@effect-kit/storage 0.0.0-stage → 0.0.0

package/dist/s3/events.js

@@ -0,0 +1,69 @@
+import { storageError } from "../core/errors.js";
+import { decodeRequest } from "../internal/request-validation.js";
+import { StorageEvent } from "../events.js";
+import { decodeResponse } from "../internal/provider-response.js";
+import { Effect, Redacted, Schema } from "effect";
+
+// src/providers/s3/events.ts
+const Event = Schema.Struct({
+	eventVersion: Schema.String,
+	eventTime: Schema.DateTimeUtcFromString,
+	eventName: Schema.NonEmptyString,
+	s3: Schema.Struct({
+		bucket: Schema.Struct({ name: Schema.NonEmptyString }),
+		object: Schema.Struct({
+			key: Schema.String,
+			versionId: Schema.optional(Schema.String),
+			sequencer: Schema.optional(Schema.String)
+		})
+	})
+});
+let S3Events;
+(function(_S3Events) {
+	_S3Events.decode = Effect.fnUntraced(function* (payload, options) {
+		const batch = yield* decodeResponse(Schema.Struct({ Records: Schema.Array(Event).check(Schema.isMaxLength(1e3)) }), payload, "decodeEvent", "s3");
+		return yield* Effect.forEach(batch.Records, (record, index) => Effect.gen(function* () {
+			if (record.s3.bucket.name !== options.bucket || !record.eventVersion.startsWith("2.")) return yield* storageError("decodeEvent", "s3", {
+				_tag: "InvalidInput",
+				field: "bucket-or-version"
+			});
+			const key = yield* Effect.try({
+				try: () => decodeURIComponent(record.s3.object.key.replace(/\+/gu, " ")),
+				catch: () => storageError("decodeEvent", "s3", {
+					_tag: "InvalidInput",
+					field: "encoded-key"
+				})
+			});
+			const object = record.s3.object;
+			const kind = record.eventName.startsWith("ObjectCreated:") ? "object-created" : record.eventName === "ObjectRemoved:DeleteMarkerCreated" ? "delete-marker-created" : record.eventName.startsWith("ObjectRemoved:") ? "object-deleted" : record.eventName === "ObjectRestore:Completed" ? "restore-completed" : record.eventName.startsWith("ObjectTagging:") ? "metadata-updated" : "other";
+			return yield* decodeRequest(StorageEvent, {
+				provider: options.provider ?? "s3",
+				kind,
+				ref: {
+					storeId: options.storeId,
+					key,
+					...object.versionId ? { version: {
+						_tag: "S3Version",
+						id: object.versionId
+					} } : {}
+				},
+				occurredAt: record.eventTime,
+				nativeType: record.eventName,
+				native: Redacted.make(payload),
+				...object.sequencer ? {
+					sequencer: object.sequencer,
+					id: JSON.stringify([
+						record.s3.bucket.name,
+						key,
+						record.eventName,
+						object.versionId,
+						object.sequencer
+					])
+				} : options.messageId ? { id: `${options.messageId}:${String(index)}` } : {}
+			}, "decodeEvent", "s3");
+		}));
+	});
+})(S3Events || (S3Events = {}));
+
+export { S3Events };
+//# sourceMappingURL=events.js.map

package/dist/s3/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../src/providers/s3/events.ts"],"sourcesContent":["import { Effect, Redacted, Schema } from \"effect\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport { decodeResponse } from \"../../internal/provider-response.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { StorageEvent } from \"../../lifecycle/events.js\";\n\nconst Event = Schema.Struct({\n  eventVersion: Schema.String,\n  eventTime: Schema.DateTimeUtcFromString,\n  eventName: Schema.NonEmptyString,\n  s3: Schema.Struct({\n    bucket: Schema.Struct({ name: Schema.NonEmptyString }),\n    object: Schema.Struct({\n      key: Schema.String,\n      versionId: Schema.optional(Schema.String),\n      sequencer: Schema.optional(Schema.String),\n    }),\n  }),\n});\nexport namespace S3Events {\n  export const decode = Effect.fnUntraced(function* (\n    payload: unknown,\n    options: {\n      readonly bucket: string;\n      readonly storeId: string;\n      readonly provider?: string;\n      readonly messageId?: string;\n    },\n  ) {\n    const batch = yield* decodeResponse(\n      Schema.Struct({ Records: Schema.Array(Event).check(Schema.isMaxLength(1000)) }),\n      payload,\n      \"decodeEvent\",\n      \"s3\",\n    );\n    return yield* Effect.forEach(batch.Records, (record, index) =>\n      Effect.gen(function* () {\n        if (record.s3.bucket.name !== options.bucket || !record.eventVersion.startsWith(\"2.\"))\n          return yield* storageError(\"decodeEvent\", \"s3\", {\n            _tag: \"InvalidInput\",\n            field: \"bucket-or-version\",\n          });\n        const key = yield* Effect.try({\n          try: () => decodeURIComponent(record.s3.object.key.replace(/\\+/gu, \" \")),\n          catch: () =>\n            storageError(\"decodeEvent\", \"s3\", { _tag: \"InvalidInput\", field: \"encoded-key\" }),\n        });\n        const object = record.s3.object;\n        const kind = record.eventName.startsWith(\"ObjectCreated:\")\n          ? \"object-created\"\n          : record.eventName === \"ObjectRemoved:DeleteMarkerCreated\"\n            ? \"delete-marker-created\"\n            : record.eventName.startsWith(\"ObjectRemoved:\")\n              ? \"object-deleted\"\n              : record.eventName === \"ObjectRestore:Completed\"\n                ? \"restore-completed\"\n                : record.eventName.startsWith(\"ObjectTagging:\")\n                  ? \"metadata-updated\"\n                  : \"other\";\n        return yield* decodeRequest(\n          StorageEvent,\n          {\n            provider: options.provider ?? \"s3\",\n            kind,\n            ref: {\n              storeId: options.storeId,\n              key,\n              ...(object.versionId ? { version: { _tag: \"S3Version\", id: object.versionId } } : {}),\n            },\n            occurredAt: record.eventTime,\n            nativeType: record.eventName,\n            native: Redacted.make(payload),\n            ...(object.sequencer\n              ? {\n                  sequencer: object.sequencer,\n                  id: JSON.stringify([\n                    record.s3.bucket.name,\n                    key,\n                    record.eventName,\n                    object.versionId,\n                    object.sequencer,\n                  ]),\n                }\n              : options.messageId\n                ? { id: `${options.messageId}:${String(index)}` }\n                : {}),\n          },\n          \"decodeEvent\",\n          \"s3\",\n        );\n      }),\n    );\n  });\n}\n"],"mappings":";;;;;;;AAOA,MAAM,QAAQ,OAAO,OAAO;CAC1B,cAAc,OAAO;CACrB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,IAAI,OAAO,OAAO;EAChB,QAAQ,OAAO,OAAO,EAAE,MAAM,OAAO,eAAe,CAAC;EACrD,QAAQ,OAAO,OAAO;GACpB,KAAK,OAAO;GACZ,WAAW,OAAO,SAAS,OAAO,MAAM;GACxC,WAAW,OAAO,SAAS,OAAO,MAAM;EAC1C,CAAC;CACH,CAAC;AACH,CAAC;AACM,IAAU;CAAV;oBACiB,OAAO,WAAW,WACtC,SACA,SAMA;EACA,MAAM,QAAQ,OAAO,eACnB,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,OAAO,YAAY,GAAI,CAAC,EAAE,CAAC,GAC9E,SACA,eACA,IACF;EACA,OAAO,OAAO,OAAO,QAAQ,MAAM,UAAU,QAAQ,UACnD,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,GAAG,OAAO,SAAS,QAAQ,UAAU,CAAC,OAAO,aAAa,WAAW,IAAI,GAClF,OAAO,OAAO,aAAa,eAAe,MAAM;IAC9C,MAAM;IACN,OAAO;GACT,CAAC;GACH,MAAM,MAAM,OAAO,OAAO,IAAI;IAC5B,WAAW,mBAAmB,OAAO,GAAG,OAAO,IAAI,QAAQ,QAAQ,GAAG,CAAC;IACvE,aACE,aAAa,eAAe,MAAM;KAAE,MAAM;KAAgB,OAAO;IAAc,CAAC;GACpF,CAAC;GACD,MAAM,SAAS,OAAO,GAAG;GACzB,MAAM,OAAO,OAAO,UAAU,WAAW,gBAAgB,IACrD,mBACA,OAAO,cAAc,sCACnB,0BACA,OAAO,UAAU,WAAW,gBAAgB,IAC1C,mBACA,OAAO,cAAc,4BACnB,sBACA,OAAO,UAAU,WAAW,gBAAgB,IAC1C,qBACA;GACZ,OAAO,OAAO,cACZ,cACA;IACE,UAAU,QAAQ,YAAY;IAC9B;IACA,KAAK;KACH,SAAS,QAAQ;KACjB;KACA,GAAI,OAAO,YAAY,EAAE,SAAS;MAAE,MAAM;MAAa,IAAI,OAAO;KAAU,EAAE,IAAI,CAAC;IACrF;IACA,YAAY,OAAO;IACnB,YAAY,OAAO;IACnB,QAAQ,SAAS,KAAK,OAAO;IAC7B,GAAI,OAAO,YACP;KACE,WAAW,OAAO;KAClB,IAAI,KAAK,UAAU;MACjB,OAAO,GAAG,OAAO;MACjB;MACA,OAAO;MACP,OAAO;MACP,OAAO;KACT,CAAC;IACH,IACA,QAAQ,YACN,EAAE,IAAI,GAAG,QAAQ,UAAU,GAAG,OAAO,KAAK,IAAI,IAC9C,CAAC;GACT,GACA,eACA,IACF;EACF,CAAC,CACH;CACF,CAAC;EACF,4BAAD"}

package/dist/s3/governance.d.ts

@@ -0,0 +1,319 @@
+import { StorageError } from "../core/errors.js";
+import "../index.js";
+import { S3Storage, S3StorageService } from "../s3.js";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+export declare const GovernanceBypass: Schema.Struct<{
+  readonly intent: Schema.Literal<"bypass-governance">;
+  readonly reason: Schema.NonEmptyString;
+}>;
+export declare const RetentionPolicy: Schema.Struct<{
+  readonly mode: Schema.Literals<readonly ["governance", "compliance"]>;
+  readonly retainUntil: Schema.DateTimeUtc;
+}>;
+declare const make: (storage: S3StorageService) => {
+  getRetention: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+  }) => Effect.Effect<{
+    _tag: "None";
+    mode?: never;
+    retainUntil?: never;
+  } | {
+    _tag: "Retention";
+    mode: "compliance" | "governance";
+    retainUntil: DateTime.Utc;
+  }, StorageError, never>;
+  setRetention: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly retention: {
+      readonly mode: "compliance" | "governance";
+      readonly retainUntil: DateTime.Utc;
+    };
+    readonly bypassGovernance?: {
+      readonly intent: "bypass-governance";
+      readonly reason: string;
+    } | undefined;
+  }) => Effect.Effect<{
+    _tag: "Accepted";
+  }, StorageError, never>;
+  getLegalHold: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+  }) => Effect.Effect<{
+    status: "off" | "on" | "unreported";
+  }, StorageError, never>;
+  setLegalHold: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly status: "off" | "on";
+    readonly releaseIntent?: "release-object-hold" | undefined;
+  }) => Effect.Effect<{
+    _tag: "Accepted";
+  }, StorageError, never>;
+  deleteVersion: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly bypassGovernance: {
+      readonly intent: "bypass-governance";
+      readonly reason: string;
+    };
+  }) => Effect.Effect<void, StorageError, never>;
+};
+export type S3ObjectLockService = ReturnType<typeof make>;
+declare const S3ObjectLock_base: Context.ServiceClass<S3ObjectLock, "@effect-kit/storage/s3/S3ObjectLock", {
+  getRetention: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+  }) => Effect.Effect<{
+    _tag: "None";
+    mode?: never;
+    retainUntil?: never;
+  } | {
+    _tag: "Retention";
+    mode: "compliance" | "governance";
+    retainUntil: DateTime.Utc;
+  }, StorageError, never>;
+  setRetention: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly retention: {
+      readonly mode: "compliance" | "governance";
+      readonly retainUntil: DateTime.Utc;
+    };
+    readonly bypassGovernance?: {
+      readonly intent: "bypass-governance";
+      readonly reason: string;
+    } | undefined;
+  }) => Effect.Effect<{
+    _tag: "Accepted";
+  }, StorageError, never>;
+  getLegalHold: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+  }) => Effect.Effect<{
+    status: "off" | "on" | "unreported";
+  }, StorageError, never>;
+  setLegalHold: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly status: "off" | "on";
+    readonly releaseIntent?: "release-object-hold" | undefined;
+  }) => Effect.Effect<{
+    _tag: "Accepted";
+  }, StorageError, never>;
+  deleteVersion: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly bypassGovernance: {
+      readonly intent: "bypass-governance";
+      readonly reason: string;
+    };
+  }) => Effect.Effect<void, StorageError, never>;
+}>;
+export declare class S3ObjectLock extends S3ObjectLock_base {
+  static readonly make: typeof make;
+  static readonly layer: Layer.Layer<S3ObjectLock, never, S3Storage>;
+}
+export {};
+//# sourceMappingURL=governance.d.ts.map

package/dist/s3/governance.js

@@ -0,0 +1,108 @@
+import { storageError } from "../core/errors.js";
+import { decodeRequest } from "../internal/request-validation.js";
+import { request } from "../providers/s3/transport.js";
+import { S3Storage } from "../s3.js";
+import { VersionRef } from "../lifecycle.js";
+import { lifecycleFeature, lifecycleTarget } from "../providers/s3/lifecycle-validation.js";
+import { Context, DateTime, Effect, Layer, Schema } from "effect";
+import { DeleteObjectCommand, GetObjectLegalHoldCommand, GetObjectRetentionCommand, PutObjectLegalHoldCommand, PutObjectRetentionCommand } from "@aws-sdk/client-s3";
+
+// src/providers/s3/governance.ts
+const GovernanceBypass = Schema.Struct({
+	intent: Schema.Literal("bypass-governance"),
+	reason: Schema.NonEmptyString
+});
+const RetentionPolicy = Schema.Struct({
+	mode: Schema.Literals(["governance", "compliance"]),
+	retainUntil: Schema.DateTimeUtc
+});
+const Target = Schema.Struct({ ref: VersionRef });
+const SetRetention = Schema.Struct({
+	...Target.fields,
+	retention: RetentionPolicy,
+	bypassGovernance: Schema.optional(GovernanceBypass)
+});
+const SetHold = Schema.Struct({
+	...Target.fields,
+	status: Schema.Literals(["on", "off"]),
+	releaseIntent: Schema.optional(Schema.Literal("release-object-hold"))
+});
+const DeleteProtected = Schema.Struct({
+	...Target.fields,
+	bypassGovernance: GovernanceBypass
+});
+const make = (storage) => {
+	const selected = Effect.fnUntraced(function* (ref, operation) {
+		yield* lifecycleFeature(storage, "protection");
+		return yield* lifecycleTarget(storage, ref, operation, true);
+	});
+	return {
+		getRetention: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(Target, input, "getRetention", storage.provider);
+			const target = yield* selected(value.ref, "getRetention");
+			const output = yield* request(storage, "getRetention", false, (signal) => storage.client.send(new GetObjectRetentionCommand(target), { abortSignal: signal }));
+			if (!output.Retention?.Mode && !output.Retention?.RetainUntilDate) return { _tag: "None" };
+			if (!output.Retention?.Mode || !["GOVERNANCE", "COMPLIANCE"].includes(output.Retention.Mode) || !output.Retention.RetainUntilDate || !Number.isFinite(output.Retention.RetainUntilDate.getTime())) return yield* storageError("getRetention", storage.provider, {
+				_tag: "ProviderFailure",
+				code: "InvalidRetention"
+			});
+			return {
+				_tag: "Retention",
+				mode: output.Retention.Mode === "GOVERNANCE" ? "governance" : "compliance",
+				retainUntil: DateTime.makeUnsafe(output.Retention.RetainUntilDate)
+			};
+		}),
+		setRetention: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(SetRetention, input, "setRetention", storage.provider, true);
+			const target = yield* selected(value.ref, "setRetention");
+			const now = yield* DateTime.now;
+			if (DateTime.toEpochMillis(value.retention.retainUntil) <= DateTime.toEpochMillis(now)) return yield* storageError("setRetention", storage.provider, {
+				_tag: "InvalidInput",
+				field: "retainUntil"
+			}, "not-started");
+			yield* request(storage, "setRetention", true, (signal) => storage.client.send(new PutObjectRetentionCommand({
+				...target,
+				Retention: {
+					Mode: value.retention.mode === "governance" ? "GOVERNANCE" : "COMPLIANCE",
+					RetainUntilDate: DateTime.toDateUtc(value.retention.retainUntil)
+				},
+				...value.bypassGovernance ? { BypassGovernanceRetention: true } : {}
+			}), { abortSignal: signal }));
+			return { _tag: "Accepted" };
+		}),
+		getLegalHold: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(Target, input, "getLegalHold", storage.provider);
+			const target = yield* selected(value.ref, "getLegalHold");
+			const output = yield* request(storage, "getLegalHold", false, (signal) => storage.client.send(new GetObjectLegalHoldCommand(target), { abortSignal: signal }));
+			return { status: output.LegalHold?.Status === "ON" ? "on" : output.LegalHold?.Status === "OFF" ? "off" : "unreported" };
+		}),
+		setLegalHold: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(SetHold, input, "setLegalHold", storage.provider, true);
+			if (value.status === "off" && !value.releaseIntent) return yield* storageError("setLegalHold", storage.provider, {
+				_tag: "InvalidInput",
+				field: "releaseIntent"
+			}, "not-started");
+			const target = yield* selected(value.ref, "setLegalHold");
+			yield* request(storage, "setLegalHold", true, (signal) => storage.client.send(new PutObjectLegalHoldCommand({
+				...target,
+				LegalHold: { Status: value.status === "on" ? "ON" : "OFF" }
+			}), { abortSignal: signal }));
+			return { _tag: "Accepted" };
+		}),
+		deleteVersion: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(DeleteProtected, input, "deleteProtectedVersion", storage.provider, true);
+			const target = yield* selected(value.ref, "deleteProtectedVersion");
+			yield* request(storage, "deleteProtectedVersion", true, (signal) => storage.client.send(new DeleteObjectCommand({
+				...target,
+				BypassGovernanceRetention: true
+			}), { abortSignal: signal }));
+		})
+	};
+};
+var S3ObjectLock = class S3ObjectLock extends Context.Service()("@effect-kit/storage/s3/S3ObjectLock") {
+	static make = make;
+	static layer = Layer.effect(S3ObjectLock, Effect.map(S3Storage, make));
+};
+
+export { GovernanceBypass, RetentionPolicy, S3ObjectLock };
+//# sourceMappingURL=governance.js.map

package/dist/s3/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","names":[],"sources":["../../src/providers/s3/governance.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Schema } from \"effect\";\n\nimport {\n  DeleteObjectCommand,\n  GetObjectLegalHoldCommand,\n  GetObjectRetentionCommand,\n  PutObjectLegalHoldCommand,\n  PutObjectRetentionCommand,\n} from \"@aws-sdk/client-s3\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { VersionRef } from \"../../lifecycle/index.js\";\nimport { S3Storage } from \"./index.js\";\nimport type { S3StorageService } from \"./index.js\";\nimport { lifecycleFeature, lifecycleTarget } from \"./lifecycle-validation.js\";\nimport { request } from \"./transport.js\";\n\nexport const GovernanceBypass = Schema.Struct({\n  intent: Schema.Literal(\"bypass-governance\"),\n  reason: Schema.NonEmptyString,\n});\nexport const RetentionPolicy = Schema.Struct({\n  mode: Schema.Literals([\"governance\", \"compliance\"]),\n  retainUntil: Schema.DateTimeUtc,\n});\nconst Target = Schema.Struct({ ref: VersionRef });\nconst SetRetention = Schema.Struct({\n  ...Target.fields,\n  retention: RetentionPolicy,\n  bypassGovernance: Schema.optional(GovernanceBypass),\n});\nconst SetHold = Schema.Struct({\n  ...Target.fields,\n  status: Schema.Literals([\"on\", \"off\"]),\n  releaseIntent: Schema.optional(Schema.Literal(\"release-object-hold\")),\n});\nconst DeleteProtected = Schema.Struct({ ...Target.fields, bypassGovernance: GovernanceBypass });\n\nconst make = (storage: S3StorageService) => {\n  const selected = Effect.fnUntraced(function* (ref: VersionRef, operation: string) {\n    yield* lifecycleFeature(storage, \"protection\");\n    return yield* lifecycleTarget(storage, ref, operation, true);\n  });\n  return {\n    getRetention: Effect.fnUntraced(function* (input: typeof Target.Type) {\n      const value = yield* decodeRequest(Target, input, \"getRetention\", storage.provider);\n      const target = yield* selected(value.ref, \"getRetention\");\n      const output = yield* request(storage, \"getRetention\", false, (signal) =>\n        storage.client.send(new GetObjectRetentionCommand(target), { abortSignal: signal }),\n      );\n      if (!output.Retention?.Mode && !output.Retention?.RetainUntilDate)\n        return { _tag: \"None\" as const };\n      if (\n        !output.Retention?.Mode ||\n        ![\"GOVERNANCE\", \"COMPLIANCE\"].includes(output.Retention.Mode) ||\n        !output.Retention.RetainUntilDate ||\n        !Number.isFinite(output.Retention.RetainUntilDate.getTime())\n      )\n        return yield* storageError(\"getRetention\", storage.provider, {\n          _tag: \"ProviderFailure\",\n          code: \"InvalidRetention\",\n        });\n      return {\n        _tag: \"Retention\" as const,\n        mode:\n          output.Retention.Mode === \"GOVERNANCE\"\n            ? (\"governance\" as const)\n            : (\"compliance\" as const),\n        retainUntil: DateTime.makeUnsafe(output.Retention.RetainUntilDate),\n      };\n    }),\n    setRetention: Effect.fnUntraced(function* (input: typeof SetRetention.Type) {\n      const value = yield* decodeRequest(\n        SetRetention,\n        input,\n        \"setRetention\",\n        storage.provider,\n        true,\n      );\n      const target = yield* selected(value.ref, \"setRetention\");\n      const now = yield* DateTime.now;\n      if (DateTime.toEpochMillis(value.retention.retainUntil) <= DateTime.toEpochMillis(now))\n        return yield* storageError(\n          \"setRetention\",\n          storage.provider,\n          { _tag: \"InvalidInput\", field: \"retainUntil\" },\n          \"not-started\",\n        );\n      yield* request(storage, \"setRetention\", true, (signal) =>\n        storage.client.send(\n          new PutObjectRetentionCommand({\n            ...target,\n            Retention: {\n              Mode: value.retention.mode === \"governance\" ? \"GOVERNANCE\" : \"COMPLIANCE\",\n              RetainUntilDate: DateTime.toDateUtc(value.retention.retainUntil),\n            },\n            ...(value.bypassGovernance ? { BypassGovernanceRetention: true } : {}),\n          }),\n          { abortSignal: signal },\n        ),\n      );\n      return { _tag: \"Accepted\" as const };\n    }),\n    getLegalHold: Effect.fnUntraced(function* (input: typeof Target.Type) {\n      const value = yield* decodeRequest(Target, input, \"getLegalHold\", storage.provider);\n      const target = yield* selected(value.ref, \"getLegalHold\");\n      const output = yield* request(storage, \"getLegalHold\", false, (signal) =>\n        storage.client.send(new GetObjectLegalHoldCommand(target), { abortSignal: signal }),\n      );\n      return {\n        status:\n          output.LegalHold?.Status === \"ON\"\n            ? (\"on\" as const)\n            : output.LegalHold?.Status === \"OFF\"\n              ? (\"off\" as const)\n              : (\"unreported\" as const),\n      };\n    }),\n    setLegalHold: Effect.fnUntraced(function* (input: typeof SetHold.Type) {\n      const value = yield* decodeRequest(SetHold, input, \"setLegalHold\", storage.provider, true);\n      if (value.status === \"off\" && !value.releaseIntent)\n        return yield* storageError(\n          \"setLegalHold\",\n          storage.provider,\n          { _tag: \"InvalidInput\", field: \"releaseIntent\" },\n          \"not-started\",\n        );\n      const target = yield* selected(value.ref, \"setLegalHold\");\n      yield* request(storage, \"setLegalHold\", true, (signal) =>\n        storage.client.send(\n          new PutObjectLegalHoldCommand({\n            ...target,\n            LegalHold: { Status: value.status === \"on\" ? \"ON\" : \"OFF\" },\n          }),\n          { abortSignal: signal },\n        ),\n      );\n      return { _tag: \"Accepted\" as const };\n    }),\n    deleteVersion: Effect.fnUntraced(function* (input: typeof DeleteProtected.Type) {\n      const value = yield* decodeRequest(\n        DeleteProtected,\n        input,\n        \"deleteProtectedVersion\",\n        storage.provider,\n        true,\n      );\n      const target = yield* selected(value.ref, \"deleteProtectedVersion\");\n      yield* request(storage, \"deleteProtectedVersion\", true, (signal) =>\n        storage.client.send(\n          new DeleteObjectCommand({ ...target, BypassGovernanceRetention: true }),\n          { abortSignal: signal },\n        ),\n      );\n    }),\n  };\n};\nexport type S3ObjectLockService = ReturnType<typeof make>;\nexport class S3ObjectLock extends Context.Service<S3ObjectLock, S3ObjectLockService>()(\n  \"@effect-kit/storage/s3/S3ObjectLock\",\n) {\n  static readonly make = make;\n  static readonly layer = Layer.effect(S3ObjectLock, Effect.map(S3Storage, make));\n}\n"],"mappings":";;;;;;;;;;AAkBA,MAAa,mBAAmB,OAAO,OAAO;CAC5C,QAAQ,OAAO,QAAQ,mBAAmB;CAC1C,QAAQ,OAAO;AACjB,CAAC;AACD,MAAa,kBAAkB,OAAO,OAAO;CAC3C,MAAM,OAAO,SAAS,CAAC,cAAc,YAAY,CAAC;CAClD,aAAa,OAAO;AACtB,CAAC;AACD,MAAM,SAAS,OAAO,OAAO,EAAE,KAAK,WAAW,CAAC;AAChD,MAAM,eAAe,OAAO,OAAO;CACjC,GAAG,OAAO;CACV,WAAW;CACX,kBAAkB,OAAO,SAAS,gBAAgB;AACpD,CAAC;AACD,MAAM,UAAU,OAAO,OAAO;CAC5B,GAAG,OAAO;CACV,QAAQ,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;CACrC,eAAe,OAAO,SAAS,OAAO,QAAQ,qBAAqB,CAAC;AACtE,CAAC;AACD,MAAM,kBAAkB,OAAO,OAAO;CAAE,GAAG,OAAO;CAAQ,kBAAkB;AAAiB,CAAC;AAE9F,MAAM,QAAQ,YAA8B;CAC1C,MAAM,WAAW,OAAO,WAAW,WAAW,KAAiB,WAAmB;EAChF,OAAO,iBAAiB,SAAS,YAAY;EAC7C,OAAO,OAAO,gBAAgB,SAAS,KAAK,WAAW,IAAI;CAC7D,CAAC;CACD,OAAO;EACL,cAAc,OAAO,WAAW,WAAW,OAA2B;GACpE,MAAM,QAAQ,OAAO,cAAc,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ;GAClF,MAAM,SAAS,OAAO,SAAS,MAAM,KAAK,cAAc;GACxD,MAAM,SAAS,OAAO,QAAQ,SAAS,gBAAgB,QAAQ,WAC7D,QAAQ,OAAO,KAAK,IAAI,0BAA0B,MAAM,GAAG,EAAE,aAAa,OAAO,CAAC,CACpF;GACA,IAAI,CAAC,OAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,iBAChD,OAAO,EAAE,MAAM,OAAgB;GACjC,IACE,CAAC,OAAO,WAAW,QACnB,CAAC,CAAC,cAAc,YAAY,CAAC,CAAC,SAAS,OAAO,UAAU,IAAI,KAC5D,CAAC,OAAO,UAAU,mBAClB,CAAC,OAAO,SAAS,OAAO,UAAU,gBAAgB,QAAQ,CAAC,GAE3D,OAAO,OAAO,aAAa,gBAAgB,QAAQ,UAAU;IAC3D,MAAM;IACN,MAAM;GACR,CAAC;GACH,OAAO;IACL,MAAM;IACN,MACE,OAAO,UAAU,SAAS,eACrB,eACA;IACP,aAAa,SAAS,WAAW,OAAO,UAAU,eAAe;GACnE;EACF,CAAC;EACD,cAAc,OAAO,WAAW,WAAW,OAAiC;GAC1E,MAAM,QAAQ,OAAO,cACnB,cACA,OACA,gBACA,QAAQ,UACR,IACF;GACA,MAAM,SAAS,OAAO,SAAS,MAAM,KAAK,cAAc;GACxD,MAAM,MAAM,OAAO,SAAS;GAC5B,IAAI,SAAS,cAAc,MAAM,UAAU,WAAW,KAAK,SAAS,cAAc,GAAG,GACnF,OAAO,OAAO,aACZ,gBACA,QAAQ,UACR;IAAE,MAAM;IAAgB,OAAO;GAAc,GAC7C,aACF;GACF,OAAO,QAAQ,SAAS,gBAAgB,OAAO,WAC7C,QAAQ,OAAO,KACb,IAAI,0BAA0B;IAC5B,GAAG;IACH,WAAW;KACT,MAAM,MAAM,UAAU,SAAS,eAAe,eAAe;KAC7D,iBAAiB,SAAS,UAAU,MAAM,UAAU,WAAW;IACjE;IACA,GAAI,MAAM,mBAAmB,EAAE,2BAA2B,KAAK,IAAI,CAAC;GACtE,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;GACA,OAAO,EAAE,MAAM,WAAoB;EACrC,CAAC;EACD,cAAc,OAAO,WAAW,WAAW,OAA2B;GACpE,MAAM,QAAQ,OAAO,cAAc,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ;GAClF,MAAM,SAAS,OAAO,SAAS,MAAM,KAAK,cAAc;GACxD,MAAM,SAAS,OAAO,QAAQ,SAAS,gBAAgB,QAAQ,WAC7D,QAAQ,OAAO,KAAK,IAAI,0BAA0B,MAAM,GAAG,EAAE,aAAa,OAAO,CAAC,CACpF;GACA,OAAO,EACL,QACE,OAAO,WAAW,WAAW,OACxB,OACD,OAAO,WAAW,WAAW,QAC1B,QACA,aACX;EACF,CAAC;EACD,cAAc,OAAO,WAAW,WAAW,OAA4B;GACrE,MAAM,QAAQ,OAAO,cAAc,SAAS,OAAO,gBAAgB,QAAQ,UAAU,IAAI;GACzF,IAAI,MAAM,WAAW,SAAS,CAAC,MAAM,eACnC,OAAO,OAAO,aACZ,gBACA,QAAQ,UACR;IAAE,MAAM;IAAgB,OAAO;GAAgB,GAC/C,aACF;GACF,MAAM,SAAS,OAAO,SAAS,MAAM,KAAK,cAAc;GACxD,OAAO,QAAQ,SAAS,gBAAgB,OAAO,WAC7C,QAAQ,OAAO,KACb,IAAI,0BAA0B;IAC5B,GAAG;IACH,WAAW,EAAE,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;GAC5D,CAAC,GACD,EAAE,aAAa,OAAO,CACxB,CACF;GACA,OAAO,EAAE,MAAM,WAAoB;EACrC,CAAC;EACD,eAAe,OAAO,WAAW,WAAW,OAAoC;GAC9E,MAAM,QAAQ,OAAO,cACnB,iBACA,OACA,0BACA,QAAQ,UACR,IACF;GACA,MAAM,SAAS,OAAO,SAAS,MAAM,KAAK,wBAAwB;GAClE,OAAO,QAAQ,SAAS,0BAA0B,OAAO,WACvD,QAAQ,OAAO,KACb,IAAI,oBAAoB;IAAE,GAAG;IAAQ,2BAA2B;GAAK,CAAC,GACtE,EAAE,aAAa,OAAO,CACxB,CACF;EACF,CAAC;CACH;AACF;AAEA,IAAa,eAAb,MAAa,qBAAqB,QAAQ,QAA2C,CAAC,CACpF,qCACF,CAAC,CAAC;CACA,OAAgB,OAAO;CACvB,OAAgB,QAAQ,MAAM,OAAO,cAAc,OAAO,IAAI,WAAW,IAAI,CAAC;AAChF"}

package/dist/s3/lifecycle.d.ts

@@ -0,0 +1,4 @@
+import { S3Versions } from "../providers/s3/versions.js";
+import { S3Tags } from "../providers/s3/tags.js";
+import { S3Metadata } from "../providers/s3/metadata.js";
+export { S3Metadata, S3Tags, S3Versions };

package/dist/s3/lifecycle.js

@@ -0,0 +1,5 @@
+import { S3Versions } from "../providers/s3/versions.js";
+import { S3Tags } from "../providers/s3/tags.js";
+import { S3Metadata } from "../providers/s3/metadata.js";
+
+export { S3Metadata, S3Tags, S3Versions };

package/dist/s3/post.d.ts

@@ -0,0 +1,31 @@
+import { ObjectRef } from "../core/object.js";
+import { StorageError } from "../core/errors.js";
+import { GrantConstraint } from "../core/capabilities.js";
+import { S3Storage, S3StorageService } from "../s3.js";
+import { Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+declare const PostRequest: Schema.Struct<{
+  readonly key: Schema.NonEmptyString;
+  readonly expiresInSeconds: Schema.Int;
+  readonly maxBytes: Schema.Natural;
+  readonly minBytes: Schema.optional<Schema.Natural>;
+  readonly contentType: Schema.optional<Schema.String>;
+  readonly customMetadata: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+}>;
+export type S3PostRequest = typeof PostRequest.Type;
+export interface S3PostGrant {
+  readonly method: "POST";
+  readonly ref: ObjectRef;
+  readonly url: Redacted.Redacted<string>;
+  readonly fields: Redacted.Redacted<Readonly<Record<string, string>>>;
+  readonly expiresAt: DateTime.Utc;
+  readonly constraints: ReadonlyArray<GrantConstraint>;
+}
+declare const S3Post_base: Context.ServiceClass<S3Post, "@effect-kit/storage/s3/S3Post", {
+  readonly create: (input: S3PostRequest) => Effect.Effect<S3PostGrant, StorageError>;
+}>;
+export declare class S3Post extends S3Post_base {
+  static make(storage: S3StorageService): S3Post["Service"];
+  static readonly layer: Layer.Layer<S3Post, never, S3Storage>;
+}
+export {};
+//# sourceMappingURL=post.d.ts.map

package/dist/s3/post.js

@@ -0,0 +1,93 @@
+import { HeaderValue, ObjectKey } from "../core/object.js";
+import { storageError } from "../core/errors.js";
+import { decodeRequest } from "../internal/request-validation.js";
+import { request } from "../providers/s3/transport.js";
+import { S3Storage } from "../s3.js";
+import { signingCredentials } from "../providers/s3/signing-credentials.js";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
+
+// src/providers/s3/post.ts
+const PostRequest = Schema.Struct({
+	key: ObjectKey,
+	expiresInSeconds: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 604800
+	})),
+	maxBytes: Schema.Natural,
+	minBytes: Schema.optional(Schema.Natural),
+	contentType: Schema.optional(HeaderValue),
+	customMetadata: Schema.optional(Schema.Record(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]+$/u)), HeaderValue))
+});
+var S3Post = class S3Post extends Context.Service()("@effect-kit/storage/s3/S3Post") {
+	static make(storage) {
+		return { create: Effect.fnUntraced(function* (input) {
+			const value = yield* decodeRequest(PostRequest, input, "post", "s3");
+			if (storage.profile && (!storage.profile.post || value.maxBytes > storage.profile.limits.maximumSinglePutBytes)) return yield* storageError("post", storage.profile.provider, {
+				_tag: "Unsupported",
+				capability: "post-policy"
+			}, "not-started");
+			if ((value.minBytes ?? 0) > value.maxBytes || value.key.includes(`\${filename}`)) return yield* storageError("post", "s3", {
+				_tag: "InvalidInput",
+				field: "policy"
+			});
+			if (storage.config.encryption || storage.config.expectedBucketOwner || storage.config.requestPayer) return yield* storageError("post", "s3", {
+				_tag: "Unsupported",
+				capability: "post-config-authority"
+			});
+			const credentials = yield* signingCredentials(storage, value.expiresInSeconds);
+			const fields = {};
+			if (value.contentType !== void 0) fields["Content-Type"] = value.contentType;
+			for (const [name, content] of Object.entries(value.customMetadata ?? {})) fields[`x-amz-meta-${name.toLowerCase()}`] = content;
+			const grant = yield* request(storage, "post", false, () => createPresignedPost(credentials.client, {
+				Bucket: storage.config.bucket,
+				Key: value.key,
+				Expires: credentials.seconds,
+				Fields: fields,
+				Conditions: [[
+					"content-length-range",
+					value.minBytes ?? 0,
+					value.maxBytes
+				]]
+			}));
+			const policy = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+				expiration: Schema.DateTimeUtcFromString,
+				conditions: Schema.Array(Schema.Unknown)
+			})))(Buffer.from(grant.fields.Policy ?? "", "base64").toString("utf8")).pipe(Effect.mapError(() => storageError("post", "s3", {
+				_tag: "ProviderFailure",
+				code: "InvalidPostPolicy"
+			})));
+			return {
+				method: "POST",
+				ref: {
+					storeId: storage.storeId,
+					key: value.key
+				},
+				url: Redacted.make(grant.url),
+				fields: Redacted.make(grant.fields),
+				expiresAt: policy.expiration,
+				constraints: [
+					{
+						kind: "minimum-bytes",
+						enforcement: "provider",
+						value: value.minBytes ?? 0
+					},
+					{
+						kind: "maximum-bytes",
+						enforcement: "provider",
+						value: value.maxBytes
+					},
+					...Object.keys(fields).map((name) => ({
+						kind: `field:${name}`,
+						enforcement: "provider",
+						value: "required"
+					}))
+				]
+			};
+		}) };
+	}
+	static layer = Layer.effect(S3Post, Effect.map(S3Storage, S3Post.make));
+};
+
+export { S3Post };
+//# sourceMappingURL=post.js.map