@atproto/aws 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @atproto/aws
 
+## 0.3.3
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Build with `noImplicitAny` enabled
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto/common-web@0.5.3
+  - @atproto/common@0.6.5
+  - @atproto/crypto@0.5.3
+  - @atproto/repo@0.10.3
+
+## 0.3.2
+
+### Patch Changes
+
+- [#5151](https://github.com/bluesky-social/atproto/pull/5151) [`a51c45d`](https://github.com/bluesky-social/atproto/commit/a51c45d38f6bd7b8765f640e564cf921d52162e7) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update dependencies
+
+- Updated dependencies [[`f2cf8f7`](https://github.com/bluesky-social/atproto/commit/f2cf8f7fc5f3a10847f2e6d785e5fa2244ee8cfb), [`a51c45d`](https://github.com/bluesky-social/atproto/commit/a51c45d38f6bd7b8765f640e564cf921d52162e7), [`f2cf8f7`](https://github.com/bluesky-social/atproto/commit/f2cf8f7fc5f3a10847f2e6d785e5fa2244ee8cfb)]:
+  - @atproto/common@0.6.4
+  - @atproto/common-web@0.5.2
+  - @atproto/crypto@0.5.2
+  - @atproto/repo@0.10.2
+
 ## 0.3.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/aws",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "license": "MIT",
   "description": "Shared AWS cloud API helpers for atproto services",
   "keywords": [
@@ -13,6 +13,18 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/aws"
   },
+  "files": [
+    "./dist",
+    "./README.md",
+    "./CHANGELOG.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
   "engines": {
     "node": ">=22"
   },
@@ -25,18 +37,10 @@
     "key-encoder": "^2.0.3",
     "multiformats": "^13.0.0",
     "uint8arrays": "^5.0.0",
-    "@atproto/crypto": "^0.5.1",
-    "@atproto/common-web": "^0.5.1",
-    "@atproto/repo": "^0.10.1",
-    "@atproto/common": "^0.6.3"
-  },
-  "devDependencies": {},
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
+    "@atproto/common": "^0.6.5",
+    "@atproto/common-web": "^0.5.3",
+    "@atproto/crypto": "^0.5.3",
+    "@atproto/repo": "^0.10.3"
   },
   "scripts": {
     "build": "tsgo --build tsconfig.build.json"

package/src/bunny.ts

@@ -1,35 +0,0 @@
-import { allFulfilled } from '@atproto/common'
-import { ImageInvalidator } from './types.js'
-
-export type BunnyConfig = {
-  accessKey: string
-  urlPrefix: string
-}
-
-const API_PURGE_URL = 'https://api.bunny.net/purge'
-
-export class BunnyInvalidator implements ImageInvalidator {
-  constructor(public cfg: BunnyConfig) {}
-  async invalidate(_subject: string, paths: string[]) {
-    await allFulfilled(
-      paths.map(async (path) =>
-        purgeUrl({
-          url: this.cfg.urlPrefix + path,
-          accessKey: this.cfg.accessKey,
-        }),
-      ),
-    )
-  }
-}
-
-export default BunnyInvalidator
-
-async function purgeUrl(opts: { accessKey: string; url: string }) {
-  const search = new URLSearchParams()
-  search.set('async', 'true')
-  search.set('url', opts.url)
-  await fetch(API_PURGE_URL + '?' + search.toString(), {
-    method: 'post',
-    headers: { AccessKey: opts.accessKey },
-  })
-}

package/src/cloudfront.ts

@@ -1,36 +0,0 @@
-import * as aws from '@aws-sdk/client-cloudfront'
-import { ImageInvalidator } from './types.js'
-
-export type CloudfrontConfig = {
-  distributionId: string
-  pathPrefix?: string
-} & Omit<aws.CloudFrontClientConfig, 'apiVersion'>
-
-export class CloudfrontInvalidator implements ImageInvalidator {
-  distributionId: string
-  pathPrefix: string
-  client: aws.CloudFront
-  constructor(cfg: CloudfrontConfig) {
-    const { distributionId, pathPrefix, ...rest } = cfg
-    this.distributionId = distributionId
-    this.pathPrefix = pathPrefix ?? ''
-    this.client = new aws.CloudFront({
-      ...rest,
-      apiVersion: '2020-05-31',
-    })
-  }
-  async invalidate(subject: string, paths: string[]) {
-    await this.client.createInvalidation({
-      DistributionId: this.distributionId,
-      InvalidationBatch: {
-        CallerReference: `cf-invalidator-${subject}-${Date.now()}`,
-        Paths: {
-          Quantity: paths.length,
-          Items: paths.map((path) => this.pathPrefix + path),
-        },
-      },
-    })
-  }
-}
-
-export default CloudfrontInvalidator

package/src/index.ts

@@ -1,6 +0,0 @@
-export * from './kms.js'
-export * from './s3.js'
-export * from './cloudfront.js'
-export * from './bunny.js'
-export * from './util.js'
-export * from './types.js'

package/src/kms.ts

@@ -1,70 +0,0 @@
-import * as aws from '@aws-sdk/client-kms'
-import { secp256k1 as noble } from '@noble/curves/secp256k1'
-import KeyEncoderModule from 'key-encoder'
-import * as ui8 from 'uint8arrays'
-import * as crypto from '@atproto/crypto'
-
-// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }
-const KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)
-
-const keyEncoder = new KeyEncoder('secp256k1')
-
-export type KmsConfig = { keyId: string } & Omit<
-  aws.KMSClientConfig,
-  'apiVersion'
->
-
-export class KmsKeypair implements crypto.Keypair {
-  jwtAlg = crypto.SECP256K1_JWT_ALG
-
-  constructor(
-    private client: aws.KMS,
-    private keyId: string,
-    private publicKey: Uint8Array,
-  ) {}
-
-  static async load(cfg: KmsConfig) {
-    const { keyId, ...rest } = cfg
-    const client = new aws.KMS({
-      ...rest,
-      apiVersion: '2014-11-01',
-    })
-    const res = await client.getPublicKey({ KeyId: keyId })
-    if (!res.PublicKey) {
-      throw new Error('Could not find public key')
-    }
-    // public key comes back DER-encoded, so we translate it to raw 65 byte encoding
-    const rawPublicKeyHex = keyEncoder.encodePublic(
-      Buffer.from(res.PublicKey),
-      'der',
-      'raw',
-    )
-    const publicKey = ui8.fromString(rawPublicKeyHex, 'hex')
-    return new KmsKeypair(client, keyId, publicKey)
-  }
-
-  did(): string {
-    return crypto.formatDidKey(this.jwtAlg, this.publicKey)
-  }
-
-  async sign(msg: Uint8Array): Promise<Uint8Array> {
-    const res = await this.client.sign({
-      KeyId: this.keyId,
-      Message: msg,
-      SigningAlgorithm: 'ECDSA_SHA_256',
-    })
-    if (!res.Signature) {
-      throw new Error('Could not get signature')
-    }
-    // signature comes back DER encoded & not-normalized
-    // we translate to raw 64 byte encoding
-    // we also normalize s as no more than 1/2 prime order to pass strict verification
-    // (prevents duplicating a signature)
-    // more: https://github.com/bitcoin-core/secp256k1/blob/a1102b12196ea27f44d6201de4d25926a2ae9640/include/secp256k1.h#L530-L534
-    const sig = noble.Signature.fromDER(res.Signature)
-    const normalized = sig.normalizeS()
-    return normalized.toCompactRawBytes()
-  }
-}
-
-export default KmsKeypair

package/src/s3.ts

@@ -1,267 +0,0 @@
-import stream from 'node:stream'
-import { NoSuchKey, S3, S3ClientConfig } from '@aws-sdk/client-s3'
-import { Upload } from '@aws-sdk/lib-storage'
-import { CID } from 'multiformats/cid'
-import { SECOND, aggregateErrors, chunkArray } from '@atproto/common-web'
-import { randomStr } from '@atproto/crypto'
-import { BlobNotFoundError, BlobStore } from '@atproto/repo'
-
-export type S3Config = {
-  bucket: string
-  /**
-   * The maximum time any request to S3 (including individual blob chunks
-   * uploads) can take, in milliseconds.
-   */
-  requestTimeoutMs?: number
-  /**
-   * The maximum total time a blob upload can take, in milliseconds.
-   */
-  uploadTimeoutMs?: number
-} & Omit<S3ClientConfig, 'apiVersion' | 'requestHandler'>
-
-export class S3BlobStore implements BlobStore {
-  private client: S3
-  private bucket: string
-  private uploadTimeoutMs: number
-
-  constructor(
-    public did: string,
-    cfg: S3Config,
-  ) {
-    const {
-      bucket,
-      uploadTimeoutMs = 10 * SECOND,
-      requestTimeoutMs = uploadTimeoutMs,
-      ...rest
-    } = cfg
-    this.bucket = bucket
-    this.uploadTimeoutMs = uploadTimeoutMs
-    this.client = new S3({
-      ...rest,
-      apiVersion: '2006-03-01',
-      // Ensures that all requests timeout under "requestTimeoutMs".
-      //
-      // @NOTE This will also apply to the upload of each individual chunk
-      // when using Upload from @aws-sdk/lib-storage.
-      requestHandler: { requestTimeout: requestTimeoutMs },
-    })
-  }
-
-  static creator(cfg: S3Config) {
-    return (did: string) => {
-      return new S3BlobStore(did, cfg)
-    }
-  }
-
-  private genKey() {
-    return randomStr(32, 'base32')
-  }
-
-  private getTmpPath(key: string): string {
-    return `tmp/${this.did}/${key}`
-  }
-
-  private getStoredPath(cid: CID): string {
-    return `blocks/${this.did}/${cid.toString()}`
-  }
-
-  private getQuarantinedPath(cid: CID): string {
-    return `quarantine/${this.did}/${cid.toString()}`
-  }
-
-  private async uploadBytes(path: string, bytes: Uint8Array | stream.Readable) {
-    // @NOTE we use Upload rather than client.putObject because stream length is
-    // not known in advance. See also aws/aws-sdk-js-v3#2348.
-    //
-    // See also https://github.com/aws/aws-sdk-js-v3/issues/6426, wherein Upload
-    // may hang the s3 connection under certain circumstances. We don't have a
-    // good way to avoid this, so we use timeouts defensively on all s3
-    // requests.
-
-    const abortSignal = AbortSignal.timeout(this.uploadTimeoutMs)
-    const abortController = new AbortController()
-    abortSignal.addEventListener('abort', () => abortController.abort())
-
-    const upload = new Upload({
-      client: this.client,
-      params: {
-        Bucket: this.bucket,
-        Body: bytes,
-        Key: path,
-      },
-      // @ts-ignore native implementation fine in node >=15
-      abortController,
-    })
-
-    try {
-      await upload.done()
-    } catch (err) {
-      // Translate aws-sdk's abort error to something more specific
-      if (err instanceof Error && err.name === 'AbortError') {
-        throw new Error('Blob upload timed out', { cause: err })
-      }
-
-      throw err
-    }
-  }
-
-  async putTemp(bytes: Uint8Array | stream.Readable): Promise<string> {
-    const key = this.genKey()
-    await this.uploadBytes(this.getTmpPath(key), bytes)
-    return key
-  }
-
-  async makePermanent(key: string, cid: CID): Promise<void> {
-    try {
-      // @NOTE we normally call this method when we know the file is temporary.
-      // Because of this, we optimistically move the file, allowing to make
-      // fewer network requests in the happy path.
-      await this.move({
-        from: this.getTmpPath(key),
-        to: this.getStoredPath(cid),
-      })
-    } catch (err) {
-      // If the optimistic move failed because the temp file was not found,
-      // check if the permanent file already exists. If it does, we can assume
-      // that another process made the file permanent concurrently, and we can
-      // no-op.
-      if (err instanceof BlobNotFoundError) {
-        // Blob was not found from temp storage...
-        const alreadyHas = await this.hasStored(cid)
-        // already saved, so we no-op
-        if (alreadyHas) return
-      }
-
-      throw err
-    }
-  }
-
-  async putPermanent(
-    cid: CID,
-    bytes: Uint8Array | stream.Readable,
-  ): Promise<void> {
-    await this.uploadBytes(this.getStoredPath(cid), bytes)
-  }
-
-  async quarantine(cid: CID): Promise<void> {
-    await this.move({
-      from: this.getStoredPath(cid),
-      to: this.getQuarantinedPath(cid),
-    })
-  }
-
-  async unquarantine(cid: CID): Promise<void> {
-    await this.move({
-      from: this.getQuarantinedPath(cid),
-      to: this.getStoredPath(cid),
-    })
-  }
-
-  private async getObject(cid: CID) {
-    const res = await this.client.getObject({
-      Bucket: this.bucket,
-      Key: this.getStoredPath(cid),
-    })
-    if (res.Body) {
-      return res.Body
-    } else {
-      throw new BlobNotFoundError()
-    }
-  }
-
-  async getBytes(cid: CID): Promise<Uint8Array> {
-    const res = await this.getObject(cid)
-    return res.transformToByteArray()
-  }
-
-  async getStream(cid: CID): Promise<stream.Readable> {
-    const res = await this.getObject(cid)
-    return res as stream.Readable
-  }
-
-  async delete(cid: CID): Promise<void> {
-    await this.deleteKey(this.getStoredPath(cid))
-  }
-
-  async deleteMany(cids: CID[]): Promise<void> {
-    const errors: unknown[] = []
-    for (const chunk of chunkArray(cids, 500)) {
-      try {
-        const keys = chunk.map((cid) => this.getStoredPath(cid))
-        await this.deleteManyKeys(keys)
-      } catch (err) {
-        errors.push(err)
-      }
-    }
-    if (errors.length) throw aggregateErrors(errors)
-  }
-
-  async hasStored(cid: CID): Promise<boolean> {
-    return this.hasKey(this.getStoredPath(cid))
-  }
-
-  async hasTemp(key: string): Promise<boolean> {
-    return this.hasKey(this.getTmpPath(key))
-  }
-
-  private async hasKey(key: string) {
-    try {
-      const res = await this.client.headObject({
-        Bucket: this.bucket,
-        Key: key,
-      })
-      return res.$metadata.httpStatusCode === 200
-    } catch (err) {
-      return false
-    }
-  }
-
-  private async deleteKey(key: string) {
-    await this.client.deleteObject({
-      Bucket: this.bucket,
-      Key: key,
-    })
-  }
-
-  private async deleteManyKeys(keys: string[]) {
-    await this.client.deleteObjects({
-      Bucket: this.bucket,
-      Delete: {
-        Objects: keys.map((k) => ({ Key: k })),
-      },
-    })
-  }
-
-  private async move(keys: { from: string; to: string }) {
-    try {
-      await this.client.copyObject({
-        Bucket: this.bucket,
-        CopySource: `${this.bucket}/${keys.from}`,
-        Key: keys.to,
-      })
-    } catch (cause) {
-      if (cause instanceof NoSuchKey) {
-        // Already deleted, possibly by a concurrently running process
-        throw new BlobNotFoundError(undefined, { cause })
-      }
-
-      throw cause
-    }
-
-    try {
-      await this.client.deleteObject({
-        Bucket: this.bucket,
-        Key: keys.from,
-      })
-    } catch (err) {
-      if (err instanceof NoSuchKey) {
-        // Already deleted, possibly by a concurrently running process
-        return
-      }
-
-      throw err
-    }
-  }
-}
-
-export default S3BlobStore

package/src/types.ts

@@ -1,5 +0,0 @@
-// @NOTE keep in sync with same interface in bsky/src/image/invalidator.ts
-// this is separate to avoid the dependency on @atproto/bsky.
-export interface ImageInvalidator {
-  invalidate(subject: string, paths: string[]): Promise<void>
-}

package/src/util.ts

@@ -1,13 +0,0 @@
-import { allFulfilled } from '@atproto/common'
-import { ImageInvalidator } from './types.js'
-
-export class MultiImageInvalidator implements ImageInvalidator {
-  constructor(public invalidators: ImageInvalidator[]) {}
-  async invalidate(subject: string, paths: string[]) {
-    await allFulfilled(
-      this.invalidators.map((invalidator) =>
-        invalidator.invalidate(subject, paths),
-      ),
-    )
-  }
-}

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../tsconfig/isomorphic.json",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "outDir": "./dist",
-  },
-  "include": ["./src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/bunny.ts","./src/cloudfront.ts","./src/index.ts","./src/kms.ts","./src/s3.ts","./src/types.ts","./src/util.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}