@baruk/core 0.3.1 → 0.5.0

package/dist/storage/key.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Construção da chave de objeto (ADR 0007 D7).
+ *
+ * Formato:
+ *   {tenant_id}/{client_id}/{yyyy}/{mm}/{category}/{document_id}/{version}-{rand}
+ *
+ * Três propriedades que a forma garante:
+ *
+ * 1. **Tenant no primeiro segmento** — a fronteira fica legível no próprio
+ *    bucket e permite política de acesso por prefixo no provedor.
+ * 2. **Não previsível** — o sufixo aleatório impede que alguém que conheça os
+ *    ids enumere objetos. A URL assinada já expira, mas defesa em profundidade
+ *    custa 8 bytes.
+ * 3. **Sem nome de arquivo do cliente** — o `original_filename` vive na tabela
+ *    `document_version`, nunca na chave. Nome vindo do cliente não é identidade
+ *    de objeto e é o vetor clássico de path traversal.
+ */
+export declare function buildStorageKey(input: {
+    tenantId: string;
+    clientId: string;
+    documentId: string;
+    versionNo: number;
+    categoryKey?: string | null;
+    competenceLabel?: string | null;
+}): string;
+/**
+ * Reduz um segmento a `[a-z0-9_-]`. Qualquer outra coisa — inclusive `.` e `/` —
+ * é descartada, o que torna `../` impossível de construir por aqui.
+ */
+export declare function sanitizeSegment(value: string): string;
+/**
+ * Higieniza o nome exibido ao usuário. Não participa da chave de storage — é só
+ * o rótulo guardado em `document_version.original_filename` e devolvido no
+ * download. Remove diretório, controla o comprimento e recusa nome vazio.
+ */
+export declare function sanitizeFilename(value: string): string;
+//# sourceMappingURL=key.d.ts.map

package/dist/storage/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/storage/key.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GAAG,MAAM,CAmBT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAStD"}

package/dist/storage/key.js

@@ -0,0 +1,67 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * Construção da chave de objeto (ADR 0007 D7).
+ *
+ * Formato:
+ *   {tenant_id}/{client_id}/{yyyy}/{mm}/{category}/{document_id}/{version}-{rand}
+ *
+ * Três propriedades que a forma garante:
+ *
+ * 1. **Tenant no primeiro segmento** — a fronteira fica legível no próprio
+ *    bucket e permite política de acesso por prefixo no provedor.
+ * 2. **Não previsível** — o sufixo aleatório impede que alguém que conheça os
+ *    ids enumere objetos. A URL assinada já expira, mas defesa em profundidade
+ *    custa 8 bytes.
+ * 3. **Sem nome de arquivo do cliente** — o `original_filename` vive na tabela
+ *    `document_version`, nunca na chave. Nome vindo do cliente não é identidade
+ *    de objeto e é o vetor clássico de path traversal.
+ */
+export function buildStorageKey(input) {
+    const { tenantId, clientId, documentId, versionNo } = input;
+    // Competência dá a partição temporal quando existe; senão, a data corrente.
+    // O formato YYYY-MM já é validado no banco, então o split é seguro.
+    let yyyy;
+    let mm;
+    if (input.competenceLabel && /^\d{4}-\d{2}$/.test(input.competenceLabel)) {
+        [yyyy, mm] = input.competenceLabel.split('-');
+    }
+    else {
+        const now = new Date();
+        yyyy = String(now.getUTCFullYear());
+        mm = String(now.getUTCMonth() + 1).padStart(2, '0');
+    }
+    const category = sanitizeSegment(input.categoryKey ?? 'geral');
+    const rand = randomBytes(8).toString('hex');
+    return `${tenantId}/${clientId}/${yyyy}/${mm}/${category}/${documentId}/${versionNo}-${rand}`;
+}
+/**
+ * Reduz um segmento a `[a-z0-9_-]`. Qualquer outra coisa — inclusive `.` e `/` —
+ * é descartada, o que torna `../` impossível de construir por aqui.
+ */
+export function sanitizeSegment(value) {
+    const cleaned = value
+        .toLowerCase()
+        .normalize('NFD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .replace(/[^a-z0-9_-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, 48);
+    return cleaned.length > 0 ? cleaned : 'geral';
+}
+/**
+ * Higieniza o nome exibido ao usuário. Não participa da chave de storage — é só
+ * o rótulo guardado em `document_version.original_filename` e devolvido no
+ * download. Remove diretório, controla o comprimento e recusa nome vazio.
+ */
+export function sanitizeFilename(value) {
+    const base = value.split(/[\\/]/).pop() ?? '';
+    const cleaned = base
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f]/g, '')
+        .replace(/^\.+/, '')
+        .trim()
+        .slice(0, 180);
+    return cleaned.length > 0 ? cleaned : 'arquivo';
+}
+//# sourceMappingURL=key.js.map

package/dist/storage/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../src/storage/key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAE5D,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAY,CAAC;IACjB,IAAI,EAAU,CAAC;IACf,IAAI,KAAK,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QACpC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5C,OAAO,GAAG,QAAQ,IAAI,QAAQ,IAAI,IAAI,IAAI,EAAE,IAAI,QAAQ,IAAI,UAAU,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK;SAClB,WAAW,EAAE;SACb,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI;QAClB,4CAA4C;SAC3C,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}

package/dist/storage/local.d.ts

@@ -0,0 +1,40 @@
+import { type ObjectHead, type PutObjectInput, type PutObjectResult, type SignedUrlOptions, type StorageProvider } from './types.js';
+/**
+ * Provider de sistema de arquivos — o default seguro (ADR 0007 D4).
+ *
+ * Usado em desenvolvimento e em toda a suíte de testes: nenhum teste depende de
+ * R2 real, o que mantém o CI offline e determinístico.
+ *
+ * A "URL assinada" aqui é um caminho relativo da própria API com token HMAC e
+ * expiração — mesma semântica do presigned do R2 (link temporário, sem
+ * credencial embutida), servido pelo backend em vez do provedor.
+ */
+export declare class LocalStorageProvider implements StorageProvider {
+    readonly key: "local";
+    private readonly root;
+    private readonly signingSecret;
+    constructor(options: {
+        rootDir: string;
+        signingSecret: string;
+    });
+    /**
+     * Resolve a chave para um caminho absoluto e recusa qualquer coisa que escape
+     * da raiz. A chave já é construída por `buildStorageKey`, mas este guard não
+     * confia nisso: um provider de storage é o último lugar onde se deve supor
+     * que a entrada é boa.
+     */
+    private pathFor;
+    put(input: PutObjectInput): Promise<PutObjectResult>;
+    getSignedUrl(key: string, options?: SignedUrlOptions): Promise<string>;
+    head(key: string): Promise<ObjectHead>;
+    delete(key: string): Promise<void>;
+    /** Lê o objeto. Só o LocalStorageProvider expõe isso — o R2 serve direto. */
+    read(key: string): Promise<Uint8Array>;
+    private sign;
+    /**
+     * Valida assinatura e expiração. Comparação em tempo constante — um HMAC
+     * comparado com `===` vaza o prefixo correto byte a byte.
+     */
+    verifySignature(key: string, expiresAt: number, signature: string): boolean;
+}
+//# sourceMappingURL=local.d.ts.map

package/dist/storage/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/storage/local.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAGpB;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,QAAQ,CAAC,GAAG,EAAG,OAAO,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAK/D;;;;;OAKG;IACH,OAAO,CAAC,OAAO;IAST,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAWpD,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAStE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAStC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,6EAA6E;IACvE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ5C,OAAO,CAAC,IAAI;IAIZ;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;CAO5E"}

package/dist/storage/local.js

@@ -0,0 +1,96 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, join, normalize, resolve, sep } from 'node:path';
+import { DEFAULT_SIGNED_URL_TTL_SECONDS, StorageError, } from './types.js';
+import { sha256Hex } from './checksum.js';
+/**
+ * Provider de sistema de arquivos — o default seguro (ADR 0007 D4).
+ *
+ * Usado em desenvolvimento e em toda a suíte de testes: nenhum teste depende de
+ * R2 real, o que mantém o CI offline e determinístico.
+ *
+ * A "URL assinada" aqui é um caminho relativo da própria API com token HMAC e
+ * expiração — mesma semântica do presigned do R2 (link temporário, sem
+ * credencial embutida), servido pelo backend em vez do provedor.
+ */
+export class LocalStorageProvider {
+    key = 'local';
+    root;
+    signingSecret;
+    constructor(options) {
+        this.root = resolve(options.rootDir);
+        this.signingSecret = options.signingSecret;
+    }
+    /**
+     * Resolve a chave para um caminho absoluto e recusa qualquer coisa que escape
+     * da raiz. A chave já é construída por `buildStorageKey`, mas este guard não
+     * confia nisso: um provider de storage é o último lugar onde se deve supor
+     * que a entrada é boa.
+     */
+    pathFor(key) {
+        if (key.includes('\0'))
+            throw new StorageError('chave inválida', 'invalid');
+        const target = resolve(join(this.root, normalize(key)));
+        if (target !== this.root && !target.startsWith(this.root + sep)) {
+            throw new StorageError('chave fora da raiz de storage', 'invalid');
+        }
+        return target;
+    }
+    async put(input) {
+        const target = this.pathFor(input.key);
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, input.body);
+        return {
+            key: input.key,
+            checksumSha256: sha256Hex(input.body),
+            sizeBytes: input.body.byteLength,
+        };
+    }
+    async getSignedUrl(key, options) {
+        const ttl = options?.expiresInSeconds ?? DEFAULT_SIGNED_URL_TTL_SECONDS;
+        const expiresAt = Math.floor(Date.now() / 1000) + ttl;
+        const signature = this.sign(key, expiresAt);
+        const params = new URLSearchParams({ key, expires: String(expiresAt), sig: signature });
+        if (options?.downloadFilename)
+            params.set('filename', options.downloadFilename);
+        return `/v1/documents/blob?${params.toString()}`;
+    }
+    async head(key) {
+        try {
+            const info = await stat(this.pathFor(key));
+            return { exists: true, sizeBytes: info.size };
+        }
+        catch {
+            return { exists: false };
+        }
+    }
+    async delete(key) {
+        await rm(this.pathFor(key), { force: true });
+    }
+    /** Lê o objeto. Só o LocalStorageProvider expõe isso — o R2 serve direto. */
+    async read(key) {
+        try {
+            return new Uint8Array(await readFile(this.pathFor(key)));
+        }
+        catch {
+            throw new StorageError('objeto não encontrado', 'not-found');
+        }
+    }
+    sign(key, expiresAt) {
+        return createHmac('sha256', this.signingSecret).update(`${key}:${expiresAt}`).digest('hex');
+    }
+    /**
+     * Valida assinatura e expiração. Comparação em tempo constante — um HMAC
+     * comparado com `===` vaza o prefixo correto byte a byte.
+     */
+    verifySignature(key, expiresAt, signature) {
+        if (!Number.isFinite(expiresAt) || expiresAt < Math.floor(Date.now() / 1000))
+            return false;
+        const expected = Buffer.from(this.sign(key, expiresAt), 'utf8');
+        const received = Buffer.from(signature, 'utf8');
+        if (expected.length !== received.length)
+            return false;
+        return timingSafeEqual(expected, received);
+    }
+}
+//# sourceMappingURL=local.js.map

package/dist/storage/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/storage/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,8BAA8B,EAC9B,YAAY,GAMb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IACtB,GAAG,GAAG,OAAgB,CAAC;IACf,IAAI,CAAS;IACb,aAAa,CAAS;IAEvC,YAAY,OAAmD;QAC7D,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,GAAW;QACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YACrC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,OAA0B;QACxD,MAAM,GAAG,GAAG,OAAO,EAAE,gBAAgB,IAAI,8BAA8B,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,IAAI,OAAO,EAAE,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChF,OAAO,sBAAsB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAW,EAAE,SAAiB;QACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,GAAW,EAAE,SAAiB,EAAE,SAAiB;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/storage/r2.d.ts

@@ -0,0 +1,43 @@
+import { type ObjectHead, type PutObjectInput, type PutObjectResult, type SignedUrlOptions, type StorageProvider } from './types.js';
+/**
+ * Cloudflare R2 — provider de produção (ADR 0007 D5).
+ *
+ * Fala S3 por AWS SigV4 implementado aqui, sem SDK. Duas razões:
+ *
+ * 1. **Nenhuma dependência nova.** `@aws-sdk/client-s3` traria dezenas de
+ *    pacotes transitivos para usarmos quatro operações. O lockfile deste
+ *    monorepo já é sensível a divergência entre macOS e o CI Linux.
+ * 2. **A superfície é pequena e estável.** SigV4 não muda; o que muda é o
+ *    fornecedor, e é exatamente isso que a interface `StorageProvider` isola.
+ *
+ * O bucket é privado. Não existe caminho neste arquivo que torne um objeto
+ * público — leitura é sempre por URL assinada com expiração.
+ */
+export interface R2Config {
+    accountId: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    bucket: string;
+    /** Região fixa do R2. */
+    region?: string;
+    fetchImpl?: typeof fetch;
+}
+export declare class R2StorageProvider implements StorageProvider {
+    readonly key: "r2";
+    private readonly cfg;
+    private readonly fetchImpl;
+    private readonly host;
+    constructor(config: R2Config);
+    private objectUrl;
+    put(input: PutObjectInput): Promise<PutObjectResult>;
+    /**
+     * Presigned GET por query string (SigV4). O link carrega a assinatura e a
+     * expiração — nunca a credencial.
+     */
+    getSignedUrl(key: string, options?: SignedUrlOptions): Promise<string>;
+    head(key: string): Promise<ObjectHead>;
+    delete(key: string): Promise<void>;
+    private signedHeaders;
+    private calculateSignature;
+}
+//# sourceMappingURL=r2.d.ts.map

package/dist/storage/r2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAGpB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAKD,qBAAa,iBAAkB,YAAW,eAAe;IACvD,QAAQ,CAAC,GAAG,EAAG,IAAI,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,MAAM,EAAE,QAAQ;IAe5B,OAAO,CAAC,SAAS;IAIX,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IA6B1D;;;OAGG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqCtE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkBtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,kBAAkB;CAsB3B"}

package/dist/storage/r2.js

@@ -0,0 +1,177 @@
+import { createHash, createHmac } from 'node:crypto';
+import { DEFAULT_SIGNED_URL_TTL_SECONDS, StorageError, } from './types.js';
+import { sha256Hex } from './checksum.js';
+const SERVICE = 's3';
+const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
+export class R2StorageProvider {
+    key = 'r2';
+    cfg;
+    fetchImpl;
+    host;
+    constructor(config) {
+        if (!config.accountId || !config.accessKeyId || !config.secretAccessKey || !config.bucket) {
+            throw new StorageError('configuração R2 incompleta', 'invalid');
+        }
+        this.cfg = {
+            accountId: config.accountId,
+            accessKeyId: config.accessKeyId,
+            secretAccessKey: config.secretAccessKey,
+            bucket: config.bucket,
+            region: config.region ?? 'auto',
+        };
+        this.fetchImpl = config.fetchImpl ?? fetch;
+        this.host = `${this.cfg.accountId}.r2.cloudflarestorage.com`;
+    }
+    objectUrl(key) {
+        return `https://${this.host}/${this.cfg.bucket}/${encodeKey(key)}`;
+    }
+    async put(input) {
+        const url = this.objectUrl(input.key);
+        const payloadHash = createHash('sha256').update(input.body).digest('hex');
+        const headers = this.signedHeaders('PUT', new URL(url), payloadHash, {
+            'content-type': input.contentType,
+            'content-length': String(input.body.byteLength),
+        });
+        const res = await this.fetchImpl(url, {
+            method: 'PUT',
+            headers,
+            body: input.body,
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!res.ok) {
+            throw new StorageError(`R2 recusou o upload (HTTP ${res.status})`, res.status === 403 ? 'denied' : 'unavailable');
+        }
+        return {
+            key: input.key,
+            checksumSha256: sha256Hex(input.body),
+            sizeBytes: input.body.byteLength,
+        };
+    }
+    /**
+     * Presigned GET por query string (SigV4). O link carrega a assinatura e a
+     * expiração — nunca a credencial.
+     */
+    async getSignedUrl(key, options) {
+        const expires = Math.min(options?.expiresInSeconds ?? DEFAULT_SIGNED_URL_TTL_SECONDS, 604_800);
+        const url = new URL(this.objectUrl(key));
+        const { amzDate, dateStamp } = timestamps();
+        const credentialScope = `${dateStamp}/${this.cfg.region}/${SERVICE}/aws4_request`;
+        url.searchParams.set('X-Amz-Algorithm', 'AWS4-HMAC-SHA256');
+        url.searchParams.set('X-Amz-Credential', `${this.cfg.accessKeyId}/${credentialScope}`);
+        url.searchParams.set('X-Amz-Date', amzDate);
+        url.searchParams.set('X-Amz-Expires', String(expires));
+        url.searchParams.set('X-Amz-SignedHeaders', 'host');
+        if (options?.downloadFilename) {
+            url.searchParams.set('response-content-disposition', `attachment; filename="${options.downloadFilename.replace(/"/g, '')}"`);
+        }
+        const canonicalRequest = [
+            'GET',
+            url.pathname,
+            canonicalQuery(url.searchParams),
+            `host:${this.host}\n`,
+            'host',
+            UNSIGNED_PAYLOAD,
+        ].join('\n');
+        const signature = this.calculateSignature(canonicalRequest, amzDate, dateStamp, credentialScope);
+        url.searchParams.set('X-Amz-Signature', signature);
+        return url.toString();
+    }
+    async head(key) {
+        const url = this.objectUrl(key);
+        const headers = this.signedHeaders('HEAD', new URL(url), UNSIGNED_PAYLOAD, {});
+        const res = await this.fetchImpl(url, {
+            method: 'HEAD',
+            headers,
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (res.status === 404)
+            return { exists: false };
+        if (!res.ok)
+            throw new StorageError(`R2 head falhou (HTTP ${res.status})`, 'unavailable');
+        const len = res.headers.get('content-length');
+        return {
+            exists: true,
+            sizeBytes: len ? Number(len) : undefined,
+            contentType: res.headers.get('content-type') ?? undefined,
+        };
+    }
+    async delete(key) {
+        const url = this.objectUrl(key);
+        const headers = this.signedHeaders('DELETE', new URL(url), UNSIGNED_PAYLOAD, {});
+        const res = await this.fetchImpl(url, {
+            method: 'DELETE',
+            headers,
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok && res.status !== 404) {
+            throw new StorageError(`R2 delete falhou (HTTP ${res.status})`, 'unavailable');
+        }
+    }
+    signedHeaders(method, url, payloadHash, extra) {
+        const { amzDate, dateStamp } = timestamps();
+        const credentialScope = `${dateStamp}/${this.cfg.region}/${SERVICE}/aws4_request`;
+        const headers = {
+            host: this.host,
+            'x-amz-content-sha256': payloadHash,
+            'x-amz-date': amzDate,
+            ...extra,
+        };
+        const sortedKeys = Object.keys(headers)
+            .map((k) => k.toLowerCase())
+            .sort();
+        const canonicalHeaders = sortedKeys.map((k) => `${k}:${headers[k].trim()}\n`).join('');
+        const signedHeaderList = sortedKeys.join(';');
+        const canonicalRequest = [
+            method,
+            url.pathname,
+            canonicalQuery(url.searchParams),
+            canonicalHeaders,
+            signedHeaderList,
+            payloadHash,
+        ].join('\n');
+        const signature = this.calculateSignature(canonicalRequest, amzDate, dateStamp, credentialScope);
+        return {
+            ...headers,
+            authorization: `AWS4-HMAC-SHA256 Credential=${this.cfg.accessKeyId}/${credentialScope}, ` +
+                `SignedHeaders=${signedHeaderList}, Signature=${signature}`,
+        };
+    }
+    calculateSignature(canonicalRequest, amzDate, dateStamp, credentialScope) {
+        const stringToSign = [
+            'AWS4-HMAC-SHA256',
+            amzDate,
+            credentialScope,
+            createHash('sha256').update(canonicalRequest).digest('hex'),
+        ].join('\n');
+        const kDate = createHmac('sha256', `AWS4${this.cfg.secretAccessKey}`)
+            .update(dateStamp)
+            .digest();
+        const kRegion = createHmac('sha256', kDate).update(this.cfg.region).digest();
+        const kService = createHmac('sha256', kRegion).update(SERVICE).digest();
+        const kSigning = createHmac('sha256', kService).update('aws4_request').digest();
+        return createHmac('sha256', kSigning).update(stringToSign).digest('hex');
+    }
+}
+function timestamps() {
+    const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '');
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+}
+/** Cada segmento é codificado; a barra separadora, não. */
+function encodeKey(key) {
+    return key.split('/').map(encodeURIComponent).join('/');
+}
+/** SigV4 exige query ordenada e RFC3986-encoded. */
+function canonicalQuery(params) {
+    const pairs = [];
+    params.forEach((value, name) => {
+        if (name === 'X-Amz-Signature')
+            return;
+        pairs.push([name, value]);
+    });
+    pairs.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return pairs.map(([k, v]) => `${rfc3986(k)}=${rfc3986(v)}`).join('&');
+}
+function rfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+//# sourceMappingURL=r2.js.map

package/dist/storage/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,8BAA8B,EAC9B,YAAY,GAMb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AA0B1C,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,OAAO,iBAAiB;IACnB,GAAG,GAAG,IAAa,CAAC;IACZ,GAAG,CAAwC;IAC3C,SAAS,CAAe;IACxB,IAAI,CAAS;IAE9B,YAAY,MAAgB;QAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1F,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,GAAG;YACT,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;SAChC,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,2BAA2B,CAAC;IAC/D,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,OAAO,WAAW,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;YACnE,cAAc,EAAE,KAAK,CAAC,WAAW;YACjC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,6BAA6B,GAAG,CAAC,MAAM,GAAG,EAC1C,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YACrC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,OAA0B;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,8BAA8B,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,eAAe,CAAC;QAElF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,8BAA8B,EAC9B,yBAAyB,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG;YACvB,KAAK;YACL,GAAG,CAAC,QAAQ;YACZ,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YAChC,QAAQ,IAAI,CAAC,IAAI,IAAI;YACrB,MAAM;YACN,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CACvC,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,aAAa,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACxC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;SAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CAAC,0BAA0B,GAAG,CAAC,MAAM,GAAG,EAAE,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,aAAa,CACnB,MAAc,EACd,GAAQ,EACR,WAAmB,EACnB,KAA6B;QAE7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,eAAe,CAAC;QAElF,MAAM,OAAO,GAA2B;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,sBAAsB,EAAE,WAAW;YACnC,YAAY,EAAE,OAAO;YACrB,GAAG,KAAK;SACT,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC3B,IAAI,EAAE,CAAC;QACV,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9C,MAAM,gBAAgB,GAAG;YACvB,MAAM;YACN,GAAG,CAAC,QAAQ;YACZ,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YAChC,gBAAgB;YAChB,gBAAgB;YAChB,WAAW;SACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CACvC,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;QAEF,OAAO;YACL,GAAG,OAAO;YACV,aAAa,EACX,+BAA+B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,eAAe,IAAI;gBAC1E,iBAAiB,gBAAgB,eAAe,SAAS,EAAE;SAC9D,CAAC;IACJ,CAAC;IAEO,kBAAkB,CACxB,gBAAwB,EACxB,OAAe,EACf,SAAiB,EACjB,eAAuB;QAEvB,MAAM,YAAY,GAAG;YACnB,kBAAkB;YAClB,OAAO;YACP,eAAe;YACf,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;aAClE,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;QAEhF,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,2DAA2D;AAC3D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,oDAAoD;AACpD,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO;QACvC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC"}

package/dist/storage/registry.d.ts

@@ -0,0 +1,23 @@
+import { type StorageProvider } from './types.js';
+/**
+ * Resolução do provider (ADR 0007 D4) — mesma forma de `resolveBillingProvider`
+ * (ADR 0005): este é o único lugar do produto que conhece nome de fornecedor.
+ *
+ * **Falha fechado.** Pedir `r2` sem configuração completa lança, em vez de cair
+ * silenciosamente no disco local. Um upload que o operador acredita estar no R2
+ * e está no disco efêmero de um contêiner é perda de documento do cliente — e
+ * seria descoberto tarde demais.
+ */
+export type StorageProviderKey = 'local' | 'r2';
+export interface StorageConfig {
+    provider?: string;
+    localRootDir?: string;
+    localSigningSecret?: string;
+    r2AccountId?: string;
+    r2AccessKeyId?: string;
+    r2SecretAccessKey?: string;
+    r2Bucket?: string;
+}
+export declare function resolveStorageProvider(config?: StorageConfig): StorageProvider;
+export declare function availableStorageProviders(): StorageProviderKey[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/storage/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/storage/registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,aAAkB,GAAG,eAAe,CAuClF;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,EAAE,CAEhE"}

package/dist/storage/registry.js

@@ -0,0 +1,37 @@
+import { LocalStorageProvider } from './local.js';
+import { R2StorageProvider } from './r2.js';
+import { StorageError } from './types.js';
+export function resolveStorageProvider(config = {}) {
+    const key = (config.provider ?? 'local').toLowerCase();
+    if (key === 'r2') {
+        const missing = [
+            ['DOCUMENTS_R2_ACCOUNT_ID', config.r2AccountId],
+            ['DOCUMENTS_R2_ACCESS_KEY_ID', config.r2AccessKeyId],
+            ['DOCUMENTS_R2_SECRET_ACCESS_KEY', config.r2SecretAccessKey],
+            ['DOCUMENTS_R2_BUCKET', config.r2Bucket],
+        ]
+            .filter(([, value]) => !value)
+            .map(([name]) => name);
+        if (missing.length > 0) {
+            // A mensagem nomeia as variáveis ausentes e nunca o valor de nenhuma.
+            throw new StorageError(`storage r2 selecionado mas a configuração está incompleta: ${missing.join(', ')}`, 'invalid');
+        }
+        return new R2StorageProvider({
+            accountId: config.r2AccountId,
+            accessKeyId: config.r2AccessKeyId,
+            secretAccessKey: config.r2SecretAccessKey,
+            bucket: config.r2Bucket,
+        });
+    }
+    if (key === 'local') {
+        return new LocalStorageProvider({
+            rootDir: config.localRootDir ?? '.storage',
+            signingSecret: config.localSigningSecret ?? 'dev-only-signing-secret',
+        });
+    }
+    throw new StorageError(`storage provider desconhecido: ${key}`, 'invalid');
+}
+export function availableStorageProviders() {
+    return ['local', 'r2'];
+}
+//# sourceMappingURL=registry.js.map

package/dist/storage/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/storage/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAwB,MAAM,YAAY,CAAC;AAuBhE,MAAM,UAAU,sBAAsB,CAAC,SAAwB,EAAE;IAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAEvD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,GACX;YACE,CAAC,yBAAyB,EAAE,MAAM,CAAC,WAAW,CAAC;YAC/C,CAAC,4BAA4B,EAAE,MAAM,CAAC,aAAa,CAAC;YACpD,CAAC,gCAAgC,EAAE,MAAM,CAAC,iBAAiB,CAAC;YAC5D,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC;SAE3C;aACE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,sEAAsE;YACtE,MAAM,IAAI,YAAY,CACpB,8DAA8D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClF,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,iBAAiB,CAAC;YAC3B,SAAS,EAAE,MAAM,CAAC,WAAY;YAC9B,WAAW,EAAE,MAAM,CAAC,aAAc;YAClC,eAAe,EAAE,MAAM,CAAC,iBAAkB;YAC1C,MAAM,EAAE,MAAM,CAAC,QAAS;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,oBAAoB,CAAC;YAC9B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,UAAU;YAC1C,aAAa,EAAE,MAAM,CAAC,kBAAkB,IAAI,yBAAyB;SACtE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,YAAY,CAAC,kCAAkC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/storage/types.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Contrato de storage de objetos (ADR 0007 D4).
+ *
+ * Mesma forma do Billing Provider Pattern (ADR 0005): o domínio conhece a
+ * interface, nunca o fornecedor. `local` é o default seguro — o produto roda em
+ * desenvolvimento e em teste sem nenhuma conta externa; `r2` é produção.
+ *
+ * O domínio Documents nunca importa SDK de fornecedor. Se um dia trocarmos R2
+ * por outro S3-compatible, só este diretório muda.
+ */
+export interface PutObjectInput {
+    /** Chave completa, já namespaced por tenant (ver `buildStorageKey`). */
+    key: string;
+    body: Uint8Array;
+    contentType: string;
+}
+export interface PutObjectResult {
+    key: string;
+    /** SHA-256 em hex minúsculo, calculado pelo chamador antes do put. */
+    checksumSha256: string;
+    sizeBytes: number;
+}
+export interface SignedUrlOptions {
+    /**
+     * Validade em segundos. O default de 300s é decisão da ADR 0007 D6: curto o
+     * bastante para que o vazamento do link não vire acesso permanente.
+     */
+    expiresInSeconds?: number;
+    /** Nome sugerido no download; vai no `response-content-disposition`. */
+    downloadFilename?: string;
+}
+export interface ObjectHead {
+    exists: boolean;
+    sizeBytes?: number;
+    contentType?: string;
+}
+export interface StorageProvider {
+    /** Identificador persistido em `blob.storage_provider`. */
+    readonly key: 'local' | 'r2' | 's3';
+    put(input: PutObjectInput): Promise<PutObjectResult>;
+    /**
+     * URL temporária de leitura. NUNCA retorna URL pública permanente — o bucket
+     * é privado e o link expira (ADR 0007 D6).
+     */
+    getSignedUrl(key: string, options?: SignedUrlOptions): Promise<string>;
+    head(key: string): Promise<ObjectHead>;
+    /**
+     * Remoção física. Só é chamada pelo job de retenção, nunca pelo fluxo de UI
+     * (ADR 0007). A exclusão no produto é soft delete no `document`.
+     */
+    delete(key: string): Promise<void>;
+}
+export declare class StorageError extends Error {
+    readonly code: 'not-found' | 'unavailable' | 'denied' | 'invalid';
+    constructor(message: string, code: 'not-found' | 'unavailable' | 'denied' | 'invalid');
+}
+/** Validade padrão de URL assinada, em segundos (ADR 0007 D6). */
+export declare const DEFAULT_SIGNED_URL_TTL_SECONDS = 300;
+/** Teto de tamanho por arquivo. Acima disso, o upload é recusado na borda. */
+export declare const MAX_UPLOAD_BYTES: number;
+/**
+ * Tipos aceitos. Allowlist, nunca denylist: um tipo desconhecido é recusado, e
+ * não aceito por omissão.
+ */
+export declare const ALLOWED_MIME_TYPES: readonly string[];
+export declare function isAllowedMimeType(mime: string): boolean;
+//# sourceMappingURL=types.d.ts.map

package/dist/storage/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD;;;OAGG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS;gBADjE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS;CAKpE;AAED,kEAAkE;AAClE,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}