@effect-kit/storage 0.0.0-stage → 0.0.0

package/dist/providers/s3/config.js

@@ -0,0 +1,89 @@
+import { ObjectValidator } from "../../core/object.js";
+import { storageError } from "../../core/errors.js";
+import { Effect, Redacted, Schema } from "effect";
+import { createHash } from "node:crypto";
+
+// src/providers/s3/config.ts
+const Positive = Schema.Int.check(Schema.isGreaterThan(0));
+const Settings = Schema.Struct({
+	bucket: Schema.String.check(Schema.isPattern(/^(?!.*\.\.)(?!.*--x-s3$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/u)),
+	region: Schema.String.check(Schema.isPattern(/^[a-z0-9-]+$/u)),
+	storeId: Schema.optional(Schema.NonEmptyString),
+	endpoint: Schema.optional(Schema.String),
+	forcePathStyle: Schema.optional(Schema.Boolean),
+	credentials: Schema.optional(Schema.Unknown),
+	expectedBucketOwner: Schema.optional(Schema.String.check(Schema.isPattern(/^\d{12}$/u))),
+	requestPayer: Schema.optional(Schema.Literal("requester")),
+	encryption: Schema.optional(Schema.Union([
+		Schema.Struct({ mode: Schema.Literal("AES256") }),
+		Schema.Struct({
+			mode: Schema.Literals(["aws:kms", "aws:kms:dsse"]),
+			keyId: Schema.optional(ObjectValidator),
+			bucketKey: Schema.optional(Schema.Boolean)
+		}),
+		Schema.Struct({
+			mode: Schema.Literal("customer"),
+			key: Schema.Redacted(Schema.NonEmptyString),
+			keyMD5: ObjectValidator
+		})
+	])),
+	requestTimeoutMillis: Schema.optional(Positive),
+	maxUnknownLengthBytes: Schema.optional(Positive)
+});
+const resolveConfig = Effect.fnUntraced(function* (config) {
+	yield* Schema.decodeUnknownEffect(Settings, { onExcessProperty: "error" })(config).pipe(Effect.mapError(() => storageError("make", "s3", {
+		_tag: "InvalidConfiguration",
+		field: "config"
+	})));
+	if (config.endpoint !== void 0) {
+		const url = URL.parse(config.endpoint);
+		if (!url || !["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") return yield* storageError("make", "s3", {
+			_tag: "InvalidConfiguration",
+			field: "endpoint"
+		});
+	}
+	if (config.encryption?.mode === "customer" && config.endpoint?.startsWith("http:")) return yield* storageError("make", "s3", {
+		_tag: "InvalidConfiguration",
+		field: "encryption.endpoint"
+	});
+	const identity = JSON.stringify([
+		config.endpoint ?? "aws",
+		config.region,
+		config.bucket
+	]);
+	return {
+		...config,
+		...config.encryption ? { encryption: { ...config.encryption } } : {},
+		storeId: config.storeId ?? `s3:${createHash("sha256").update(identity).digest("hex")}`,
+		requestTimeoutMillis: config.requestTimeoutMillis ?? 3e4,
+		maxUnknownLengthBytes: config.maxUnknownLengthBytes ?? 16777216
+	};
+});
+function encryptionHeaders(encryption) {
+	if (!encryption) return {};
+	if (encryption.mode === "customer") return {
+		SSECustomerAlgorithm: "AES256",
+		SSECustomerKey: Redacted.value(encryption.key),
+		SSECustomerKeyMD5: encryption.keyMD5
+	};
+	return {
+		ServerSideEncryption: encryption.mode,
+		...encryption.mode === "AES256" ? {} : {
+			SSEKMSKeyId: encryption.keyId,
+			BucketKeyEnabled: encryption.bucketKey
+		}
+	};
+}
+function readEncryption(encryption) {
+	return encryption?.mode === "customer" ? encryptionHeaders(encryption) : {};
+}
+function authority(config) {
+	return {
+		Bucket: config.bucket,
+		ExpectedBucketOwner: config.expectedBucketOwner,
+		RequestPayer: config.requestPayer
+	};
+}
+
+export { authority, encryptionHeaders, readEncryption, resolveConfig };
+//# sourceMappingURL=config.js.map

package/dist/providers/s3/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","names":[],"sources":["../../../src/providers/s3/config.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport { Effect, Redacted, Schema } from \"effect\";\n\nimport type { S3Client, S3ClientConfig } from \"@aws-sdk/client-s3\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport { ObjectValidator } from \"../../core/object.js\";\nimport type { S3Profile } from \"./profile.js\";\n\nexport type S3Encryption =\n  | { readonly mode: \"AES256\" }\n  | {\n      readonly mode: \"aws:kms\" | \"aws:kms:dsse\";\n      readonly keyId?: string;\n      readonly bucketKey?: boolean;\n    }\n  | { readonly mode: \"customer\"; readonly key: Redacted.Redacted<string>; readonly keyMD5: string };\n\nexport interface S3Config {\n  readonly bucket: string;\n  readonly region: string;\n  readonly storeId?: string;\n  readonly endpoint?: string;\n  readonly forcePathStyle?: boolean;\n  readonly credentials?: S3ClientConfig[\"credentials\"];\n  readonly expectedBucketOwner?: string;\n  readonly requestPayer?: \"requester\";\n  readonly encryption?: S3Encryption;\n  readonly requestTimeoutMillis?: number;\n  /** Unknown-length streams are staged up to this explicit adapter limit. */\n  readonly maxUnknownLengthBytes?: number;\n}\n\nconst Positive = Schema.Int.check(Schema.isGreaterThan(0));\nconst Settings = Schema.Struct({\n  bucket: Schema.String.check(\n    Schema.isPattern(/^(?!.*\\.\\.)(?!.*--x-s3$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/u),\n  ),\n  region: Schema.String.check(Schema.isPattern(/^[a-z0-9-]+$/u)),\n  storeId: Schema.optional(Schema.NonEmptyString),\n  endpoint: Schema.optional(Schema.String),\n  forcePathStyle: Schema.optional(Schema.Boolean),\n  credentials: Schema.optional(Schema.Unknown),\n  expectedBucketOwner: Schema.optional(Schema.String.check(Schema.isPattern(/^\\d{12}$/u))),\n  requestPayer: Schema.optional(Schema.Literal(\"requester\")),\n  encryption: Schema.optional(\n    Schema.Union([\n      Schema.Struct({ mode: Schema.Literal(\"AES256\") }),\n      Schema.Struct({\n        mode: Schema.Literals([\"aws:kms\", \"aws:kms:dsse\"]),\n        keyId: Schema.optional(ObjectValidator),\n        bucketKey: Schema.optional(Schema.Boolean),\n      }),\n      Schema.Struct({\n        mode: Schema.Literal(\"customer\"),\n        key: Schema.Redacted(Schema.NonEmptyString),\n        keyMD5: ObjectValidator,\n      }),\n    ]),\n  ),\n  requestTimeoutMillis: Schema.optional(Positive),\n  maxUnknownLengthBytes: Schema.optional(Positive),\n});\n\nexport type ResolvedS3Config = Omit<\n  S3Config,\n  \"storeId\" | \"requestTimeoutMillis\" | \"maxUnknownLengthBytes\"\n> & {\n  readonly storeId: string;\n  readonly requestTimeoutMillis: number;\n  readonly maxUnknownLengthBytes: number;\n};\n\nexport interface S3Connection {\n  readonly profile?: S3Profile;\n  /** Compatibility transports may lack the optional S3 checksum read extension. */\n  readonly readChecksums?: false;\n  readonly multipartChecksums?: false;\n  readonly client: S3Client;\n  readonly config: ResolvedS3Config;\n}\n\nexport const resolveConfig = Effect.fnUntraced(function* (config: S3Config) {\n  yield* Schema.decodeUnknownEffect(Settings, { onExcessProperty: \"error\" })(config).pipe(\n    Effect.mapError(() =>\n      storageError(\"make\", \"s3\", { _tag: \"InvalidConfiguration\", field: \"config\" }),\n    ),\n  );\n\n  if (config.endpoint !== undefined) {\n    const url = URL.parse(config.endpoint);\n    if (\n      !url ||\n      ![\"https:\", \"http:\"].includes(url.protocol) ||\n      url.username ||\n      url.password ||\n      url.search ||\n      url.hash ||\n      url.pathname !== \"/\"\n    ) {\n      return yield* storageError(\"make\", \"s3\", { _tag: \"InvalidConfiguration\", field: \"endpoint\" });\n    }\n  }\n\n  if (config.encryption?.mode === \"customer\" && config.endpoint?.startsWith(\"http:\"))\n    return yield* storageError(\"make\", \"s3\", {\n      _tag: \"InvalidConfiguration\",\n      field: \"encryption.endpoint\",\n    });\n  const identity = JSON.stringify([config.endpoint ?? \"aws\", config.region, config.bucket]);\n  return {\n    ...config,\n    ...(config.encryption ? { encryption: { ...config.encryption } } : {}),\n    storeId: config.storeId ?? `s3:${createHash(\"sha256\").update(identity).digest(\"hex\")}`,\n    requestTimeoutMillis: config.requestTimeoutMillis ?? 30_000,\n    maxUnknownLengthBytes: config.maxUnknownLengthBytes ?? 16 * 1024 * 1024,\n  } satisfies ResolvedS3Config;\n});\n\nexport function encryptionHeaders(encryption?: S3Encryption) {\n  if (!encryption) return {};\n  if (encryption.mode === \"customer\") {\n    return {\n      SSECustomerAlgorithm: \"AES256\",\n      SSECustomerKey: Redacted.value(encryption.key),\n      SSECustomerKeyMD5: encryption.keyMD5,\n    };\n  }\n  return {\n    ServerSideEncryption: encryption.mode,\n    ...(encryption.mode === \"AES256\"\n      ? {}\n      : { SSEKMSKeyId: encryption.keyId, BucketKeyEnabled: encryption.bucketKey }),\n  };\n}\n\nexport function readEncryption(encryption?: S3Encryption) {\n  return encryption?.mode === \"customer\" ? encryptionHeaders(encryption) : {};\n}\n\nexport function authority(config: ResolvedS3Config) {\n  return {\n    Bucket: config.bucket,\n    ExpectedBucketOwner: config.expectedBucketOwner,\n    RequestPayer: config.requestPayer,\n  };\n}\n"],"mappings":";;;;;;AAkCA,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACzD,MAAM,WAAW,OAAO,OAAO;CAC7B,QAAQ,OAAO,OAAO,MACpB,OAAO,UAAU,4DAA4D,CAC/E;CACA,QAAQ,OAAO,OAAO,MAAM,OAAO,UAAU,eAAe,CAAC;CAC7D,SAAS,OAAO,SAAS,OAAO,cAAc;CAC9C,UAAU,OAAO,SAAS,OAAO,MAAM;CACvC,gBAAgB,OAAO,SAAS,OAAO,OAAO;CAC9C,aAAa,OAAO,SAAS,OAAO,OAAO;CAC3C,qBAAqB,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,WAAW,CAAC,CAAC;CACvF,cAAc,OAAO,SAAS,OAAO,QAAQ,WAAW,CAAC;CACzD,YAAY,OAAO,SACjB,OAAO,MAAM;EACX,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,QAAQ,EAAE,CAAC;EAChD,OAAO,OAAO;GACZ,MAAM,OAAO,SAAS,CAAC,WAAW,cAAc,CAAC;GACjD,OAAO,OAAO,SAAS,eAAe;GACtC,WAAW,OAAO,SAAS,OAAO,OAAO;EAC3C,CAAC;EACD,OAAO,OAAO;GACZ,MAAM,OAAO,QAAQ,UAAU;GAC/B,KAAK,OAAO,SAAS,OAAO,cAAc;GAC1C,QAAQ;EACV,CAAC;CACH,CAAC,CACH;CACA,sBAAsB,OAAO,SAAS,QAAQ;CAC9C,uBAAuB,OAAO,SAAS,QAAQ;AACjD,CAAC;AAoBD,MAAa,gBAAgB,OAAO,WAAW,WAAW,QAAkB;CAC1E,OAAO,OAAO,oBAAoB,UAAU,EAAE,kBAAkB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KACjF,OAAO,eACL,aAAa,QAAQ,MAAM;EAAE,MAAM;EAAwB,OAAO;CAAS,CAAC,CAC9E,CACF;CAEA,IAAI,OAAO,aAAa,QAAW;EACjC,MAAM,MAAM,IAAI,MAAM,OAAO,QAAQ;EACrC,IACE,CAAC,OACD,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,IAAI,aAAa,KAEjB,OAAO,OAAO,aAAa,QAAQ,MAAM;GAAE,MAAM;GAAwB,OAAO;EAAW,CAAC;CAEhG;CAEA,IAAI,OAAO,YAAY,SAAS,cAAc,OAAO,UAAU,WAAW,OAAO,GAC/E,OAAO,OAAO,aAAa,QAAQ,MAAM;EACvC,MAAM;EACN,OAAO;CACT,CAAC;CACH,MAAM,WAAW,KAAK,UAAU;EAAC,OAAO,YAAY;EAAO,OAAO;EAAQ,OAAO;CAAM,CAAC;CACxF,OAAO;EACL,GAAG;EACH,GAAI,OAAO,aAAa,EAAE,YAAY,EAAE,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC;EACpE,SAAS,OAAO,WAAW,MAAM,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK;EACnF,sBAAsB,OAAO,wBAAwB;EACrD,uBAAuB,OAAO,yBAAyB;CACzD;AACF,CAAC;AAED,SAAgB,kBAAkB,YAA2B;CAC3D,IAAI,CAAC,YAAY,OAAO,CAAC;CACzB,IAAI,WAAW,SAAS,YACtB,OAAO;EACL,sBAAsB;EACtB,gBAAgB,SAAS,MAAM,WAAW,GAAG;EAC7C,mBAAmB,WAAW;CAChC;CAEF,OAAO;EACL,sBAAsB,WAAW;EACjC,GAAI,WAAW,SAAS,WACpB,CAAC,IACD;GAAE,aAAa,WAAW;GAAO,kBAAkB,WAAW;EAAU;CAC9E;AACF;AAEA,SAAgB,eAAe,YAA2B;CACxD,OAAO,YAAY,SAAS,aAAa,kBAAkB,UAAU,IAAI,CAAC;AAC5E;AAEA,SAAgB,UAAU,QAA0B;CAClD,OAAO;EACL,QAAQ,OAAO;EACf,qBAAqB,OAAO;EAC5B,cAAc,OAAO;CACvB;AACF"}

package/dist/providers/s3/copy.d.ts

@@ -0,0 +1,115 @@
+import { ObjectRef } from "../../core/object.js";
+import { StorageError } from "../../core/errors.js";
+import { ByteRange } from "../../core/ranges.js";
+import { MultipartHandle } from "../../core/contracts/multipart.js";
+import "../../index.js";
+import { S3Connection } from "./config.js";
+import { Effect } from "effect";
+export declare const copyObject: (connection: S3Connection, input: {
+  readonly source: {
+    readonly storeId: string;
+    readonly key: string;
+    readonly version?: {
+      readonly _tag: "S3Version";
+      readonly id: string;
+    } | {
+      readonly _tag: "GcsGeneration";
+      readonly id: string;
+      readonly metageneration?: string | undefined;
+    } | {
+      readonly _tag: "AzureVersion";
+      readonly id: string;
+    } | {
+      readonly _tag: "AzureSnapshot";
+      readonly id: string;
+    } | {
+      readonly _tag: "OpaqueVersion";
+      readonly provider: string;
+      readonly id: string;
+    } | undefined;
+  };
+  readonly destinationKey: string;
+  readonly condition?: {
+    readonly _tag: "CreateOnly";
+  } | {
+    readonly _tag: "IfMatch";
+    readonly etag: string;
+  } | undefined;
+  readonly sourceIfMatch?: string | undefined;
+  readonly headers?: {
+    readonly contentType?: string | undefined;
+    readonly contentEncoding?: string | undefined;
+    readonly contentLanguage?: string | undefined;
+    readonly contentDisposition?: string | undefined;
+    readonly cacheControl?: string | undefined;
+    readonly customMetadata?: {
+      readonly [x: string]: string;
+    } | undefined;
+  } | undefined;
+  readonly metadataDirective?: "COPY" | "REPLACE" | undefined;
+  readonly taggingDirective?: "COPY" | "REPLACE" | undefined;
+  readonly tagging?: string | undefined;
+}, source?: S3Connection | undefined) => Effect.Effect<{
+  readonly contentType?: string | undefined;
+  readonly contentEncoding?: string | undefined;
+  readonly contentLanguage?: string | undefined;
+  readonly contentDisposition?: string | undefined;
+  readonly cacheControl?: string | undefined;
+  readonly customMetadata?: {
+    readonly [x: string]: string;
+  } | undefined;
+  readonly ref: {
+    readonly storeId: string;
+    readonly key: string;
+    readonly version?: {
+      readonly _tag: "S3Version";
+      readonly id: string;
+    } | {
+      readonly _tag: "GcsGeneration";
+      readonly id: string;
+      readonly metageneration?: string | undefined;
+    } | {
+      readonly _tag: "AzureVersion";
+      readonly id: string;
+    } | {
+      readonly _tag: "AzureSnapshot";
+      readonly id: string;
+    } | {
+      readonly _tag: "OpaqueVersion";
+      readonly provider: string;
+      readonly id: string;
+    } | undefined;
+  };
+  readonly size?: number | undefined;
+  readonly etag?: string | undefined;
+  readonly lastModified?: import("effect/DateTime").Utc | undefined;
+  readonly checksums?: readonly {
+    readonly algorithm: string;
+    readonly encoding: "base64" | "hex";
+    readonly scope: "composite" | "full-object";
+    readonly value: string;
+    readonly partCount?: number | undefined;
+  }[] | undefined;
+  readonly storageClass?: string | undefined;
+}, StorageError, never>;
+export interface S3CopyPartRequest {
+  readonly upload: MultipartHandle;
+  readonly partNumber: number;
+  readonly source: ObjectRef;
+  readonly sourceIfMatch?: string | undefined;
+  readonly range?: Extract<ByteRange, {
+    readonly _tag: "Bounded";
+  }>;
+}
+export declare const copyPart: (connection: S3Connection, input: S3CopyPartRequest, source?: S3Connection | undefined) => Effect.Effect<{
+  partNumber: number;
+  etag: string;
+  checksums: readonly {
+    readonly algorithm: string;
+    readonly encoding: "base64" | "hex";
+    readonly scope: "composite" | "full-object";
+    readonly value: string;
+    readonly partCount?: number | undefined;
+  }[] | undefined;
+}, StorageError, never>;
+//# sourceMappingURL=copy.d.ts.map

package/dist/providers/s3/copy.js

@@ -0,0 +1,122 @@
+import { storageError } from "../../core/errors.js";
+import { decodeRequest } from "../../internal/request-validation.js";
+import { authority, encryptionHeaders } from "./config.js";
+import { validateHeaders } from "./validation.js";
+import { checksums, condition, encodeCopySource, headers, metadata, validateRef } from "./object-mapping.js";
+import { enforceProfile } from "./profile.js";
+import { request } from "./transport.js";
+import { CopyRequest, PartNumber, Upload } from "./native-models.js";
+import { Effect, Redacted, Schema } from "effect";
+import { CopyObjectCommand, UploadPartCopyCommand } from "@aws-sdk/client-s3";
+
+// src/providers/s3/copy.ts
+function sourceEncryption(connection) {
+	const encryption = connection.config.encryption;
+	return encryption?.mode === "customer" ? {
+		CopySourceSSECustomerAlgorithm: "AES256",
+		CopySourceSSECustomerKey: Redacted.value(encryption.key),
+		CopySourceSSECustomerKeyMD5: encryption.keyMD5
+	} : {};
+}
+const copyObject = Effect.fnUntraced(function* (connection, input, source = connection) {
+	if (connection.config.endpoint !== source.config.endpoint) return yield* storageError("copy", "s3", {
+		_tag: "Unsupported",
+		capability: "cross-endpoint-copy"
+	}, "not-started");
+	const value = yield* decodeRequest(CopyRequest, input, "copy", "s3", true);
+	yield* enforceProfile(connection, "copy", value);
+	const profile = connection.profile;
+	if (profile && (profile.copy === "none" || profile.copy === "bucket" && (connection.config.bucket !== source.config.bucket || connection.config.encryption?.mode === "customer" || source.config.encryption?.mode === "customer"))) return yield* storageError("copy", profile.provider, {
+		_tag: "Unsupported",
+		capability: "native-copy-profile"
+	}, "not-started");
+	yield* validateRef(value.source, source.config, "copy");
+	if (value.headers) yield* validateHeaders(value.headers, "copy");
+	if (value.headers && value.metadataDirective !== "REPLACE") return yield* storageError("copy", "s3", {
+		_tag: "InvalidInput",
+		field: "metadataDirective"
+	}, "not-started");
+	if (value.tagging && value.taggingDirective !== "REPLACE") return yield* storageError("copy", "s3", {
+		_tag: "InvalidInput",
+		field: "taggingDirective"
+	}, "not-started");
+	const output = yield* request(connection, "copy", true, (signal) => connection.client.send(new CopyObjectCommand({
+		...authority(connection.config),
+		...encryptionHeaders(connection.config.encryption),
+		...sourceEncryption(source),
+		...condition(value.condition),
+		...headers(value.headers ?? {}),
+		Key: value.destinationKey,
+		ExpectedSourceBucketOwner: source.config.expectedBucketOwner,
+		CopySource: encodeCopySource(source.config.bucket, value.source),
+		CopySourceIfMatch: value.sourceIfMatch,
+		MetadataDirective: value.metadataDirective,
+		TaggingDirective: value.taggingDirective,
+		Tagging: value.tagging
+	}), { abortSignal: signal }));
+	if (!output.CopyObjectResult?.ETag) return yield* storageError("copy", "s3", {
+		_tag: "ProviderFailure",
+		code: "MissingCopyReceipt"
+	}, "unknown");
+	return metadata(connection, value.destinationKey, {
+		...output,
+		...output.CopyObjectResult
+	});
+});
+const CopyPartRequest = Schema.Struct({
+	upload: Upload,
+	partNumber: PartNumber,
+	source: CopyRequest.fields.source,
+	sourceIfMatch: CopyRequest.fields.sourceIfMatch,
+	range: Schema.optional(Schema.TaggedStruct("Bounded", {
+		start: Schema.Natural,
+		end: Schema.Natural
+	}))
+});
+const copyPart = Effect.fnUntraced(function* (connection, input, source = connection) {
+	if (connection.config.endpoint !== source.config.endpoint) return yield* storageError("copyPart", "s3", {
+		_tag: "Unsupported",
+		capability: "cross-endpoint-copy"
+	}, "not-started");
+	const value = yield* decodeRequest(CopyPartRequest, input, "copyPart", "s3", true);
+	yield* enforceProfile(connection, "copyPart", value);
+	const profile = connection.profile;
+	if (profile && (profile.copy === "none" || profile.copy === "bucket" && (connection.config.bucket !== source.config.bucket || connection.config.encryption?.mode === "customer" || source.config.encryption?.mode === "customer") || value.sourceIfMatch && !profile.copyPartConditions)) return yield* storageError("copyPart", profile.provider, {
+		_tag: "Unsupported",
+		capability: "native-copy-profile"
+	}, "not-started");
+	yield* validateRef(value.upload.ref, connection.config, "copyPart");
+	if (value.upload.ref.version) return yield* storageError("copyPart", "s3", {
+		_tag: "InvalidInput",
+		field: "upload.ref.version"
+	}, "not-started");
+	yield* validateRef(value.source, source.config, "copyPart");
+	if (value.range && value.range.end < value.range.start) return yield* storageError("copyPart", "s3", {
+		_tag: "InvalidInput",
+		field: "range"
+	}, "not-started");
+	const output = yield* request(connection, "copyPart", true, (signal) => connection.client.send(new UploadPartCopyCommand({
+		...authority(connection.config),
+		...sourceEncryption(source),
+		...encryptionHeaders(connection.config.encryption),
+		Key: value.upload.ref.key,
+		UploadId: Redacted.value(value.upload.uploadId),
+		PartNumber: value.partNumber,
+		ExpectedSourceBucketOwner: source.config.expectedBucketOwner,
+		CopySource: encodeCopySource(source.config.bucket, value.source),
+		CopySourceIfMatch: value.sourceIfMatch,
+		CopySourceRange: value.range ? `bytes=${String(value.range.start)}-${String(value.range.end)}` : void 0
+	}), { abortSignal: signal }));
+	if (!output.CopyPartResult?.ETag) return yield* storageError("copyPart", "s3", {
+		_tag: "ProviderFailure",
+		code: "MissingPartReceipt"
+	}, "unknown");
+	return {
+		partNumber: value.partNumber,
+		etag: output.CopyPartResult.ETag,
+		checksums: checksums(output.CopyPartResult)
+	};
+});
+
+export { copyObject, copyPart };
+//# sourceMappingURL=copy.js.map

package/dist/providers/s3/copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js","names":[],"sources":["../../../src/providers/s3/copy.ts"],"sourcesContent":["import { Effect, Redacted, Schema } from \"effect\";\n\nimport { CopyObjectCommand, UploadPartCopyCommand } from \"@aws-sdk/client-s3\";\n\nimport type { MultipartHandle } from \"../../core/contracts/multipart.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport type { ObjectRef } from \"../../core/object.js\";\nimport type { ByteRange } from \"../../core/ranges.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { authority, encryptionHeaders } from \"./config.js\";\nimport type { S3Connection } from \"./config.js\";\nimport { CopyRequest, PartNumber, Upload } from \"./native-models.js\";\nimport type { S3CopyRequest } from \"./native-models.js\";\nimport {\n  checksums,\n  condition,\n  encodeCopySource,\n  headers,\n  metadata,\n  validateRef,\n} from \"./object-mapping.js\";\nimport { enforceProfile } from \"./profile.js\";\nimport { request } from \"./transport.js\";\nimport { validateHeaders } from \"./validation.js\";\n\nfunction sourceEncryption(connection: S3Connection) {\n  const encryption = connection.config.encryption;\n  return encryption?.mode === \"customer\"\n    ? {\n        CopySourceSSECustomerAlgorithm: \"AES256\",\n        CopySourceSSECustomerKey: Redacted.value(encryption.key),\n        CopySourceSSECustomerKeyMD5: encryption.keyMD5,\n      }\n    : {};\n}\n\nexport const copyObject = Effect.fnUntraced(function* (\n  connection: S3Connection,\n  input: S3CopyRequest,\n  source: S3Connection = connection,\n) {\n  if (connection.config.endpoint !== source.config.endpoint)\n    return yield* storageError(\n      \"copy\",\n      \"s3\",\n      { _tag: \"Unsupported\", capability: \"cross-endpoint-copy\" },\n      \"not-started\",\n    );\n  const value = yield* decodeRequest(CopyRequest, input, \"copy\", \"s3\", true);\n  yield* enforceProfile(connection, \"copy\", value);\n  const profile = connection.profile;\n  if (\n    profile &&\n    (profile.copy === \"none\" ||\n      (profile.copy === \"bucket\" &&\n        (connection.config.bucket !== source.config.bucket ||\n          connection.config.encryption?.mode === \"customer\" ||\n          source.config.encryption?.mode === \"customer\")))\n  )\n    return yield* storageError(\n      \"copy\",\n      profile.provider,\n      { _tag: \"Unsupported\", capability: \"native-copy-profile\" },\n      \"not-started\",\n    );\n  yield* validateRef(value.source, source.config, \"copy\");\n  if (value.headers) yield* validateHeaders(value.headers, \"copy\");\n  if (value.headers && value.metadataDirective !== \"REPLACE\")\n    return yield* storageError(\n      \"copy\",\n      \"s3\",\n      { _tag: \"InvalidInput\", field: \"metadataDirective\" },\n      \"not-started\",\n    );\n  if (value.tagging && value.taggingDirective !== \"REPLACE\")\n    return yield* storageError(\n      \"copy\",\n      \"s3\",\n      { _tag: \"InvalidInput\", field: \"taggingDirective\" },\n      \"not-started\",\n    );\n\n  const output = yield* request(connection, \"copy\", true, (signal) =>\n    connection.client.send(\n      new CopyObjectCommand({\n        ...authority(connection.config),\n        ...encryptionHeaders(connection.config.encryption),\n        ...sourceEncryption(source),\n        ...condition(value.condition),\n        ...headers(value.headers ?? {}),\n        Key: value.destinationKey,\n        ExpectedSourceBucketOwner: source.config.expectedBucketOwner,\n        CopySource: encodeCopySource(source.config.bucket, value.source),\n        CopySourceIfMatch: value.sourceIfMatch,\n        MetadataDirective: value.metadataDirective,\n        TaggingDirective: value.taggingDirective,\n        Tagging: value.tagging,\n      }),\n      { abortSignal: signal },\n    ),\n  );\n  if (!output.CopyObjectResult?.ETag)\n    return yield* storageError(\n      \"copy\",\n      \"s3\",\n      { _tag: \"ProviderFailure\", code: \"MissingCopyReceipt\" },\n      \"unknown\",\n    );\n  return metadata(connection, value.destinationKey, {\n    ...output,\n    ...output.CopyObjectResult,\n  });\n});\n\nexport interface S3CopyPartRequest {\n  readonly upload: MultipartHandle;\n  readonly partNumber: number;\n  readonly source: ObjectRef;\n  readonly sourceIfMatch?: string | undefined;\n  readonly range?: Extract<ByteRange, { readonly _tag: \"Bounded\" }>;\n}\n\nconst CopyPartRequest = Schema.Struct({\n  upload: Upload,\n  partNumber: PartNumber,\n  source: CopyRequest.fields.source,\n  sourceIfMatch: CopyRequest.fields.sourceIfMatch,\n  range: Schema.optional(\n    Schema.TaggedStruct(\"Bounded\", { start: Schema.Natural, end: Schema.Natural }),\n  ),\n});\n\nexport const copyPart = Effect.fnUntraced(function* (\n  connection: S3Connection,\n  input: S3CopyPartRequest,\n  source: S3Connection = connection,\n) {\n  if (connection.config.endpoint !== source.config.endpoint)\n    return yield* storageError(\n      \"copyPart\",\n      \"s3\",\n      { _tag: \"Unsupported\", capability: \"cross-endpoint-copy\" },\n      \"not-started\",\n    );\n  const value = yield* decodeRequest(CopyPartRequest, input, \"copyPart\", \"s3\", true);\n  yield* enforceProfile(connection, \"copyPart\", value);\n  const profile = connection.profile;\n  if (\n    profile &&\n    (profile.copy === \"none\" ||\n      (profile.copy === \"bucket\" &&\n        (connection.config.bucket !== source.config.bucket ||\n          connection.config.encryption?.mode === \"customer\" ||\n          source.config.encryption?.mode === \"customer\")) ||\n      (value.sourceIfMatch && !profile.copyPartConditions))\n  )\n    return yield* storageError(\n      \"copyPart\",\n      profile.provider,\n      { _tag: \"Unsupported\", capability: \"native-copy-profile\" },\n      \"not-started\",\n    );\n  yield* validateRef(value.upload.ref, connection.config, \"copyPart\");\n  if (value.upload.ref.version)\n    return yield* storageError(\n      \"copyPart\",\n      \"s3\",\n      { _tag: \"InvalidInput\", field: \"upload.ref.version\" },\n      \"not-started\",\n    );\n  yield* validateRef(value.source, source.config, \"copyPart\");\n  if (value.range && value.range.end < value.range.start)\n    return yield* storageError(\n      \"copyPart\",\n      \"s3\",\n      { _tag: \"InvalidInput\", field: \"range\" },\n      \"not-started\",\n    );\n\n  const output = yield* request(connection, \"copyPart\", true, (signal) =>\n    connection.client.send(\n      new UploadPartCopyCommand({\n        ...authority(connection.config),\n        ...sourceEncryption(source),\n        ...encryptionHeaders(connection.config.encryption),\n        Key: value.upload.ref.key,\n        UploadId: Redacted.value(value.upload.uploadId),\n        PartNumber: value.partNumber,\n        ExpectedSourceBucketOwner: source.config.expectedBucketOwner,\n        CopySource: encodeCopySource(source.config.bucket, value.source),\n        CopySourceIfMatch: value.sourceIfMatch,\n        CopySourceRange: value.range\n          ? `bytes=${String(value.range.start)}-${String(value.range.end)}`\n          : undefined,\n      }),\n      { abortSignal: signal },\n    ),\n  );\n  if (!output.CopyPartResult?.ETag)\n    return yield* storageError(\n      \"copyPart\",\n      \"s3\",\n      { _tag: \"ProviderFailure\", code: \"MissingPartReceipt\" },\n      \"unknown\",\n    );\n  return {\n    partNumber: value.partNumber,\n    etag: output.CopyPartResult.ETag,\n    checksums: checksums(output.CopyPartResult),\n  };\n});\n"],"mappings":";;;;;;;;;;;;AAyBA,SAAS,iBAAiB,YAA0B;CAClD,MAAM,aAAa,WAAW,OAAO;CACrC,OAAO,YAAY,SAAS,aACxB;EACE,gCAAgC;EAChC,0BAA0B,SAAS,MAAM,WAAW,GAAG;EACvD,6BAA6B,WAAW;CAC1C,IACA,CAAC;AACP;AAEA,MAAa,aAAa,OAAO,WAAW,WAC1C,YACA,OACA,SAAuB,YACvB;CACA,IAAI,WAAW,OAAO,aAAa,OAAO,OAAO,UAC/C,OAAO,OAAO,aACZ,QACA,MACA;EAAE,MAAM;EAAe,YAAY;CAAsB,GACzD,aACF;CACF,MAAM,QAAQ,OAAO,cAAc,aAAa,OAAO,QAAQ,MAAM,IAAI;CACzE,OAAO,eAAe,YAAY,QAAQ,KAAK;CAC/C,MAAM,UAAU,WAAW;CAC3B,IACE,YACC,QAAQ,SAAS,UACf,QAAQ,SAAS,aACf,WAAW,OAAO,WAAW,OAAO,OAAO,UAC1C,WAAW,OAAO,YAAY,SAAS,cACvC,OAAO,OAAO,YAAY,SAAS,cAEzC,OAAO,OAAO,aACZ,QACA,QAAQ,UACR;EAAE,MAAM;EAAe,YAAY;CAAsB,GACzD,aACF;CACF,OAAO,YAAY,MAAM,QAAQ,OAAO,QAAQ,MAAM;CACtD,IAAI,MAAM,SAAS,OAAO,gBAAgB,MAAM,SAAS,MAAM;CAC/D,IAAI,MAAM,WAAW,MAAM,sBAAsB,WAC/C,OAAO,OAAO,aACZ,QACA,MACA;EAAE,MAAM;EAAgB,OAAO;CAAoB,GACnD,aACF;CACF,IAAI,MAAM,WAAW,MAAM,qBAAqB,WAC9C,OAAO,OAAO,aACZ,QACA,MACA;EAAE,MAAM;EAAgB,OAAO;CAAmB,GAClD,aACF;CAEF,MAAM,SAAS,OAAO,QAAQ,YAAY,QAAQ,OAAO,WACvD,WAAW,OAAO,KAChB,IAAI,kBAAkB;EACpB,GAAG,UAAU,WAAW,MAAM;EAC9B,GAAG,kBAAkB,WAAW,OAAO,UAAU;EACjD,GAAG,iBAAiB,MAAM;EAC1B,GAAG,UAAU,MAAM,SAAS;EAC5B,GAAG,QAAQ,MAAM,WAAW,CAAC,CAAC;EAC9B,KAAK,MAAM;EACX,2BAA2B,OAAO,OAAO;EACzC,YAAY,iBAAiB,OAAO,OAAO,QAAQ,MAAM,MAAM;EAC/D,mBAAmB,MAAM;EACzB,mBAAmB,MAAM;EACzB,kBAAkB,MAAM;EACxB,SAAS,MAAM;CACjB,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;CACA,IAAI,CAAC,OAAO,kBAAkB,MAC5B,OAAO,OAAO,aACZ,QACA,MACA;EAAE,MAAM;EAAmB,MAAM;CAAqB,GACtD,SACF;CACF,OAAO,SAAS,YAAY,MAAM,gBAAgB;EAChD,GAAG;EACH,GAAG,OAAO;CACZ,CAAC;AACH,CAAC;AAUD,MAAM,kBAAkB,OAAO,OAAO;CACpC,QAAQ;CACR,YAAY;CACZ,QAAQ,YAAY,OAAO;CAC3B,eAAe,YAAY,OAAO;CAClC,OAAO,OAAO,SACZ,OAAO,aAAa,WAAW;EAAE,OAAO,OAAO;EAAS,KAAK,OAAO;CAAQ,CAAC,CAC/E;AACF,CAAC;AAED,MAAa,WAAW,OAAO,WAAW,WACxC,YACA,OACA,SAAuB,YACvB;CACA,IAAI,WAAW,OAAO,aAAa,OAAO,OAAO,UAC/C,OAAO,OAAO,aACZ,YACA,MACA;EAAE,MAAM;EAAe,YAAY;CAAsB,GACzD,aACF;CACF,MAAM,QAAQ,OAAO,cAAc,iBAAiB,OAAO,YAAY,MAAM,IAAI;CACjF,OAAO,eAAe,YAAY,YAAY,KAAK;CACnD,MAAM,UAAU,WAAW;CAC3B,IACE,YACC,QAAQ,SAAS,UACf,QAAQ,SAAS,aACf,WAAW,OAAO,WAAW,OAAO,OAAO,UAC1C,WAAW,OAAO,YAAY,SAAS,cACvC,OAAO,OAAO,YAAY,SAAS,eACtC,MAAM,iBAAiB,CAAC,QAAQ,qBAEnC,OAAO,OAAO,aACZ,YACA,QAAQ,UACR;EAAE,MAAM;EAAe,YAAY;CAAsB,GACzD,aACF;CACF,OAAO,YAAY,MAAM,OAAO,KAAK,WAAW,QAAQ,UAAU;CAClE,IAAI,MAAM,OAAO,IAAI,SACnB,OAAO,OAAO,aACZ,YACA,MACA;EAAE,MAAM;EAAgB,OAAO;CAAqB,GACpD,aACF;CACF,OAAO,YAAY,MAAM,QAAQ,OAAO,QAAQ,UAAU;CAC1D,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM,MAAM,OAC/C,OAAO,OAAO,aACZ,YACA,MACA;EAAE,MAAM;EAAgB,OAAO;CAAQ,GACvC,aACF;CAEF,MAAM,SAAS,OAAO,QAAQ,YAAY,YAAY,OAAO,WAC3D,WAAW,OAAO,KAChB,IAAI,sBAAsB;EACxB,GAAG,UAAU,WAAW,MAAM;EAC9B,GAAG,iBAAiB,MAAM;EAC1B,GAAG,kBAAkB,WAAW,OAAO,UAAU;EACjD,KAAK,MAAM,OAAO,IAAI;EACtB,UAAU,SAAS,MAAM,MAAM,OAAO,QAAQ;EAC9C,YAAY,MAAM;EAClB,2BAA2B,OAAO,OAAO;EACzC,YAAY,iBAAiB,OAAO,OAAO,QAAQ,MAAM,MAAM;EAC/D,mBAAmB,MAAM;EACzB,iBAAiB,MAAM,QACnB,SAAS,OAAO,MAAM,MAAM,KAAK,EAAE,GAAG,OAAO,MAAM,MAAM,GAAG,MAC5D;CACN,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;CACA,IAAI,CAAC,OAAO,gBAAgB,MAC1B,OAAO,OAAO,aACZ,YACA,MACA;EAAE,MAAM;EAAmB,MAAM;CAAqB,GACtD,SACF;CACF,OAAO;EACL,YAAY,MAAM;EAClB,MAAM,OAAO,eAAe;EAC5B,WAAW,UAAU,OAAO,cAAc;CAC5C;AACF,CAAC"}

package/dist/providers/s3/lifecycle-validation.js

@@ -0,0 +1,33 @@
+import { storageError } from "../../core/errors.js";
+import { validateRef } from "./object-mapping.js";
+import { Effect } from "effect";
+
+// src/providers/s3/lifecycle-validation.ts
+const lifecycleTarget = Effect.fnUntraced(function* (storage, ref, operation, version = false) {
+	yield* validateRef(ref, storage.config, operation);
+	if (version && (!ref.version || ref.version.id === "null") || ref.version && storage.capabilities.versionedReads !== "history") return yield* storageError(operation, storage.provider, {
+		_tag: "Unsupported",
+		capability: "native-history"
+	}, "not-started");
+	return {
+		Bucket: storage.config.bucket,
+		Key: ref.key,
+		...ref.version ? { VersionId: ref.version.id } : {}
+	};
+});
+const lifecycleFeature = (storage, feature) => {
+	const provider = storage.provider;
+	return provider === "s3" || (feature === "versions" ? storage.capabilities.versionedReads === "history" : feature === "tags" ? storage.profile?.tagging : feature === "protection" ? [
+		"minio",
+		"wasabi",
+		"scaleway",
+		"b2",
+		"hetzner"
+	].includes(provider) : provider === "tigris") ? Effect.void : Effect.fail(storageError(feature, provider, {
+		_tag: "Unsupported",
+		capability: feature
+	}, "not-started"));
+};
+
+export { lifecycleFeature, lifecycleTarget };
+//# sourceMappingURL=lifecycle-validation.js.map

package/dist/providers/s3/lifecycle-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-validation.js","names":[],"sources":["../../../src/providers/s3/lifecycle-validation.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport type { ObjectRef } from \"../../core/object.js\";\nimport type { S3StorageService } from \"./index.js\";\nimport { validateRef } from \"./object-mapping.js\";\n\nexport const lifecycleTarget = Effect.fnUntraced(function* (\n  storage: S3StorageService,\n  ref: ObjectRef,\n  operation: string,\n  version = false,\n) {\n  yield* validateRef(ref, storage.config, operation);\n  if (\n    (version && (!ref.version || ref.version.id === \"null\")) ||\n    (ref.version && storage.capabilities.versionedReads !== \"history\")\n  )\n    return yield* storageError(\n      operation,\n      storage.provider,\n      { _tag: \"Unsupported\", capability: \"native-history\" },\n      \"not-started\",\n    );\n  return {\n    Bucket: storage.config.bucket,\n    Key: ref.key,\n    ...(ref.version ? { VersionId: ref.version.id } : {}),\n  };\n});\nexport const lifecycleFeature = (\n  storage: S3StorageService,\n  feature: \"tags\" | \"versions\" | \"protection\" | \"archive\",\n) => {\n  const provider = storage.provider;\n  const supported =\n    provider === \"s3\" ||\n    (feature === \"versions\"\n      ? storage.capabilities.versionedReads === \"history\"\n      : feature === \"tags\"\n        ? storage.profile?.tagging\n        : feature === \"protection\"\n          ? [\"minio\", \"wasabi\", \"scaleway\", \"b2\", \"hetzner\"].includes(provider)\n          : provider === \"tigris\");\n  return supported\n    ? Effect.void\n    : Effect.fail(\n        storageError(\n          feature,\n          provider,\n          { _tag: \"Unsupported\", capability: feature },\n          \"not-started\",\n        ),\n      );\n};\n"],"mappings":";;;;;AAOA,MAAa,kBAAkB,OAAO,WAAW,WAC/C,SACA,KACA,WACA,UAAU,OACV;CACA,OAAO,YAAY,KAAK,QAAQ,QAAQ,SAAS;CACjD,IACG,YAAY,CAAC,IAAI,WAAW,IAAI,QAAQ,OAAO,WAC/C,IAAI,WAAW,QAAQ,aAAa,mBAAmB,WAExD,OAAO,OAAO,aACZ,WACA,QAAQ,UACR;EAAE,MAAM;EAAe,YAAY;CAAiB,GACpD,aACF;CACF,OAAO;EACL,QAAQ,QAAQ,OAAO;EACvB,KAAK,IAAI;EACT,GAAI,IAAI,UAAU,EAAE,WAAW,IAAI,QAAQ,GAAG,IAAI,CAAC;CACrD;AACF,CAAC;AACD,MAAa,oBACX,SACA,YACG;CACH,MAAM,WAAW,QAAQ;CAUzB,OARE,aAAa,SACZ,YAAY,aACT,QAAQ,aAAa,mBAAmB,YACxC,YAAY,SACV,QAAQ,SAAS,UACjB,YAAY,eACV;EAAC;EAAS;EAAU;EAAY;EAAM;CAAS,CAAC,CAAC,SAAS,QAAQ,IAClE,aAAa,YAEnB,OAAO,OACP,OAAO,KACL,aACE,SACA,UACA;EAAE,MAAM;EAAe,YAAY;CAAQ,GAC3C,aACF,CACF;AACN"}

package/dist/providers/s3/listing.js

@@ -0,0 +1,56 @@
+import { storageError } from "../../core/errors.js";
+import { authority } from "./config.js";
+import { metadata } from "./object-mapping.js";
+import { request } from "./transport.js";
+import { decodeCursor, encodeCursor } from "../../internal/listing-cursor.js";
+import { Effect } from "effect";
+import { ListObjectsV2Command } from "@aws-sdk/client-s3";
+
+// src/providers/s3/listing.ts
+const listPage = Effect.fnUntraced(function* (connection, input = {}) {
+	const { config, client } = connection;
+	const query = JSON.stringify([
+		"objects",
+		...connection.profile ? [connection.profile.provider, connection.profile.configuration] : [],
+		input.prefix ?? "",
+		input.delimiter ?? null,
+		input.limit ?? 1e3
+	]);
+	const token = yield* decodeCursor("s3", input.cursor, config.storeId, query, "listPage");
+	const output = yield* request(connection, "listPage", false, (signal) => client.send(new ListObjectsV2Command({
+		...authority(config),
+		Prefix: input.prefix,
+		Delimiter: input.delimiter,
+		MaxKeys: input.limit ?? 1e3,
+		ContinuationToken: token
+	}), { abortSignal: signal }));
+	const entries = [];
+	for (const object of output.Contents ?? []) {
+		if (object.Key === void 0) return yield* storageError("listPage", "s3", {
+			_tag: "ProviderFailure",
+			code: "MissingObjectKey"
+		});
+		entries.push({
+			_tag: "Object",
+			metadata: metadata(connection, object.Key, {
+				...object,
+				ContentLength: object.Size
+			})
+		});
+	}
+	for (const prefix of output.CommonPrefixes ?? []) if (prefix.Prefix !== void 0) entries.push({
+		_tag: "CommonPrefix",
+		prefix: prefix.Prefix
+	});
+	if (output.IsTruncated && !output.NextContinuationToken) return yield* storageError("listPage", "s3", {
+		_tag: "ProviderFailure",
+		code: "MissingContinuation"
+	});
+	return {
+		entries,
+		...output.IsTruncated && output.NextContinuationToken ? { cursor: encodeCursor(config.storeId, query, output.NextContinuationToken) } : {}
+	};
+});
+
+export { listPage };
+//# sourceMappingURL=listing.js.map

package/dist/providers/s3/listing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listing.js","names":[],"sources":["../../../src/providers/s3/listing.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { ListObjectsV2Command } from \"@aws-sdk/client-s3\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport type { ListEntry, ListRequest } from \"../../core/requests.js\";\nimport { decodeCursor, encodeCursor } from \"../../internal/listing-cursor.js\";\nimport { authority } from \"./config.js\";\nimport type { S3Connection } from \"./config.js\";\nimport { metadata } from \"./object-mapping.js\";\nimport { request } from \"./transport.js\";\n\nexport const listPage = Effect.fnUntraced(function* (\n  connection: S3Connection,\n  input: ListRequest = {},\n) {\n  const { config, client } = connection;\n  const query = JSON.stringify([\n    \"objects\",\n    ...(connection.profile ? [connection.profile.provider, connection.profile.configuration] : []),\n    input.prefix ?? \"\",\n    input.delimiter ?? null,\n    input.limit ?? 1000,\n  ]);\n  const token = yield* decodeCursor(\"s3\", input.cursor, config.storeId, query, \"listPage\");\n  const output = yield* request(connection, \"listPage\", false, (signal) =>\n    client.send(\n      new ListObjectsV2Command({\n        ...authority(config),\n        Prefix: input.prefix,\n        Delimiter: input.delimiter,\n        MaxKeys: input.limit ?? 1000,\n        ContinuationToken: token,\n      }),\n      { abortSignal: signal },\n    ),\n  );\n\n  const entries: ListEntry[] = [];\n  for (const object of output.Contents ?? []) {\n    if (object.Key === undefined)\n      return yield* storageError(\"listPage\", \"s3\", {\n        _tag: \"ProviderFailure\",\n        code: \"MissingObjectKey\",\n      });\n    entries.push({\n      _tag: \"Object\",\n      metadata: metadata(connection, object.Key, { ...object, ContentLength: object.Size }),\n    });\n  }\n  for (const prefix of output.CommonPrefixes ?? []) {\n    if (prefix.Prefix !== undefined) entries.push({ _tag: \"CommonPrefix\", prefix: prefix.Prefix });\n  }\n  if (output.IsTruncated && !output.NextContinuationToken)\n    return yield* storageError(\"listPage\", \"s3\", {\n      _tag: \"ProviderFailure\",\n      code: \"MissingContinuation\",\n    });\n  return {\n    entries,\n    ...(output.IsTruncated && output.NextContinuationToken\n      ? { cursor: encodeCursor(config.storeId, query, output.NextContinuationToken) }\n      : {}),\n  };\n});\n"],"mappings":";;;;;;;;;AAYA,MAAa,WAAW,OAAO,WAAW,WACxC,YACA,QAAqB,CAAC,GACtB;CACA,MAAM,EAAE,QAAQ,WAAW;CAC3B,MAAM,QAAQ,KAAK,UAAU;EAC3B;EACA,GAAI,WAAW,UAAU,CAAC,WAAW,QAAQ,UAAU,WAAW,QAAQ,aAAa,IAAI,CAAC;EAC5F,MAAM,UAAU;EAChB,MAAM,aAAa;EACnB,MAAM,SAAS;CACjB,CAAC;CACD,MAAM,QAAQ,OAAO,aAAa,MAAM,MAAM,QAAQ,OAAO,SAAS,OAAO,UAAU;CACvF,MAAM,SAAS,OAAO,QAAQ,YAAY,YAAY,QAAQ,WAC5D,OAAO,KACL,IAAI,qBAAqB;EACvB,GAAG,UAAU,MAAM;EACnB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,SAAS,MAAM,SAAS;EACxB,mBAAmB;CACrB,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;CAEA,MAAM,UAAuB,CAAC;CAC9B,KAAK,MAAM,UAAU,OAAO,YAAY,CAAC,GAAG;EAC1C,IAAI,OAAO,QAAQ,QACjB,OAAO,OAAO,aAAa,YAAY,MAAM;GAC3C,MAAM;GACN,MAAM;EACR,CAAC;EACH,QAAQ,KAAK;GACX,MAAM;GACN,UAAU,SAAS,YAAY,OAAO,KAAK;IAAE,GAAG;IAAQ,eAAe,OAAO;GAAK,CAAC;EACtF,CAAC;CACH;CACA,KAAK,MAAM,UAAU,OAAO,kBAAkB,CAAC,GAC7C,IAAI,OAAO,WAAW,QAAW,QAAQ,KAAK;EAAE,MAAM;EAAgB,QAAQ,OAAO;CAAO,CAAC;CAE/F,IAAI,OAAO,eAAe,CAAC,OAAO,uBAChC,OAAO,OAAO,aAAa,YAAY,MAAM;EAC3C,MAAM;EACN,MAAM;CACR,CAAC;CACH,OAAO;EACL;EACA,GAAI,OAAO,eAAe,OAAO,wBAC7B,EAAE,QAAQ,aAAa,OAAO,SAAS,OAAO,OAAO,qBAAqB,EAAE,IAC5E,CAAC;CACP;AACF,CAAC"}

package/dist/providers/s3/metadata.d.ts

@@ -0,0 +1,10 @@
+import { MetadataService, StorageMetadata } from "../../lifecycle.js";
+import { S3Storage, S3StorageService } from "../../s3.js";
+import { Context, Layer } from "effect";
+declare const S3Metadata_base: Context.ServiceClass<S3Metadata, "@effect-kit/storage/s3/S3Metadata", MetadataService>;
+export declare class S3Metadata extends S3Metadata_base {
+  static make(storage: S3StorageService): MetadataService;
+  static readonly layer: Layer.Layer<S3Metadata | StorageMetadata, never, S3Storage>;
+}
+export {};
+//# sourceMappingURL=metadata.d.ts.map

package/dist/providers/s3/metadata.js

@@ -0,0 +1,90 @@
+import { storageError } from "../../core/errors.js";
+import { decodeRequest } from "../../internal/request-validation.js";
+import { authority, readEncryption } from "./config.js";
+import { validateHeaders } from "./validation.js";
+import { condition, encodeCopySource, headers, metadata } from "./object-mapping.js";
+import { request } from "./transport.js";
+import { S3Storage } from "../../s3.js";
+import { MetadataMerge, MetadataReplace, StorageMetadata } from "../../lifecycle.js";
+import { lifecycleTarget } from "./lifecycle-validation.js";
+import { mergeHeaders, replaceHeaders } from "../../lifecycle/metadata.js";
+import { Context, Effect, Layer } from "effect";
+import { CopyObjectCommand, HeadObjectCommand } from "@aws-sdk/client-s3";
+
+// src/providers/s3/metadata.ts
+var S3Metadata = class S3Metadata extends Context.Service()("@effect-kit/storage/s3/S3Metadata") {
+	static make(storage) {
+		const update = Effect.fnUntraced(function* (input, patch) {
+			if (storage.profile) return yield* storageError("updateMetadata", storage.provider, {
+				_tag: "Unsupported",
+				capability: "qualified-conditional-metadata-copy"
+			}, "not-started");
+			if (!input.condition || input.condition._tag !== "IfMatch") return yield* storageError("updateMetadata", storage.provider, {
+				_tag: "Unsupported",
+				capability: "metadata-update-requires-current-if-match"
+			}, "not-started");
+			const target = yield* lifecycleTarget(storage, input.ref, "updateMetadata");
+			const before = yield* request(storage, "updateMetadata.head", false, (signal) => storage.client.send(new HeadObjectCommand({
+				...target,
+				...readEncryption(storage.config.encryption)
+			}), { abortSignal: signal }));
+			if (!before.ETag || before.ETag !== input.condition.etag) return yield* storageError("updateMetadata", storage.provider, { _tag: "PreconditionFailed" }, "not-started");
+			if ((before.ContentLength ?? Number.MAX_SAFE_INTEGER) > 5e9) return yield* storageError("updateMetadata", storage.provider, {
+				_tag: "Unsupported",
+				capability: "multipart-metadata-copy"
+			}, "not-started");
+			const original = metadata(storage, input.ref.key, before);
+			const replacement = patch ? mergeHeaders(original, patch) : replaceHeaders(original, input.headers);
+			yield* validateHeaders(replacement, "updateMetadata");
+			const customer = readEncryption(storage.config.encryption);
+			const output = yield* request(storage, "updateMetadata", true, (signal) => storage.client.send(new CopyObjectCommand({
+				...authority(storage.config),
+				Key: input.ref.key,
+				CopySource: encodeCopySource(storage.config.bucket, input.ref),
+				CopySourceIfMatch: before.ETag,
+				...condition(input.condition),
+				...headers(replacement),
+				MetadataDirective: "REPLACE",
+				TaggingDirective: "COPY",
+				ServerSideEncryption: before.ServerSideEncryption,
+				SSEKMSKeyId: before.SSEKMSKeyId,
+				BucketKeyEnabled: before.BucketKeyEnabled,
+				...customer,
+				...storage.config.encryption?.mode === "customer" ? {
+					CopySourceSSECustomerAlgorithm: customer.SSECustomerAlgorithm,
+					CopySourceSSECustomerKey: customer.SSECustomerKey,
+					CopySourceSSECustomerKeyMD5: customer.SSECustomerKeyMD5
+				} : {},
+				ObjectLockMode: before.ObjectLockMode,
+				ObjectLockRetainUntilDate: before.ObjectLockRetainUntilDate,
+				ObjectLockLegalHoldStatus: before.ObjectLockLegalHoldStatus,
+				StorageClass: before.StorageClass
+			}), { abortSignal: signal }));
+			if (!output.CopyObjectResult?.ETag) return yield* storageError("updateMetadata", storage.provider, {
+				_tag: "ProviderFailure",
+				code: "MissingCopyReceipt"
+			}, "unknown");
+			return metadata(storage, input.ref.key, {
+				...output,
+				...output.CopyObjectResult,
+				...headers(replacement),
+				ContentLength: before.ContentLength
+			});
+		});
+		return {
+			replace: (input) => decodeRequest(MetadataReplace, input, "updateMetadata", storage.provider, true).pipe(Effect.flatMap((value) => update(value))),
+			merge: (input) => decodeRequest(MetadataMerge, input, "updateMetadata", storage.provider, true).pipe(Effect.flatMap((value) => update({
+				ref: value.ref,
+				headers: {},
+				condition: value.condition
+			}, value.patch)))
+		};
+	}
+	static layer = Layer.effectContext(Effect.map(S3Storage, (storage) => {
+		const service = S3Metadata.make(storage);
+		return Context.make(S3Metadata, service).pipe(Context.add(StorageMetadata, service));
+	}));
+};
+
+export { S3Metadata };
+//# sourceMappingURL=metadata.js.map

package/dist/providers/s3/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","names":[],"sources":["../../../src/providers/s3/metadata.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\n\nimport { CopyObjectCommand, HeadObjectCommand } from \"@aws-sdk/client-s3\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport type { ObjectHeaders } from \"../../core/object.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { MetadataMerge, MetadataReplace, StorageMetadata } from \"../../lifecycle/index.js\";\nimport type { MetadataService } from \"../../lifecycle/index.js\";\nimport { mergeHeaders, replaceHeaders } from \"../../lifecycle/metadata.js\";\nimport { authority, readEncryption } from \"./config.js\";\nimport { S3Storage } from \"./index.js\";\nimport type { S3StorageService } from \"./index.js\";\nimport { lifecycleTarget } from \"./lifecycle-validation.js\";\nimport { condition, encodeCopySource, headers, metadata } from \"./object-mapping.js\";\nimport { request } from \"./transport.js\";\nimport { validateHeaders } from \"./validation.js\";\n\nexport class S3Metadata extends Context.Service<S3Metadata, MetadataService>()(\n  \"@effect-kit/storage/s3/S3Metadata\",\n) {\n  static make(storage: S3StorageService): MetadataService {\n    const update = Effect.fnUntraced(function* (\n      input: typeof MetadataReplace.Type,\n      patch?: (typeof MetadataMerge.Type)[\"patch\"],\n    ) {\n      if (storage.profile)\n        return yield* storageError(\n          \"updateMetadata\",\n          storage.provider,\n          { _tag: \"Unsupported\", capability: \"qualified-conditional-metadata-copy\" },\n          \"not-started\",\n        );\n      if (!input.condition || input.condition._tag !== \"IfMatch\")\n        return yield* storageError(\n          \"updateMetadata\",\n          storage.provider,\n          { _tag: \"Unsupported\", capability: \"metadata-update-requires-current-if-match\" },\n          \"not-started\",\n        );\n      const target = yield* lifecycleTarget(storage, input.ref, \"updateMetadata\");\n      const before = yield* request(storage, \"updateMetadata.head\", false, (signal) =>\n        storage.client.send(\n          new HeadObjectCommand({ ...target, ...readEncryption(storage.config.encryption) }),\n          { abortSignal: signal },\n        ),\n      );\n      if (!before.ETag || before.ETag !== input.condition.etag)\n        return yield* storageError(\n          \"updateMetadata\",\n          storage.provider,\n          { _tag: \"PreconditionFailed\" },\n          \"not-started\",\n        );\n      if ((before.ContentLength ?? Number.MAX_SAFE_INTEGER) > 5_000_000_000)\n        return yield* storageError(\n          \"updateMetadata\",\n          storage.provider,\n          { _tag: \"Unsupported\", capability: \"multipart-metadata-copy\" },\n          \"not-started\",\n        );\n      const original = metadata(storage, input.ref.key, before);\n      const replacement: ObjectHeaders = patch\n        ? mergeHeaders(original, patch)\n        : replaceHeaders(original, input.headers);\n      yield* validateHeaders(replacement, \"updateMetadata\");\n      const customer = readEncryption(storage.config.encryption);\n      const output = yield* request(storage, \"updateMetadata\", true, (signal) =>\n        storage.client.send(\n          new CopyObjectCommand({\n            ...authority(storage.config),\n            Key: input.ref.key,\n            CopySource: encodeCopySource(storage.config.bucket, input.ref),\n            CopySourceIfMatch: before.ETag,\n            ...condition(input.condition),\n            ...headers(replacement),\n            MetadataDirective: \"REPLACE\",\n            TaggingDirective: \"COPY\",\n            ServerSideEncryption: before.ServerSideEncryption,\n            SSEKMSKeyId: before.SSEKMSKeyId,\n            BucketKeyEnabled: before.BucketKeyEnabled,\n            ...customer,\n            ...(storage.config.encryption?.mode === \"customer\"\n              ? {\n                  CopySourceSSECustomerAlgorithm: customer.SSECustomerAlgorithm,\n                  CopySourceSSECustomerKey: customer.SSECustomerKey,\n                  CopySourceSSECustomerKeyMD5: customer.SSECustomerKeyMD5,\n                }\n              : {}),\n            ObjectLockMode: before.ObjectLockMode,\n            ObjectLockRetainUntilDate: before.ObjectLockRetainUntilDate,\n            ObjectLockLegalHoldStatus: before.ObjectLockLegalHoldStatus,\n            StorageClass: before.StorageClass,\n          }),\n          { abortSignal: signal },\n        ),\n      );\n      if (!output.CopyObjectResult?.ETag)\n        return yield* storageError(\n          \"updateMetadata\",\n          storage.provider,\n          { _tag: \"ProviderFailure\", code: \"MissingCopyReceipt\" },\n          \"unknown\",\n        );\n      return metadata(storage, input.ref.key, {\n        ...output,\n        ...output.CopyObjectResult,\n        ...headers(replacement),\n        ContentLength: before.ContentLength,\n      });\n    });\n    return {\n      replace: (input) =>\n        decodeRequest(MetadataReplace, input, \"updateMetadata\", storage.provider, true).pipe(\n          Effect.flatMap((value) => update(value)),\n        ),\n      merge: (input) =>\n        decodeRequest(MetadataMerge, input, \"updateMetadata\", storage.provider, true).pipe(\n          Effect.flatMap((value) =>\n            update({ ref: value.ref, headers: {}, condition: value.condition }, value.patch),\n          ),\n        ),\n    };\n  }\n  static readonly layer = Layer.effectContext(\n    Effect.map(S3Storage, (storage) => {\n      const service = S3Metadata.make(storage);\n      return Context.make(S3Metadata, service).pipe(Context.add(StorageMetadata, service));\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAkBA,IAAa,aAAb,MAAa,mBAAmB,QAAQ,QAAqC,CAAC,CAC5E,mCACF,CAAC,CAAC;CACA,OAAO,KAAK,SAA4C;EACtD,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA,OACA;GACA,IAAI,QAAQ,SACV,OAAO,OAAO,aACZ,kBACA,QAAQ,UACR;IAAE,MAAM;IAAe,YAAY;GAAsC,GACzE,aACF;GACF,IAAI,CAAC,MAAM,aAAa,MAAM,UAAU,SAAS,WAC/C,OAAO,OAAO,aACZ,kBACA,QAAQ,UACR;IAAE,MAAM;IAAe,YAAY;GAA4C,GAC/E,aACF;GACF,MAAM,SAAS,OAAO,gBAAgB,SAAS,MAAM,KAAK,gBAAgB;GAC1E,MAAM,SAAS,OAAO,QAAQ,SAAS,uBAAuB,QAAQ,WACpE,QAAQ,OAAO,KACb,IAAI,kBAAkB;IAAE,GAAG;IAAQ,GAAG,eAAe,QAAQ,OAAO,UAAU;GAAE,CAAC,GACjF,EAAE,aAAa,OAAO,CACxB,CACF;GACA,IAAI,CAAC,OAAO,QAAQ,OAAO,SAAS,MAAM,UAAU,MAClD,OAAO,OAAO,aACZ,kBACA,QAAQ,UACR,EAAE,MAAM,qBAAqB,GAC7B,aACF;GACF,KAAK,OAAO,iBAAiB,OAAO,oBAAoB,KACtD,OAAO,OAAO,aACZ,kBACA,QAAQ,UACR;IAAE,MAAM;IAAe,YAAY;GAA0B,GAC7D,aACF;GACF,MAAM,WAAW,SAAS,SAAS,MAAM,IAAI,KAAK,MAAM;GACxD,MAAM,cAA6B,QAC/B,aAAa,UAAU,KAAK,IAC5B,eAAe,UAAU,MAAM,OAAO;GAC1C,OAAO,gBAAgB,aAAa,gBAAgB;GACpD,MAAM,WAAW,eAAe,QAAQ,OAAO,UAAU;GACzD,MAAM,SAAS,OAAO,QAAQ,SAAS,kBAAkB,OAAO,WAC9D,QAAQ,OAAO,KACb,IAAI,kBAAkB;IACpB,GAAG,UAAU,QAAQ,MAAM;IAC3B,KAAK,MAAM,IAAI;IACf,YAAY,iBAAiB,QAAQ,OAAO,QAAQ,MAAM,GAAG;IAC7D,mBAAmB,OAAO;IAC1B,GAAG,UAAU,MAAM,SAAS;IAC5B,GAAG,QAAQ,WAAW;IACtB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB,OAAO;IAC7B,aAAa,OAAO;IACpB,kBAAkB,OAAO;IACzB,GAAG;IACH,GAAI,QAAQ,OAAO,YAAY,SAAS,aACpC;KACE,gCAAgC,SAAS;KACzC,0BAA0B,SAAS;KACnC,6BAA6B,SAAS;IACxC,IACA,CAAC;IACL,gBAAgB,OAAO;IACvB,2BAA2B,OAAO;IAClC,2BAA2B,OAAO;IAClC,cAAc,OAAO;GACvB,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;GACA,IAAI,CAAC,OAAO,kBAAkB,MAC5B,OAAO,OAAO,aACZ,kBACA,QAAQ,UACR;IAAE,MAAM;IAAmB,MAAM;GAAqB,GACtD,SACF;GACF,OAAO,SAAS,SAAS,MAAM,IAAI,KAAK;IACtC,GAAG;IACH,GAAG,OAAO;IACV,GAAG,QAAQ,WAAW;IACtB,eAAe,OAAO;GACxB,CAAC;EACH,CAAC;EACD,OAAO;GACL,UAAU,UACR,cAAc,iBAAiB,OAAO,kBAAkB,QAAQ,UAAU,IAAI,CAAC,CAAC,KAC9E,OAAO,SAAS,UAAU,OAAO,KAAK,CAAC,CACzC;GACF,QAAQ,UACN,cAAc,eAAe,OAAO,kBAAkB,QAAQ,UAAU,IAAI,CAAC,CAAC,KAC5E,OAAO,SAAS,UACd,OAAO;IAAE,KAAK,MAAM;IAAK,SAAS,CAAC;IAAG,WAAW,MAAM;GAAU,GAAG,MAAM,KAAK,CACjF,CACF;EACJ;CACF;CACA,OAAgB,QAAQ,MAAM,cAC5B,OAAO,IAAI,YAAY,YAAY;EACjC,MAAM,UAAU,WAAW,KAAK,OAAO;EACvC,OAAO,QAAQ,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,iBAAiB,OAAO,CAAC;CACrF,CAAC,CACH;AACF"}

package/dist/providers/s3/multipart.d.ts

@@ -0,0 +1,41 @@
+import { ObjectHeaders } from "../../core/object.js";
+import { StorageError } from "../../core/errors.js";
+import { ListRequest, UploadBody } from "../../core/requests.js";
+import { MultipartHandle, MultipartUploads, UploadedPart } from "../../core/contracts/multipart.js";
+import { ChecksumOptions, Upload } from "./native-models.js";
+import { S3Connection } from "./config.js";
+import { Effect } from "effect";
+export type S3MultipartHandle = typeof Upload.Type;
+export type S3ChecksumOptions = typeof ChecksumOptions.Type;
+export interface S3MultipartUploads extends Omit<MultipartUploads, "initiate" | "uploadPart" | "complete"> {
+  readonly initiate: (input: {
+    readonly key: string;
+    readonly headers?: ObjectHeaders;
+    readonly checksum?: S3ChecksumOptions;
+  }) => Effect.Effect<S3MultipartHandle, StorageError>;
+  readonly uploadPart: <E = never, R = never>(input: {
+    readonly upload: MultipartHandle;
+    readonly partNumber: number;
+    readonly contentLength?: number;
+    readonly body: UploadBody<E, R>;
+    readonly checksum?: S3ChecksumOptions;
+  }) => Effect.Effect<UploadedPart, StorageError | E, R>;
+  readonly complete: (input: Parameters<MultipartUploads["complete"]>[0] & {
+    readonly checksum?: S3ChecksumOptions;
+  }) => ReturnType<MultipartUploads["complete"]>;
+  readonly listUploads: (input: ListRequest) => Effect.Effect<{
+    readonly uploads: ReadonlyArray<S3MultipartHandle>;
+    readonly cursor?: string;
+  }, StorageError>;
+  readonly listParts: (input: {
+    readonly upload: MultipartHandle;
+    readonly cursor?: string;
+  }) => Effect.Effect<{
+    readonly parts: ReadonlyArray<UploadedPart>;
+    readonly cursor?: string;
+    readonly checksumAlgorithm?: S3ChecksumOptions["ChecksumAlgorithm"];
+    readonly checksumType?: S3ChecksumOptions["ChecksumType"];
+  }, StorageError>;
+}
+export declare function multipart(connection: S3Connection): S3MultipartUploads;
+//# sourceMappingURL=multipart.d.ts.map