@digimuza/saas-core 0.0.2

package/dist/storage/s3.js

@@ -0,0 +1,175 @@
+import { createHash } from "node:crypto";
+import { encodeObjectPath, presign } from "./sigv4.js";
+function toBytes(body) {
+    return typeof body === "string" ? new TextEncoder().encode(body) : body;
+}
+/**
+ * S3 and S3-compatible object storage.
+ *
+ * Uses SigV4 presigned URLs for reads and browser uploads, and a signed `PUT`
+ * over `fetch` for server-side writes. No AWS SDK: see `sigv4.ts` for why, and
+ * note that the signing itself is verified against AWS's published test vector.
+ */
+export function createS3Provider(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const now = options.now ?? (() => new Date());
+    const pathStyle = options.forcePathStyle ?? options.endpoint !== undefined;
+    const host = (() => {
+        if (options.endpoint === undefined) {
+            return pathStyle
+                ? `s3.${options.region}.amazonaws.com`
+                : `${options.bucket}.s3.${options.region}.amazonaws.com`;
+        }
+        const parsed = new URL(options.endpoint);
+        return pathStyle ? parsed.host : `${options.bucket}.${parsed.host}`;
+    })();
+    function pathFor(key) {
+        const encoded = encodeObjectPath(key);
+        return pathStyle ? `/${options.bucket}/${encoded}` : `/${encoded}`;
+    }
+    function sign(input) {
+        return presign({
+            method: input.method,
+            host,
+            path: pathFor(input.key),
+            region: options.region,
+            service: "s3",
+            credentials: options.credentials,
+            expiresInSeconds: input.expiresInSeconds,
+            now: now(),
+            ...(input.query !== undefined ? { query: input.query } : {}),
+            ...(input.headers !== undefined ? { headers: input.headers } : {}),
+        }).url;
+    }
+    return {
+        name: "s3",
+        async put(input) {
+            const bytes = toBytes(input.body);
+            /**
+             * A short-lived signed PUT rather than a signed request header set: the same
+             * code path the browser upload uses, so there is one signing path to get
+             * right instead of two.
+             */
+            const url = sign({
+                method: "PUT",
+                key: input.key,
+                expiresInSeconds: 300,
+                ...(input.contentType !== undefined
+                    ? { headers: { "content-type": input.contentType } }
+                    : {}),
+            });
+            const response = await fetchImpl(url, {
+                method: "PUT",
+                headers: {
+                    ...(input.contentType !== undefined ? { "Content-Type": input.contentType } : {}),
+                    ...(input.cacheControl !== undefined ? { "Cache-Control": input.cacheControl } : {}),
+                    ...Object.fromEntries(Object.entries(input.metadata ?? {}).map(([name, value]) => [
+                        `x-amz-meta-${name}`,
+                        value,
+                    ])),
+                },
+                /**
+                 * Cast at the boundary: `BodyInit` comes from the DOM lib, which this
+                 * package does not include — a `Uint8Array` is a valid body regardless.
+                 */
+                body: bytes,
+            });
+            if (!response.ok) {
+                /**
+                 * The body is not included. S3 error documents echo the key and can echo
+                 * request parameters, and this message may reach a log.
+                 */
+                throw new Error(`Object store rejected the upload with status ${response.status}.`);
+            }
+            const etag = response.headers?.get?.("etag") ?? undefined;
+            return {
+                key: input.key,
+                size: bytes.byteLength,
+                ...(etag !== null && etag !== undefined ? { etag: etag.replaceAll('"', "") } : {}),
+            };
+        },
+        async delete(key) {
+            const response = await fetchImpl(sign({ method: "DELETE", key, expiresInSeconds: 300 }), {
+                method: "DELETE",
+            });
+            // S3 returns 204 for a delete, and also for a key that was never there.
+            if (!response.ok && response.status !== 404) {
+                throw new Error(`Object store rejected the delete with status ${response.status}.`);
+            }
+        },
+        async exists(key) {
+            const response = await fetchImpl(sign({ method: "HEAD", key, expiresInSeconds: 300 }), {
+                method: "HEAD",
+            });
+            if (response.status === 404 || response.status === 403) {
+                // 403 on a HEAD usually means "no such key" on a bucket without ListBucket.
+                return false;
+            }
+            if (!response.ok) {
+                throw new Error(`Object store returned status ${response.status} for a HEAD.`);
+            }
+            return true;
+        },
+        async stat(key) {
+            const response = await fetchImpl(sign({ method: "HEAD", key, expiresInSeconds: 300 }), {
+                method: "HEAD",
+            });
+            if (response.status === 404 || response.status === 403) {
+                return undefined;
+            }
+            if (!response.ok) {
+                throw new Error(`Object store returned status ${response.status} for a HEAD.`);
+            }
+            const length = response.headers?.get?.("content-length");
+            const contentType = response.headers?.get?.("content-type") ?? undefined;
+            const etag = response.headers?.get?.("etag") ?? undefined;
+            return {
+                // A HEAD without content-length would be unusual; treat it as unknown.
+                size: length == null ? 0 : Number(length),
+                ...(contentType != null ? { contentType } : {}),
+                ...(etag != null ? { etag: etag.replaceAll('"', "") } : {}),
+            };
+        },
+        publicUrl(key) {
+            if (options.publicBaseUrl === undefined) {
+                return undefined;
+            }
+            const base = options.publicBaseUrl.replace(/\/+$/, "");
+            return `${base}/${encodeObjectPath(key)}`;
+        },
+        async signedDownloadUrl(input) {
+            const query = {};
+            if (input.downloadFilename !== undefined) {
+                /**
+                 * `attachment` rather than `inline`. Serving user-uploaded HTML or SVG
+                 * inline from a bucket origin is stored XSS; forcing a download is what
+                 * makes arbitrary uploads safe to hand back.
+                 */
+                query["response-content-disposition"] =
+                    `attachment; filename="${input.downloadFilename.replace(/["\\]/g, "")}"`;
+            }
+            return sign({
+                method: "GET",
+                key: input.key,
+                expiresInSeconds: input.expiresInSeconds,
+                ...(Object.keys(query).length > 0 ? { query } : {}),
+            });
+        },
+        async signedUploadUrl(input) {
+            return sign({
+                method: "PUT",
+                key: input.key,
+                expiresInSeconds: input.expiresInSeconds,
+                // Signed, so the client must send exactly this type or be rejected.
+                ...(input.contentType !== undefined
+                    ? { headers: { "content-type": input.contentType } }
+                    : {}),
+            });
+        },
+    };
+}
+/** Content hash, for deduplicating or naming objects by content. */
+export function objectDigest(body) {
+    return createHash("sha256").update(toBytes(body)).digest("hex");
+}
+//# sourceMappingURL=s3.js.map

package/dist/storage/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../src/storage/s3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAyB,MAAM,YAAY,CAAC;AAwB9E,SAAS,OAAO,CAAC,IAAgB;IAC/B,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC;IAE3E,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS;gBACd,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,gBAAgB;gBACtC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,gBAAgB,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC,CAAC,EAAE,CAAC;IAEL,SAAS,OAAO,CAAC,GAAW;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,SAAS,IAAI,CAAC,KAMb;QACC,OAAO,OAAO,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,EAAE,GAAG,EAAE;YACV,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC,GAAG,CAAC;IACT,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QAEV,KAAK,CAAC,GAAG,CAAC,KAAqB;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC;;;;eAIG;YACH,MAAM,GAAG,GAAG,IAAI,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,gBAAgB,EAAE,GAAG;gBACrB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpF,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;wBAC1D,cAAc,IAAI,EAAE;wBACpB,KAAK;qBACN,CAAC,CACH;iBACF;gBACD;;;mBAGG;gBACH,IAAI,EAAE,KAAyB;aAChC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB;;;mBAGG;gBACH,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YAE1D,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;gBACvF,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,wEAAwE;YACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;gBACrF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,4EAA4E;gBAC5E,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAW;YACpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;gBACrF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;YACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YAE1D,OAAO;gBACL,uEAAuE;gBACvE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACzC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,GAAW;YACnB,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO,GAAG,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAA0B;YAChD,MAAM,KAAK,GAA2B,EAAE,CAAC;YAEzC,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACzC;;;;mBAIG;gBACH,KAAK,CAAC,8BAA8B,CAAC;oBACnC,yBAAyB,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC;YAC7E,CAAC;YAED,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAwB;YAC5C,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,oEAAoE;gBACpE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/storage/service.d.ts

@@ -0,0 +1,86 @@
+import type { WorkspaceContext } from "../workspaces/context.ts";
+import type { ObjectBody, StorageProvider, StoredObject } from "./provider.ts";
+export interface UploadInput {
+    /**
+     * Path within the workspace, e.g. `avatars/user-1.png`.
+     *
+     * Validated, not sanitised — see `keys.ts`. The workspace prefix is added for
+     * you and cannot be bypassed.
+     */
+    readonly path: string;
+    readonly body: ObjectBody;
+    readonly contentType?: string;
+    readonly cacheControl?: string;
+    readonly metadata?: Readonly<Record<string, string>>;
+    /** Rejects a body larger than this, before it reaches the provider. */
+    readonly maxBytes?: number;
+}
+export interface UrlOptions {
+    /** Default 900 (15 minutes). Capped at {@link MAX_SIGNED_URL_SECONDS}. */
+    readonly expiresInSeconds?: number;
+    /**
+     * Force a download with this filename.
+     *
+     * The safe default for anything a user uploaded — see `getUrl`.
+     */
+    readonly downloadFilename?: string;
+}
+export interface UploadUrlOptions {
+    readonly expiresInSeconds?: number;
+    /** Signed in, so the client must send exactly this type. */
+    readonly contentType?: string;
+}
+/**
+ * Storage bound to one workspace.
+ *
+ * Every method takes a *path*, never a key, so a caller cannot address an object
+ * outside its own tenant. The prefix is applied here and nowhere else.
+ */
+export interface ScopedStorage {
+    readonly workspaceId: string;
+    /** The fully-qualified key a path maps to. For storing in your own tables. */
+    keyFor(path: string): string;
+    upload(input: UploadInput): Promise<StoredObject>;
+    delete(path: string): Promise<void>;
+    exists(path: string): Promise<boolean>;
+    /**
+     * A URL for reading the object.
+     *
+     * Returns the public URL when the store has one, otherwise a time-limited
+     * signed URL.
+     */
+    getUrl(path: string, options?: UrlOptions): Promise<string>;
+    /** A URL the browser can `PUT` to directly. */
+    createUploadUrl(path: string, options?: UploadUrlOptions): Promise<string>;
+    /**
+     * Act on a key that was stored earlier, asserting it belongs to this workspace.
+     *
+     * The check that matters when a key comes back out of your own database: it may
+     * have been written before a bug was fixed, or by a different tenant.
+     */
+    urlForKey(key: string, options?: UrlOptions): Promise<string>;
+    deleteKey(key: string): Promise<void>;
+}
+export interface StorageService {
+    /** Bind to a verified workspace. The only way to address an object. */
+    forWorkspace(context: WorkspaceContext): ScopedStorage;
+    /** The underlying provider, for a capability the service does not wrap. */
+    readonly provider: StorageProvider;
+}
+export interface StorageServiceDeps {
+    readonly provider: StorageProvider;
+    /** Default signed-URL lifetime. */
+    readonly defaultExpiresInSeconds?: number;
+    /** Rejects any upload larger than this. */
+    readonly maxUploadBytes?: number;
+}
+/**
+ * Seven days. S3's own hard limit for a SigV4 presigned URL — beyond it the
+ * signature is simply invalid, so accepting a larger number would hand back a URL
+ * that never works.
+ */
+export declare const MAX_SIGNED_URL_SECONDS: number;
+export declare function createStorageService(deps: StorageServiceDeps): StorageService;
+/** Thrown by callers that need a missing object to be an error. */
+export declare function assertObjectExists(exists: boolean, path: string): void;
+//# sourceMappingURL=service.d.ts.map

package/dist/storage/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/storage/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,8EAA8E;IAC9E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAE7B,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5D,+CAA+C;IAC/C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3E;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAC;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,mCAAmC;IACnC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,2CAA2C;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAGD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAIvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CA+G7E;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAItE"}

package/dist/storage/service.js

@@ -0,0 +1,107 @@
+import { InvalidInputError, NotFoundError } from "../errors.js";
+import { assertKeyBelongsTo, workspaceObjectKey } from "./keys.js";
+const DEFAULT_EXPIRES_SECONDS = 900;
+/**
+ * Seven days. S3's own hard limit for a SigV4 presigned URL — beyond it the
+ * signature is simply invalid, so accepting a larger number would hand back a URL
+ * that never works.
+ */
+export const MAX_SIGNED_URL_SECONDS = 7 * 24 * 60 * 60;
+const DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
+export function createStorageService(deps) {
+    const defaultExpires = deps.defaultExpiresInSeconds ?? DEFAULT_EXPIRES_SECONDS;
+    const maxUploadBytes = deps.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+    function expiry(requested) {
+        const seconds = requested ?? defaultExpires;
+        if (!Number.isInteger(seconds) || seconds <= 0) {
+            throw new InvalidInputError("expiresInSeconds must be a positive integer.");
+        }
+        if (seconds > MAX_SIGNED_URL_SECONDS) {
+            // Clamping silently would produce a URL that expires sooner than promised.
+            throw new InvalidInputError(`expiresInSeconds may not exceed ${MAX_SIGNED_URL_SECONDS} (7 days).`);
+        }
+        return seconds;
+    }
+    return {
+        provider: deps.provider,
+        forWorkspace(context) {
+            const workspaceId = context.workspaceId;
+            function keyFor(path) {
+                return workspaceObjectKey(workspaceId, path);
+            }
+            async function urlFor(key, options = {}) {
+                /**
+                 * A public URL is only used when no download filename was requested —
+                 * asking for `attachment` and getting a bare CDN link back would silently
+                 * drop the protection the caller asked for.
+                 */
+                if (options.downloadFilename === undefined) {
+                    const publicUrl = deps.provider.publicUrl(key);
+                    if (publicUrl !== undefined) {
+                        return publicUrl;
+                    }
+                }
+                return deps.provider.signedDownloadUrl({
+                    key,
+                    expiresInSeconds: expiry(options.expiresInSeconds),
+                    ...(options.downloadFilename !== undefined
+                        ? { downloadFilename: options.downloadFilename }
+                        : {}),
+                });
+            }
+            return {
+                workspaceId,
+                keyFor,
+                async upload(input) {
+                    const key = keyFor(input.path);
+                    const size = typeof input.body === "string"
+                        ? Buffer.byteLength(input.body, "utf8")
+                        : input.body.byteLength;
+                    const limit = input.maxBytes ?? maxUploadBytes;
+                    if (size > limit) {
+                        // Checked before the provider call, so an oversized body is never sent.
+                        throw new InvalidInputError(`Upload exceeds the ${limit} byte limit.`);
+                    }
+                    return deps.provider.put({
+                        key,
+                        body: input.body,
+                        ...(input.contentType !== undefined ? { contentType: input.contentType } : {}),
+                        ...(input.cacheControl !== undefined ? { cacheControl: input.cacheControl } : {}),
+                        ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
+                    });
+                },
+                async delete(path) {
+                    await deps.provider.delete(keyFor(path));
+                },
+                async exists(path) {
+                    return deps.provider.exists(keyFor(path));
+                },
+                async getUrl(path, options = {}) {
+                    return urlFor(keyFor(path), options);
+                },
+                async createUploadUrl(path, options = {}) {
+                    return deps.provider.signedUploadUrl({
+                        key: keyFor(path),
+                        expiresInSeconds: expiry(options.expiresInSeconds),
+                        ...(options.contentType !== undefined ? { contentType: options.contentType } : {}),
+                    });
+                },
+                async urlForKey(key, options = {}) {
+                    assertKeyBelongsTo(workspaceId, key);
+                    return urlFor(key, options);
+                },
+                async deleteKey(key) {
+                    assertKeyBelongsTo(workspaceId, key);
+                    await deps.provider.delete(key);
+                },
+            };
+        },
+    };
+}
+/** Thrown by callers that need a missing object to be an error. */
+export function assertObjectExists(exists, path) {
+    if (!exists) {
+        throw new NotFoundError(`Object "${path}" not found.`);
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/storage/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/storage/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAwFnE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,IAAI,uBAAuB,CAAC;IAC/E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAEvE,SAAS,MAAM,CAAC,SAA6B;QAC3C,MAAM,OAAO,GAAG,SAAS,IAAI,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;YACrC,2EAA2E;YAC3E,MAAM,IAAI,iBAAiB,CACzB,mCAAmC,sBAAsB,YAAY,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QAEvB,YAAY,CAAC,OAAyB;YACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YAExC,SAAS,MAAM,CAAC,IAAY;gBAC1B,OAAO,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,OAAO,GAAe,EAAE;gBACzD;;;;mBAIG;gBACH,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,OAAO,SAAS,CAAC;oBACnB,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;oBACrC,GAAG;oBACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;wBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,WAAW;gBACX,MAAM;gBAEN,KAAK,CAAC,MAAM,CAAC,KAAK;oBAChB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAE/B,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAC5B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;wBACvC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;oBAE5B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,IAAI,cAAc,CAAC;oBAC/C,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;wBACjB,wEAAwE;wBACxE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,KAAK,cAAc,CAAC,CAAC;oBACzE,CAAC;oBAED,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;wBACvB,GAAG;wBACH,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9E,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,IAAI;oBACf,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,IAAI;oBACf,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,EAAE;oBAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvC,CAAC;gBAED,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,EAAE;oBACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;wBACnC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC;wBACjB,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;wBAClD,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE;oBAC/B,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBACrC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9B,CAAC;gBAED,KAAK,CAAC,SAAS,CAAC,GAAG;oBACjB,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBACrC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,IAAY;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/storage/sigv4.d.ts

@@ -0,0 +1,58 @@
+export interface SigV4Credentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** For temporary credentials (STS, instance roles). */
+    readonly sessionToken?: string;
+}
+export interface PresignInput {
+    readonly method: "GET" | "PUT" | "HEAD" | "DELETE";
+    /** Host only, no scheme — `bucket.s3.eu-west-1.amazonaws.com`. */
+    readonly host: string;
+    /** Already-encoded path, beginning with `/`. */
+    readonly path: string;
+    readonly region: string;
+    readonly service: string;
+    readonly credentials: SigV4Credentials;
+    readonly expiresInSeconds: number;
+    /** Extra query parameters to sign, e.g. `response-content-disposition`. */
+    readonly query?: Readonly<Record<string, string>>;
+    /**
+     * Additional headers to sign beyond `host`.
+     *
+     * A signed header must be sent by the client *exactly* as signed, or the
+     * request is rejected — so only include what the caller controls.
+     */
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly now?: Date;
+}
+/** RFC 3986, which is stricter than `encodeURIComponent` about these four. */
+export declare function uriEncode(value: string): string;
+/**
+ * Encode an object key for use in a URL path.
+ *
+ * Slashes are preserved — they are path separators in a key, not data — while
+ * every other reserved character is escaped.
+ */
+export declare function encodeObjectPath(key: string): string;
+/**
+ * Derive the signing key.
+ *
+ * Four chained HMACs, each scoping the key more narrowly — so a leaked signing
+ * key is only good for one date, region and service rather than for the account.
+ */
+export declare function signingKey(input: {
+    secretAccessKey: string;
+    dateStamp: string;
+    region: string;
+    service: string;
+}): Buffer;
+export interface PresignResult {
+    readonly url: string;
+    /** Exposed so tests can assert against AWS's published vectors. */
+    readonly signature: string;
+    readonly canonicalRequest: string;
+    readonly stringToSign: string;
+    readonly expiresAt: Date;
+}
+export declare function presign(input: PresignInput): PresignResult;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/storage/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/sigv4.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IACnD,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAgBD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAKT;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CAyE1D"}

package/dist/storage/sigv4.js

@@ -0,0 +1,114 @@
+import { createHash, createHmac } from "node:crypto";
+/**
+ * AWS Signature Version 4, query-string ("presigned URL") flavour.
+ *
+ * Implemented rather than pulled in, deliberately. `@aws-sdk/client-s3` plus the
+ * presigner is a large dependency tree for a package many applications install,
+ * and a deployment on R2, MinIO or Backblaze has no reason to carry the AWS SDK
+ * at all. SigV4 is a fully specified algorithm, so unlike an undocumented vendor
+ * API it can be *verified*: the tests check this against AWS's own published
+ * worked example.
+ *
+ * If you would rather use the SDK, `StorageProvider` is a six-method interface.
+ */
+const ALGORITHM = "AWS4-HMAC-SHA256";
+/** Presigned S3 URLs never sign the body. */
+const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+/** RFC 3986, which is stricter than `encodeURIComponent` about these four. */
+export function uriEncode(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+ * Encode an object key for use in a URL path.
+ *
+ * Slashes are preserved — they are path separators in a key, not data — while
+ * every other reserved character is escaped.
+ */
+export function encodeObjectPath(key) {
+    return key.split("/").map(uriEncode).join("/");
+}
+function hmac(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/** `20130524T000000Z` and `20130524`. */
+function timestamps(now) {
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+}
+/**
+ * Derive the signing key.
+ *
+ * Four chained HMACs, each scoping the key more narrowly — so a leaked signing
+ * key is only good for one date, region and service rather than for the account.
+ */
+export function signingKey(input) {
+    const kDate = hmac(`AWS4${input.secretAccessKey}`, input.dateStamp);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, input.service);
+    return hmac(kService, "aws4_request");
+}
+export function presign(input) {
+    const now = input.now ?? new Date();
+    const { amzDate, dateStamp } = timestamps(now);
+    const scope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+    const signedHeaderEntries = Object.entries({
+        // `host` is always signed: it is what binds a signature to one bucket.
+        host: input.host,
+        ...(input.headers ?? {}),
+    }).map(([name, value]) => [name.toLowerCase(), value.trim()]);
+    // Header names sort lexicographically, and the sorted list is itself signed.
+    signedHeaderEntries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    const signedHeaders = signedHeaderEntries.map(([name]) => name).join(";");
+    const queryParameters = {
+        ...(input.query ?? {}),
+        "X-Amz-Algorithm": ALGORITHM,
+        "X-Amz-Credential": `${input.credentials.accessKeyId}/${scope}`,
+        "X-Amz-Date": amzDate,
+        "X-Amz-Expires": String(input.expiresInSeconds),
+        "X-Amz-SignedHeaders": signedHeaders,
+    };
+    if (input.credentials.sessionToken !== undefined) {
+        queryParameters["X-Amz-Security-Token"] = input.credentials.sessionToken;
+    }
+    /**
+     * Canonical query string: encoded, then sorted by encoded key. Sorting before
+     * encoding gives a different order for some inputs, and the signature would
+     * not match.
+     */
+    const canonicalQuery = Object.entries(queryParameters)
+        .map(([key, value]) => [uriEncode(key), uriEncode(value)])
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([key, value]) => `${key}=${value}`)
+        .join("&");
+    const canonicalHeaders = signedHeaderEntries
+        .map(([name, value]) => `${name}:${value}\n`)
+        .join("");
+    const canonicalRequest = [
+        input.method,
+        input.path,
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        UNSIGNED_PAYLOAD,
+    ].join("\n");
+    const stringToSign = [ALGORITHM, amzDate, scope, sha256Hex(canonicalRequest)].join("\n");
+    const signature = createHmac("sha256", signingKey({
+        secretAccessKey: input.credentials.secretAccessKey,
+        dateStamp,
+        region: input.region,
+        service: input.service,
+    }))
+        .update(stringToSign, "utf8")
+        .digest("hex");
+    return {
+        url: `https://${input.host}${input.path}?${canonicalQuery}&X-Amz-Signature=${signature}`,
+        signature,
+        canonicalRequest,
+        stringToSign,
+        expiresAt: new Date(now.getTime() + input.expiresInSeconds * 1000),
+    };
+}
+//# sourceMappingURL=sigv4.js.map

package/dist/storage/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../../src/storage/sigv4.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;GAWG;AAEH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AA+B5C,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,yCAAyC;AACzC,SAAS,UAAU,CAAC,GAAS;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAK1B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AACxC,CAAC;AAWD,MAAM,UAAU,OAAO,CAAC,KAAmB;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,eAAe,CAAC;IAE3E,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC;QACzC,uEAAuE;QACvE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAU,CAAC,CAAC;IAEvE,6EAA6E;IAC7E,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1E,MAAM,eAAe,GAA2B;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,iBAAiB,EAAE,SAAS;QAC5B,kBAAkB,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK,EAAE;QAC/D,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,EAAE,aAAa;KACrC,CAAC;IAEF,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjD,eAAe,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAU,CAAC;SAClE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,MAAM,gBAAgB,GAAG,mBAAmB;SACzC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;SAC5C,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,gBAAgB,GAAG;QACvB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,IAAI;QACV,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzF,MAAM,SAAS,GAAG,UAAU,CAC1B,QAAQ,EACR,UAAU,CAAC;QACT,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,eAAe;QAClD,SAAS;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CACH;SACE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,cAAc,oBAAoB,SAAS,EAAE;QACxF,SAAS;QACT,gBAAgB;QAChB,YAAY;QACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;KACnE,CAAC;AACJ,CAAC"}