA,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAA,WAAW,YAAY,CAAC,UAAU,EAAE,CAAC;IAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "headroom-cms",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Headroom CMS — Serverless headless CMS for AWS, deployed with SST",
   "type": "module",
   "main": "dist/index.js",

package/src/cdn.ts

@@ -91,14 +91,8 @@ export function createCdn(name: string, args: CdnArgs) {
       var keyHash = crypto.createHash('sha256').update(apiKeyHeader.value).digest('hex');
       var hashPrefix = keyHash.substring(0, 8);
 
-      // Fetch API key hash and version in parallel
-      var results = await Promise.all([
-        kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; }),
-        kvsHandle.get('site:' + site + ':version').catch(function() { return '0'; }),
-      ]);
-
-      var storedHash = results[0];
-      var versionResult = results[1];
+      // Fetch the stored API key hash from KVS
+      var storedHash = await kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; });
 
       // Validate API key - compare full hash
       if (!storedHash || storedHash !== keyHash) {
@@ -110,9 +104,6 @@ export function createCdn(name: string, args: CdnArgs) {
         };
       }
 
-      // Add version header for cache key discrimination
-      request.headers['x-site-version'] = { value: versionResult || '0' };
-
       return request;
     }
   `,
@@ -165,12 +156,17 @@ export function createCdn(name: string, args: CdnArgs) {
         cookiesConfig: { cookieBehavior: "none" },
         headersConfig: {
           headerBehavior: "whitelist",
-          headers: { items: ["x-site-version"] },
+          headers: { items: ["x-headroom-version"] },
         },
         queryStringsConfig: {
           queryStringBehavior: "whitelist",
           queryStrings: {
-            items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort"],
+            // `select` MUST be in the cache key — without it, CloudFront
+            // will serve whichever variant (meta / full / title,cover)
+            // populated the cache entry first for every subsequent
+            // variant on the same URL, silently corrupting SDK consumers.
+            // See the single-item GET fix in handler/content.go.
+            items: ["collection", "limit", "cursor", "before", "after", "tag", "relatedTo", "relField", "sort", "select"],
           },
         },
         enableAcceptEncodingBrotli: true,
@@ -220,6 +216,24 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
+  const versionCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}VersionCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-version-cache`,
+      comment: "Short-TTL cache for /version to absorb client polling",
+      minTtl: 0,
+      defaultTtl: 2,
+      maxTtl: 2,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: { queryStringBehavior: "none" },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
   // =========================================================================
   // Origin Request Policy
   // =========================================================================
@@ -235,9 +249,10 @@ export function createCdn(name: string, args: CdnArgs) {
         headers: {
           items: [
             "x-headroom-key",
+            "x-headroom-session",
             "content-type",
             "accept",
-            "x-site-version",
+            "x-headroom-version",
           ],
         },
       },
@@ -245,10 +260,21 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
-  // Managed AllViewerExceptHostHeader policy for admin paths
-  const adminOriginRequestPolicyId =
+  // Managed AllViewerExceptHostHeader policy — forwards every viewer header
+  // except Host, including `Authorization`. CloudFront reserves certain
+  // headers (notably `Authorization`) and refuses to include them in a
+  // *custom* origin request policy, so paths that need bearer tokens at the
+  // origin must use this managed policy. It's used by `/v1/admin/*` as well
+  // as the site-user authenticated `/v1/*/auth/*` and `/v1/*/users/*`
+  // behaviors below. Safe to pair with the CachingDisabled policy — no cache
+  // key means no cross-user response leakage.
+  const allViewerExceptHostOriginRequestPolicyId =
     "b689b0a8-53d0-40ab-baf2-68738e2966ac";
 
+  // Managed CachingDisabled policy ID — used by admin and the site-user
+  // authenticated behaviors below.
+  const cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+
   // =========================================================================
   // Origin Access Controls (OAC)
   // =========================================================================
@@ -381,8 +407,147 @@ export function createCdn(name: string, args: CdnArgs) {
           ],
           cachedMethods: ["GET", "HEAD", "OPTIONS"],
           compress: true,
-          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
-          originRequestPolicyId: adminOriginRequestPolicyId,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+        },
+        // Site-user authenticated paths: no caching, forwards Authorization.
+        // Covers OTP request/verify, GET/refresh session, and PATCH
+        // /v1/{site}/users/me. Caching is disabled because the cache key
+        // does not include user identity — caching authenticated responses
+        // here would leak data between users. The edge function still runs
+        // for API key validation.
+        {
+          pathPattern: "/v1/*/auth/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        // Version endpoint: short-TTL cache (2s) shared across all consumers
+        // for a given site. The edge function still runs for API key
+        // validation. Placed before /v1/*/users/* and the default behavior
+        // because CloudFront evaluates path patterns in order, first match wins.
+        //
+        // NOTE: pathPattern "/v1/*/version" matches exact "/version" only.
+        // CloudFront's `*` wildcard does not span path segments, so any
+        // future /version/* sub-routes need their own behavior.
+        {
+          pathPattern: "/v1/*/version",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: versionCachePolicy.id,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        {
+          pathPattern: "/v1/*/users/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: allViewerExceptHostOriginRequestPolicyId,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        // Submissions: never cached. The full lifecycle lives here
+        // (GET list/get/mine/batch, POST create/batch, PUT update), so the
+        // allowedMethods list is full. Writes go through CloudFront now that
+        // Phase 2 moved create/update off the old /submit/* verb routes.
+        // Uses the custom originRequestPolicy (not AllViewerExceptHost)
+        // because x-headroom-key and x-headroom-session are the trust
+        // boundary here — no Authorization header is involved.
+        //
+        // Two path patterns are registered because CloudFront pattern matching
+        // does not treat `/v1/*/submissions/*` as matching the bare
+        // `/v1/{site}/submissions` (no trailing slash) — which is where POST
+        // create and GET list land. Both entries share the same policies and
+        // edge function association.
+        {
+          pathPattern: "/v1/*/submissions",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
+        },
+        {
+          pathPattern: "/v1/*/submissions/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: cachingDisabledPolicyId,
+          originRequestPolicyId: originRequestPolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: edgeFunction.arn,
+            },
+          ],
         },
         // Media originals: served directly from S3 via OAC
         {
@@ -418,7 +583,7 @@ export function createCdn(name: string, args: CdnArgs) {
           allowedMethods: ["GET", "HEAD"],
           cachedMethods: ["GET", "HEAD"],
           compress: true,
-          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+          cachePolicyId: cachingDisabledPolicyId,
           originRequestPolicyId: originRequestPolicy.id,
         },
       ],

package/admin/assets/AllContentPage-C11eeRMt.js

@@ -1 +0,0 @@
-import{j as s}from"./tanstack-Bs3zYPPV.js";import{u as T,f as D,r as w}from"./react-vendor-C2CvUxFh.js";import{u as M,a as R,b as L,c as z}from"./useContent-D8yDRTTy.js";import{m as k}from"./media-url-DIg_vSyf.js";import{w as E,x as H,v as r,S as F,j as h,y as V,B as _}from"./index-wYNPRVrc.js";import{u as q}from"./usePageTitle-Bwf-MpTD.js";import{C as G,c as J}from"./card-10FqkZPA.js";import{C as m}from"./checkbox-fC1QPb_4.js";import{T as K,a as O,b as S,c as i,d as Q,e as d}from"./table-WkEcC9MH.js";import{f as y}from"./format-C88SDH8g.js";import{B as W}from"./BulkActionBar-CastJGEP.js";import"./radix-C1kb_NqW.js";function ie(){const{host:c}=T(),p=D(),{collections:A}=E(),f=H();q({title:"Recent"});const[$,P]=w.useState(),[n,a]=w.useState(new Set),{data:o,isLoading:I}=M(c,$),j=R(c),g=L(c),b=z(c),N=new Map(A.map(e=>[e.name,e.label])),x=o?.items.map(e=>e.contentId)??[],v=x.length>0&&x.every(e=>n.has(e));function C(e){a(l=>{const t=new Set(l);return t.has(e)?t.delete(e):t.add(e),t})}function U(){a(v?new Set:new Set(x))}const B=j.isPending||g.isPending||b.isPending;return s.jsxs("div",{children:[!f&&s.jsxs("div",{className:"mb-6",children:[s.jsx("h1",{className:"text-2xl font-semibold",children:"All Content"}),s.jsx("p",{className:"text-muted-foreground text-sm",children:"Recently updated content across all collections."})]}),n.size>0&&s.jsx(W,{selectedCount:n.size,onPublish:async()=>{const e=[...n],t=(await j.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to publish`):r.success(`${e.length} item(s) published`),a(new Set)},onUnpublish:async()=>{const e=[...n],t=(await g.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to unpublish`):r.success(`${e.length} item(s) unpublished`),a(new Set)},onDelete:async()=>{const e=[...n],t=(await b.mutateAsync(e)).filter(u=>u.status==="rejected").length;t?r.error(`${t} of ${e.length} failed to delete`):r.success(`${e.length} item(s) deleted`),a(new Set)},onClear:()=>a(new Set),isPending:B}),I?s.jsx("div",{className:"space-y-2",children:Array.from({length:5}).map((e,l)=>s.jsx(F,{className:"h-12 w-full"},l))}):o?.items.length?s.jsxs(s.Fragment,{children:[f?s.jsx("div",{className:"grid gap-3","data-testid":"all-content-card-view",children:o.items.map(e=>{const l=e.coverUrl;return s.jsx(G,{className:V("cursor-pointer gap-0 overflow-hidden py-0 transition-shadow hover:shadow-md",n.has(e.contentId)&&"ring-2 ring-primary"),onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:s.jsx(J,{className:"p-3",children:s.jsxs("div",{className:"flex items-start gap-3 min-w-0",children:[l&&s.jsx("img",{src:k(l),alt:"",className:"h-12 w-12 rounded object-cover flex-shrink-0"}),s.jsxs("div",{className:"min-w-0 flex-1",children:[s.jsxs("div",{className:"flex items-center gap-2 min-w-0",children:[s.jsx("span",{className:"font-medium truncate",children:e.title||"Untitled"}),s.jsx(h,{variant:e.publishedAt?"default":"secondary",className:"shrink-0",children:e.publishedAt?"Published":"Draft"})]}),e.slug&&s.jsxs("p",{className:"text-xs text-muted-foreground truncate mt-0.5",children:["/",e.slug]}),s.jsxs("div",{className:"flex items-center gap-2 mt-1",children:[s.jsx(h,{variant:"outline",className:"text-[10px] px-1.5 py-0",children:N.get(e.collection)??e.collection}),s.jsx("span",{className:"text-xs text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]})]}),s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),onClick:t=>t.stopPropagation(),className:"mt-1"})]})})},e.contentId)})}):s.jsxs(K,{children:[s.jsx(O,{children:s.jsxs(S,{children:[s.jsx(i,{className:"w-10",children:s.jsx(m,{checked:v,onCheckedChange:U,"aria-label":"Select all"})}),s.jsx(i,{children:"Title"}),s.jsx(i,{children:"Slug"}),s.jsx(i,{children:"Collection"}),s.jsx(i,{children:"Status"}),s.jsx(i,{children:"Updated"})]})}),s.jsx(Q,{children:o.items.map(e=>s.jsxs(S,{className:"cursor-pointer",onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:[s.jsx(d,{onClick:l=>l.stopPropagation(),children:s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),"aria-label":`Select ${e.title||"Untitled"}`})}),s.jsx(d,{className:"font-medium",children:s.jsxs("div",{className:"flex items-center gap-3",children:[!!e.coverUrl&&s.jsx("img",{src:k(e.coverUrl),alt:"",className:"h-8 w-8 rounded object-cover flex-shrink-0"}),s.jsx("span",{children:e.title||"Untitled"})]})}),s.jsx(d,{className:"text-muted-foreground text-sm",children:e.slug||"—"}),s.jsx(d,{children:s.jsx(h,{variant:"outline",children:N.get(e.collection)??e.collection})}),s.jsx(d,{children:s.jsx(h,{variant:e.publishedAt?"default":"secondary",children:e.publishedAt?"Published":"Draft"})}),s.jsx(d,{className:"text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]},e.contentId))})]}),o.hasMore&&s.jsx("div",{className:"mt-4 flex justify-center",children:s.jsx(_,{variant:"outline",onClick:()=>P(o.cursor??void 0),children:"Load More"})})]}):s.jsx("p",{className:"text-muted-foreground",children:"No content yet."})]})}export{ie as AllContentPage};

package/admin/assets/AuditPage-DJNk7IaW.js

@@ -1 +0,0 @@
-import{u as M,j as e}from"./tanstack-Bs3zYPPV.js";import{L as R,r as i,u as _}from"./react-vendor-C2CvUxFh.js";import{e as E,F as O,G as K,J as V,K as W,B as U,au as q,S as I,x as H,aK as z,aL as G,aM as Q,aN as J,aO as X,al as v,aP as Y,T as b,$ as m,aE as Z,P as S,aQ as A,ai as ee,aR as te,aS as ae,aT as le,a4 as se,aU as ne,aV as oe}from"./index-wYNPRVrc.js";import{u as de}from"./useAdminResolver-CpZj93vH.js";import{s as T,T as re}from"./serializeToText-BJy0Ms5I.js";import{h as D}from"./useContent-D8yDRTTy.js";import{f as P,a as ce}from"./format-C88SDH8g.js";import{S as ie,a as ue,b as me,c as he,d as be}from"./select-BV3jemT6.js";import{T as xe,a as pe,b as L,c as p,d as fe,e as f}from"./table-WkEcC9MH.js";import{u as ge}from"./usePageTitle-Bwf-MpTD.js";import"./radix-C1kb_NqW.js";function je(t,l){const s=E(),o=new URLSearchParams;l?.action&&o.set("action",l.action),l?.before&&o.set("before",String(l.before));const r=o.toString();return M({queryKey:["sites",t,"audit",l?.action??"",l?.before??""],queryFn:()=>s.apiFetch(`/v1/admin/sites/${t}/audit${r?`?${r}`:""}`),enabled:!!t})}const ke={"content.create":"Content Created","content.update":"Content Updated","content.publish":"Content Published","content.unpublish":"Content Unpublished","content.delete":"Content Deleted","content.schedule":"Content Scheduled","content.unschedule":"Content Unscheduled","content.update_publish_date":"Publish Date Changed","content.discard":"Draft Discarded","media.create":"Media Uploaded","media.update":"Media Updated","media.delete":"Media Deleted","media.bulk":"Bulk Media Operation","media.folder.create":"Folder Created","media.folder.update":"Folder Renamed","media.folder.delete":"Folder Deleted","collection.create":"Collection Created","collection.update":"Collection Updated","collection.delete":"Collection Deleted","blocktype.create":"Block Type Created","blocktype.update":"Block Type Updated","blocktype.delete":"Block Type Deleted","webhook.create":"Webhook Created","webhook.update":"Webhook Updated","webhook.delete":"Webhook Deleted","webhook.rotate_secret":"Webhook Secret Rotated","webhook.retry_delivery":"Delivery Retried","apikey.create":"API Key Created","apikey.revoke":"API Key Revoked","site.archived":"Site Archived","site.unarchived":"Site Unarchived","site.purged":"Site Purged"};function ye(t){return!!t?.blockId&&!!t?.prevBlockId&&!!t?.resourceId}function Ie({host:t,details:l}){const s=l.resourceId,o=l.collection??"",{data:r}=q(t,o),{data:a,isLoading:x}=D(t,s,l.blockId??null),{data:d,isLoading:u}=D(t,s,l.prevBlockId??null),c=i.useMemo(()=>r?.fields??[],[r?.fields]),g=i.useMemo(()=>{if(!a)return[];const h={title:a.title,slug:a.slug,snippet:a.snippet,tags:a.tags};return T(c,a.body??{},h)},[a,c]),j=i.useMemo(()=>{if(!d)return[];const h={title:d.title,slug:d.slug,snippet:d.snippet,tags:d.tags};return T(c,d.body??{},h)},[d,c]);return x||u?e.jsxs("div",{className:"space-y-2","data-testid":"diff-loading",children:[e.jsx(I,{className:"h-6 w-24"}),e.jsx(I,{className:"h-40 w-full"})]}):!a||!d?e.jsx("p",{className:"text-muted-foreground text-sm","data-testid":"diff-unavailable",children:"Version data unavailable."}):e.jsxs("div",{"data-testid":"diff-view",children:[e.jsx("h3",{className:"mb-2 text-sm font-medium",children:"Changes"}),e.jsx(re,{published:j,draft:g,leftLabel:"Before",rightLabel:"After"})]})}function we({open:t,onOpenChange:l,event:s,host:o,resolveAdmin:r}){if(!s)return null;const a=s.details,x=ke[s.action]??s.action,d=ye(a),u=a?.resourceType==="content"&&a?.resourceId&&a?.collection?`/sites/${o}/content/${a.collection}/${a.resourceId}`:null;return e.jsx(O,{open:t,onOpenChange:l,children:e.jsxs(K,{className:"w-full overflow-y-auto px-6 sm:max-w-lg","data-testid":"audit-drawer",children:[e.jsx(V,{children:e.jsx(W,{children:x})}),e.jsxs("div",{className:"mt-4 space-y-4",children:[e.jsxs("dl",{className:"grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm",children:[a?.title&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Resource"}),e.jsx("dd",{className:"font-medium","data-testid":"drawer-resource",children:a.title})]}),a?.collection&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Collection"}),e.jsx("dd",{children:a.collection})]}),e.jsx("dt",{className:"text-muted-foreground",children:"Admin"}),e.jsx("dd",{children:r(s.adminId)}),e.jsx("dt",{className:"text-muted-foreground",children:"Time"}),e.jsx("dd",{children:P(s.createdAt)}),e.jsx("dt",{className:"text-muted-foreground",children:"Status"}),e.jsx("dd",{children:e.jsx("span",{className:s.status==="success"?"text-green-600":s.status==="failed"?"text-red-600":"text-yellow-600",children:s.status})}),a?.extra&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Details"}),e.jsx("dd",{className:"text-muted-foreground",children:a.extra})]})]}),s.errorMsg&&e.jsx("div",{className:"rounded border border-red-200 bg-red-50 p-3 text-sm text-red-800 dark:border-red-900 dark:bg-red-950 dark:text-red-300","data-testid":"drawer-error",children:s.errorMsg}),u&&e.jsx(U,{variant:"outline",size:"sm",asChild:!0,children:e.jsx(R,{to:u,children:"View content"})}),d&&a&&e.jsx("div",{className:"border-t pt-4",children:e.jsx(Ie,{host:o,details:a})}),!d&&a?.resourceType==="content"&&e.jsx("p",{className:"text-muted-foreground text-sm","data-testid":"no-changes",children:"No change comparison available for this event."})]})]})})}const Ce={"content.create":{label:"Created content",Icon:S},"content.update":{label:"Updated content",Icon:m},"content.publish":{label:"Published content",Icon:oe},"content.unpublish":{label:"Unpublished content",Icon:ne},"content.delete":{label:"Deleted content",Icon:b},"content.schedule":{label:"Scheduled content",Icon:se},"content.unschedule":{label:"Unscheduled content",Icon:le},"content.update_publish_date":{label:"Changed publish date",Icon:ae},"content.discard":{label:"Discarded draft",Icon:te},"media.create":{label:"Uploaded media",Icon:ee},"media.update":{label:"Updated media",Icon:m},"media.delete":{label:"Deleted media",Icon:b},"media.bulk":{label:"Bulk media operation",Icon:v},"media.folder.create":{label:"Created folder",Icon:A},"media.folder.update":{label:"Renamed folder",Icon:m},"media.folder.delete":{label:"Deleted folder",Icon:b},"collection.create":{label:"Created collection",Icon:A},"collection.update":{label:"Updated collection",Icon:m},"collection.delete":{label:"Deleted collection",Icon:b},"blocktype.create":{label:"Created block type",Icon:S},"blocktype.update":{label:"Updated block type",Icon:m},"blocktype.delete":{label:"Deleted block type",Icon:b},"webhook.create":{label:"Created webhook",Icon:Z},"webhook.update":{label:"Updated webhook",Icon:m},"webhook.delete":{label:"Deleted webhook",Icon:b},"webhook.rotate_secret":{label:"Rotated webhook secret",Icon:Y},"webhook.retry_delivery":{label:"Retried delivery",Icon:v},"apikey.create":{label:"Created API key",Icon:X},"apikey.revoke":{label:"Revoked API key",Icon:J},"site.archived":{label:"Archived site",Icon:Q},"site.unarchived":{label:"Unarchived site",Icon:G},"site.purged":{label:"Purged site",Icon:z}},Ne=[{label:"All",value:"all"},{label:"Content",value:"content."},{label:"Media",value:"media."},{label:"Collections",value:"collection."},{label:"Block Types",value:"blocktype."},{label:"Webhooks",value:"webhook."},{label:"API Keys",value:"apikey."},{label:"Sites",value:"site."}];function ve(t){return Ce[t]??{label:t,Icon:m}}function Se(t,l){const s=l.resourceType??l.details?.resourceType,o=l.resourceId??l.details?.resourceId;if(!s||!o)return null;switch(s){case"content":{const r=l.details?.collection;return r?`/sites/${t}/content/${r}/${o}`:`/sites/${t}/content`}case"media":return`/sites/${t}/media`;case"collection":return`/sites/${t}/settings/collections`;case"webhook":return`/sites/${t}/settings/webhooks`;default:return null}}function Ae({status:t}){const l=t==="success"?"bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400":t==="failed"?"bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400":"bg-yellow-100 text-yellow-800 dark:bg-yellow-900/30 dark:text-yellow-400";return e.jsx("span",{className:`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${l}`,children:t})}function Ee(){const{host:t}=_(),[l,s]=i.useState(),[o,r]=i.useState("all"),[a,x]=i.useState(null),[d,u]=i.useState(!1),{data:c,isLoading:g}=je(t,{before:l}),j=c?.items.map(n=>n.adminId)??[],{resolve:h}=de(j),B=H(),$=i.useCallback(n=>{x(n),u(!0)},[]);ge({title:"Audit Log"});const w=o!=="all"?c?.items.filter(n=>n.action.startsWith(o)):c?.items;return e.jsxs("div",{children:[e.jsxs("div",{className:"mb-6 flex items-center justify-between gap-4",children:[!B&&e.jsx("h1",{className:"text-2xl font-semibold",children:"Audit Log"}),e.jsxs(ie,{value:o,onValueChange:r,children:[e.jsx(ue,{className:"w-[180px]","data-testid":"action-filter",children:e.jsx(me,{placeholder:"Filter by type"})}),e.jsx(he,{children:Ne.map(n=>e.jsx(be,{value:n.value,children:n.label},n.value))})]})]}),g?e.jsx("div",{className:"space-y-2",children:Array.from({length:5}).map((n,k)=>e.jsx(I,{className:"h-12 w-full"},k))}):w?.length?e.jsxs(e.Fragment,{children:[e.jsxs(xe,{children:[e.jsx(pe,{children:e.jsxs(L,{children:[e.jsx(p,{children:"Action"}),e.jsx(p,{children:"Resource"}),e.jsx(p,{children:"Admin"}),e.jsx(p,{children:"Status"}),e.jsx(p,{children:"Time"})]})}),e.jsx(fe,{children:w.map(n=>{const{label:k,Icon:F}=ve(n.action),y=n.details?.title,C=n.details?.collection,N=t?Se(t,n):null;return e.jsxs(L,{"data-testid":"audit-row",className:"cursor-pointer",onClick:()=>$(n),children:[e.jsx(f,{children:e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(F,{className:"text-muted-foreground h-4 w-4 shrink-0"}),e.jsx("span",{className:"font-medium",children:k})]})}),e.jsx(f,{children:y?e.jsxs("div",{className:"flex items-center gap-2",children:[N?e.jsx(R,{to:N,className:"text-primary hover:underline",children:y}):e.jsx("span",{children:y}),C&&e.jsx("span",{className:"bg-muted text-muted-foreground rounded px-1.5 py-0.5 text-xs",children:C})]}):e.jsx("span",{className:"text-muted-foreground",children:"-"})}),e.jsx(f,{className:"text-sm",children:h(n.adminId)}),e.jsx(f,{children:e.jsx(Ae,{status:n.status})}),e.jsx(f,{className:"text-muted-foreground",title:P(n.createdAt),children:ce(n.createdAt)})]},n.eventId)})})]}),c?.hasMore&&c.items.length>0&&e.jsx("div",{className:"mt-4 flex justify-center",children:e.jsx(U,{variant:"outline",onClick:()=>s(c.items[c.items.length-1].createdAt),children:"Load More"})})]}):e.jsx("p",{className:"text-muted-foreground",children:"No audit events."}),e.jsx(we,{open:d,onOpenChange:u,event:a,host:t,resolveAdmin:h})]})}export{Ee as AuditPage};