@ayepi/aws 0.4.1 → 0.5.0

package/ayepi-aws.md

@@ -55,7 +55,7 @@ interface S3FilesOptions extends ResilientOptions {
   /** @internal Upload seam (default: `@aws-sdk/lib-storage` multipart `Upload`) — injectable for tests. */
   readonly upload?: (key: string, body: FileBody, contentType?: string, metadata?: Record<string, string>) => Promise<void>;
   /** @internal Presign seam (default: `@aws-sdk/s3-request-presigner`) — injectable for tests. */
-  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string) => Promise<string>;
+  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string, sha256?: string) => Promise<string>;
 }
 ```
 
@@ -110,7 +110,9 @@ Behavior of each method:
   `modifiedAt` but **no `contentType`** (ListObjectsV2 doesn't return it).
 - **`presignDownload(key, opts?)`** — a presigned `GET` URL (default expiry **900 s**).
 - **`presignUpload(key, opts?)`** — a presigned `PUT` URL (default expiry **900 s**); `opts.contentType`
-  pins the `Content-Type` the upload must use.
+  pins the `Content-Type` the upload must use; `opts.sha256` (hex) is signed as the object's
+  `x-amz-checksum-sha256`, so S3 refuses bytes that hash otherwise. A presigned `PUT` cannot cap a
+  body, so `opts.maxSize` rejects (use the files server, or a size check after upload).
 
 **Not-found handling.** S3 surfaces a missing key differently per op (`NoSuchKey` on GET,
 `NotFound` on HEAD). The store treats an error as not-found when its `name` is `NoSuchKey` or

package/dist/s3.cjs

@@ -53,13 +53,14 @@ function s3Files(opts) {
 			Metadata: metadata
 		}
 	}).done().then(() => void 0);
-	const sdkPresign = (kind, key, expiresIn, contentType) => (0, _aws_sdk_s3_request_presigner.getSignedUrl)(client, kind === "get" ? new _aws_sdk_client_s3.GetObjectCommand({
+	const sdkPresign = (kind, key, expiresIn, contentType, sha256) => (0, _aws_sdk_s3_request_presigner.getSignedUrl)(client, kind === "get" ? new _aws_sdk_client_s3.GetObjectCommand({
 		Bucket: bucket,
 		Key: k(key)
 	}) : new _aws_sdk_client_s3.PutObjectCommand({
 		Bucket: bucket,
 		Key: k(key),
-		ContentType: contentType
+		ContentType: contentType,
+		ChecksumSHA256: sha256 === void 0 ? void 0 : Buffer.from(sha256, "hex").toString("base64")
 	}), { expiresIn });
 	/* v8 ignore stop */
 	const upload = opts.upload ?? sdkUpload;
@@ -131,7 +132,10 @@ function s3Files(opts) {
 			};
 		}),
 		presignDownload: (key, o) => presign("get", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN),
-		presignUpload: (key, o) => presign("put", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN, o?.contentType)
+		presignUpload: (key, o) => {
+			if (o?.maxSize !== void 0) return Promise.reject(/* @__PURE__ */ new Error("s3Files: a presigned PUT cannot cap the upload size (maxSize)"));
+			return presign("put", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN, o?.contentType, o?.sha256?.toLowerCase());
+		}
 	};
 }
 //#endregion

package/dist/s3.d.cts

@@ -15,7 +15,7 @@ interface S3FilesOptions extends ResilientOptions {
   /** @internal Upload seam (default: `@aws-sdk/lib-storage` multipart `Upload`) — injectable for tests. */
   readonly upload?: (key: string, body: FileBody, contentType?: string, metadata?: Record<string, string>) => Promise<void>;
   /** @internal Presign seam (default: `@aws-sdk/s3-request-presigner`) — injectable for tests. */
-  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string) => Promise<string>;
+  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string, sha256?: string) => Promise<string>;
 }
 /**
  * Create an S3-backed {@link FileStore} (and {@link Presigner}). Pass a configured `S3Client`

package/dist/s3.d.ts

@@ -15,7 +15,7 @@ interface S3FilesOptions extends ResilientOptions {
   /** @internal Upload seam (default: `@aws-sdk/lib-storage` multipart `Upload`) — injectable for tests. */
   readonly upload?: (key: string, body: FileBody, contentType?: string, metadata?: Record<string, string>) => Promise<void>;
   /** @internal Presign seam (default: `@aws-sdk/s3-request-presigner`) — injectable for tests. */
-  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string) => Promise<string>;
+  readonly presign?: (kind: 'get' | 'put', key: string, expiresIn: number, contentType?: string, sha256?: string) => Promise<string>;
 }
 /**
  * Create an S3-backed {@link FileStore} (and {@link Presigner}). Pass a configured `S3Client`

package/dist/s3.js

@@ -52,13 +52,14 @@ function s3Files(opts) {
 			Metadata: metadata
 		}
 	}).done().then(() => void 0);
-	const sdkPresign = (kind, key, expiresIn, contentType) => getSignedUrl(client, kind === "get" ? new GetObjectCommand({
+	const sdkPresign = (kind, key, expiresIn, contentType, sha256) => getSignedUrl(client, kind === "get" ? new GetObjectCommand({
 		Bucket: bucket,
 		Key: k(key)
 	}) : new PutObjectCommand({
 		Bucket: bucket,
 		Key: k(key),
-		ContentType: contentType
+		ContentType: contentType,
+		ChecksumSHA256: sha256 === void 0 ? void 0 : Buffer.from(sha256, "hex").toString("base64")
 	}), { expiresIn });
 	/* v8 ignore stop */
 	const upload = opts.upload ?? sdkUpload;
@@ -130,7 +131,10 @@ function s3Files(opts) {
 			};
 		}),
 		presignDownload: (key, o) => presign("get", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN),
-		presignUpload: (key, o) => presign("put", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN, o?.contentType)
+		presignUpload: (key, o) => {
+			if (o?.maxSize !== void 0) return Promise.reject(/* @__PURE__ */ new Error("s3Files: a presigned PUT cannot cap the upload size (maxSize)"));
+			return presign("put", key, o?.expiresIn ?? DEFAULT_EXPIRES_IN, o?.contentType, o?.sha256?.toLowerCase());
+		}
 	};
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ayepi/aws",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "AWS backends for ayepi — an SQS @ayepi/work queue (large payloads offloaded to S3) and an S3 @ayepi/files store, all retry-wrapped for throttle resilience",
   "license": "MIT",
   "publishConfig": {
@@ -73,9 +73,9 @@
     "@aws-sdk/lib-storage": "^3",
     "@aws-sdk/s3-request-presigner": "^3",
     "@smithy/node-http-handler": "^4",
-    "@ayepi/core": "^0.4.1",
-    "@ayepi/files": "^0.4.1",
-    "@ayepi/work": "^0.4.1"
+    "@ayepi/core": "^0.5.0",
+    "@ayepi/files": "^0.5.0",
+    "@ayepi/work": "^0.5.0"
   },
   "peerDependenciesMeta": {
     "@ayepi/work": {
@@ -111,10 +111,10 @@
     "testcontainers": "^10.13.0",
     "tsdown": "^0.12.0",
     "vitest": "^2.1.8",
-    "zod": "^4.4.3",
-    "@ayepi/core": "0.4.1",
-    "@ayepi/work": "0.4.1",
-    "@ayepi/files": "0.4.1"
+    "zod": "^4.6.7",
+    "@ayepi/work": "0.5.0",
+    "@ayepi/files": "0.5.0",
+    "@ayepi/core": "0.5.0"
   },
   "keywords": [
     "ayepi",