@effect-kit/storage 0.0.0-stage → 0.0.0

package/dist/uploads/schema.d.ts

@@ -0,0 +1,278 @@
+import { ObjectRef } from "../core/object.js";
+import { Schema } from "effect";
+export declare const UploadId: Schema.String;
+export declare const UploadActor: Schema.Struct<{
+  readonly subject: Schema.NonEmptyString;
+  readonly tenantId: Schema.optional<Schema.NonEmptyString>;
+}>;
+export type UploadActor = typeof UploadActor.Type;
+export declare const UploadFile: Schema.Struct<{
+  readonly name: Schema.String;
+  readonly size: Schema.Natural;
+  readonly contentType: Schema.String;
+  readonly sha256: Schema.String;
+}>;
+export declare const UploadInput: Schema.Struct<{
+  readonly purpose: Schema.NonEmptyString;
+  readonly file: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly size: Schema.Natural;
+    readonly contentType: Schema.String;
+    readonly sha256: Schema.String;
+  }>;
+  readonly context: Schema.$Record<Schema.String, Schema.String>;
+  readonly strategy: Schema.optional<Schema.Literals<readonly ["auto", "single", "post", "multipart", "resumable", "proxy"]>>;
+}>;
+export type UploadInput = typeof UploadInput.Type;
+export declare const UploadRequest: Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly idempotencyKey: Schema.String;
+  readonly input: Schema.Struct<{
+    readonly purpose: Schema.NonEmptyString;
+    readonly file: Schema.Struct<{
+      readonly name: Schema.String;
+      readonly size: Schema.Natural;
+      readonly contentType: Schema.String;
+      readonly sha256: Schema.String;
+    }>;
+    readonly context: Schema.$Record<Schema.String, Schema.String>;
+    readonly strategy: Schema.optional<Schema.Literals<readonly ["auto", "single", "post", "multipart", "resumable", "proxy"]>>;
+  }>;
+}>;
+export declare const UploadErrorCode: Schema.Literals<readonly ["BadRequest", "Unauthorized", "Forbidden", "NotFound", "Conflict", "Expired", "Unsupported", "VerificationFailed", "Unavailable"]>;
+declare const UploadError_base: Schema.Class<UploadError, Schema.TaggedStruct<"UploadError", {
+  readonly code: Schema.Literals<readonly ["BadRequest", "Unauthorized", "Forbidden", "NotFound", "Conflict", "Expired", "Unsupported", "VerificationFailed", "Unavailable"]>;
+}>, import("effect/Cause").YieldableError>;
+export declare class UploadError extends UploadError_base {}
+export declare const failUpload: (code: typeof UploadErrorCode.Type) => UploadError;
+export declare const UploadState: Schema.Literals<readonly ["reserving", "ready", "initiating", "uploading", "verifying", "publishing", "published", "aborted", "rejected"]>;
+export declare const UploadStatus: Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly id: Schema.String;
+  readonly state: Schema.Literals<readonly ["reserving", "ready", "initiating", "uploading", "verifying", "publishing", "published", "aborted", "rejected"]>;
+  readonly expiresAt: Schema.Number;
+  readonly cleanupPending: Schema.Boolean;
+  readonly result: Schema.optional<Schema.Unknown>;
+}>;
+export type UploadStatus = typeof UploadStatus.Type;
+export declare const UploadGrant: Schema.Union<readonly [Schema.Struct<{
+  readonly _tag: Schema.Literal<"SignedRequest">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly method: Schema.Literal<"PUT">;
+  readonly url: Schema.String;
+  readonly headers: Schema.$Record<Schema.String, Schema.String>;
+  readonly expiresAt: Schema.Number;
+  readonly partReceipt: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"PostForm">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly url: Schema.String;
+  readonly fields: Schema.$Record<Schema.String, Schema.String>;
+  readonly expiresAt: Schema.Number;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Multipart">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly partBytes: Schema.Int;
+  readonly checksum: Schema.optional<Schema.Literal<"sha256">>;
+  readonly expiresAt: Schema.Number;
+  readonly completed: Schema.$Array<Schema.Struct<{
+    readonly partNumber: Schema.Natural;
+    readonly etag: Schema.String;
+  }>>;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Blocks">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly partBytes: Schema.Int;
+  readonly completed: Schema.$Array<Schema.Natural>;
+  readonly expiresAt: Schema.Number;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Resumable">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly protocol: Schema.Literals<readonly ["gcs", "tus"]>;
+  readonly url: Schema.String;
+  readonly headers: Schema.$Record<Schema.String, Schema.String>;
+  readonly offset: Schema.Natural;
+  readonly chunkBytes: Schema.Int;
+  readonly expiresAt: Schema.Number;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Proxy">;
+  readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.String;
+    readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+    readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+  }>>>;
+  readonly expiresAt: Schema.Number;
+}>]>;
+export type UploadGrant = typeof UploadGrant.Type;
+export declare const GrantResponse: Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly id: Schema.String;
+  readonly grant: Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"SignedRequest">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly method: Schema.Literal<"PUT">;
+    readonly url: Schema.String;
+    readonly headers: Schema.$Record<Schema.String, Schema.String>;
+    readonly expiresAt: Schema.Number;
+    readonly partReceipt: Schema.optional<Schema.String>;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"PostForm">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly url: Schema.String;
+    readonly fields: Schema.$Record<Schema.String, Schema.String>;
+    readonly expiresAt: Schema.Number;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Multipart">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly partBytes: Schema.Int;
+    readonly checksum: Schema.optional<Schema.Literal<"sha256">>;
+    readonly expiresAt: Schema.Number;
+    readonly completed: Schema.$Array<Schema.Struct<{
+      readonly partNumber: Schema.Natural;
+      readonly etag: Schema.String;
+    }>>;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Blocks">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly partBytes: Schema.Int;
+    readonly completed: Schema.$Array<Schema.Natural>;
+    readonly expiresAt: Schema.Number;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Resumable">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly protocol: Schema.Literals<readonly ["gcs", "tus"]>;
+    readonly url: Schema.String;
+    readonly headers: Schema.$Record<Schema.String, Schema.String>;
+    readonly offset: Schema.Natural;
+    readonly chunkBytes: Schema.Int;
+    readonly expiresAt: Schema.Number;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Proxy">;
+    readonly constraints: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.String;
+      readonly enforcement: Schema.Literals<readonly ["provider", "backend", "advisory"]>;
+      readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>>>;
+    readonly expiresAt: Schema.Number;
+  }>]>;
+}>;
+export declare const PartRequest: Schema.Struct<{
+  readonly sha256: Schema.optional<Schema.String>;
+  readonly partNumber: Schema.Int;
+}>;
+export declare const PartsRequest: Schema.Struct<{
+  readonly parts: Schema.$Array<Schema.Struct<{
+    readonly partNumber: Schema.Int;
+    readonly receipt: Schema.NonEmptyString;
+  }>>;
+}>;
+export declare const UploadRecord: Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly id: Schema.String;
+  readonly actor: Schema.Struct<{
+    readonly subject: Schema.NonEmptyString;
+    readonly tenantId: Schema.optional<Schema.NonEmptyString>;
+  }>;
+  readonly input: Schema.Struct<{
+    readonly purpose: Schema.NonEmptyString;
+    readonly file: Schema.Struct<{
+      readonly name: Schema.String;
+      readonly size: Schema.Natural;
+      readonly contentType: Schema.String;
+      readonly sha256: Schema.String;
+    }>;
+    readonly context: Schema.$Record<Schema.String, Schema.String>;
+    readonly strategy: Schema.optional<Schema.Literals<readonly ["auto", "single", "post", "multipart", "resumable", "proxy"]>>;
+  }>;
+  readonly storeId: Schema.String;
+  readonly key: Schema.String;
+  readonly stagingKey: Schema.String;
+  readonly publishedKey: Schema.String;
+  readonly context: Schema.$Record<Schema.String, Schema.String>;
+  readonly expiresAt: Schema.Number;
+  readonly grantExpiresAt: Schema.Number;
+  readonly state: Schema.Literals<readonly ["reserving", "ready", "initiating", "uploading", "verifying", "publishing", "published", "aborted", "rejected"]>;
+  readonly cleanupPending: Schema.Boolean;
+  readonly remote: Schema.optional<Schema.Redacted<Schema.Unknown>>;
+  readonly object: Schema.optional<Schema.Struct<{
+    readonly contentType: Schema.optional<Schema.String>;
+    readonly contentEncoding: Schema.optional<Schema.String>;
+    readonly contentLanguage: Schema.optional<Schema.String>;
+    readonly contentDisposition: Schema.optional<Schema.String>;
+    readonly cacheControl: Schema.optional<Schema.String>;
+    readonly customMetadata: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly ref: Schema.Struct<{
+      readonly storeId: Schema.NonEmptyString;
+      readonly key: Schema.NonEmptyString;
+      readonly version: Schema.optional<Schema.Union<readonly [Schema.TaggedStruct<"S3Version", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"GcsGeneration", {
+        readonly id: Schema.NonEmptyString;
+        readonly metageneration: Schema.optional<Schema.NonEmptyString>;
+      }>, Schema.TaggedStruct<"AzureVersion", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"AzureSnapshot", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"OpaqueVersion", {
+        readonly provider: Schema.NonEmptyString;
+        readonly id: Schema.NonEmptyString;
+      }>]>>;
+    }>;
+    readonly size: Schema.optional<Schema.Natural>;
+    readonly etag: Schema.optional<Schema.String>;
+    readonly lastModified: Schema.optional<Schema.DateTimeUtcFromString>;
+    readonly checksums: Schema.optional<Schema.$Array<Schema.Struct<{
+      readonly algorithm: Schema.NonEmptyString;
+      readonly encoding: Schema.Literals<readonly ["hex", "base64"]>;
+      readonly scope: Schema.Literals<readonly ["full-object", "composite"]>;
+      readonly value: Schema.NonEmptyString;
+      readonly partCount: Schema.optional<Schema.Int>;
+    }>>>;
+    readonly storageClass: Schema.optional<Schema.NonEmptyString>;
+  }>>;
+  readonly result: Schema.optional<Schema.Unknown>;
+}>;
+export type UploadRecord = typeof UploadRecord.Type;
+export type PublishedObject = typeof ObjectRef.Type;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/uploads/schema.js

@@ -0,0 +1,167 @@
+import { ObjectMetadata, ObjectSize } from "../core/object.js";
+import { Schema } from "effect";
+
+// src/uploads/schema.ts
+const UploadId = Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u));
+const UploadActor = Schema.Struct({
+	subject: Schema.NonEmptyString,
+	tenantId: Schema.optional(Schema.NonEmptyString)
+});
+const UploadFile = Schema.Struct({
+	name: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(255), Schema.isPattern(/^[^\r\n\0/\\]+$/u)),
+	size: ObjectSize,
+	contentType: Schema.String.check(Schema.isPattern(/^[\w!#$&^.+-]+\/[\w!#$&^.+-]+$/u)),
+	sha256: Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u))
+});
+const UploadInput = Schema.Struct({
+	purpose: Schema.NonEmptyString,
+	file: UploadFile,
+	context: Schema.Record(Schema.String, Schema.String),
+	strategy: Schema.optional(Schema.Literals([
+		"auto",
+		"single",
+		"post",
+		"multipart",
+		"resumable",
+		"proxy"
+	]))
+});
+const UploadRequest = Schema.Struct({
+	version: Schema.Literal(1),
+	idempotencyKey: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(200)),
+	input: UploadInput
+});
+const UploadErrorCode = Schema.Literals([
+	"BadRequest",
+	"Unauthorized",
+	"Forbidden",
+	"NotFound",
+	"Conflict",
+	"Expired",
+	"Unsupported",
+	"VerificationFailed",
+	"Unavailable"
+]);
+var UploadError = class extends Schema.TaggedError()("UploadError", { code: UploadErrorCode }) {};
+const failUpload = (code) => new UploadError({ code });
+const UploadState = Schema.Literals([
+	"reserving",
+	"ready",
+	"initiating",
+	"uploading",
+	"verifying",
+	"publishing",
+	"published",
+	"aborted",
+	"rejected"
+]);
+const UploadStatus = Schema.Struct({
+	version: Schema.Literal(1),
+	id: UploadId,
+	state: UploadState,
+	expiresAt: Schema.Number,
+	cleanupPending: Schema.Boolean,
+	result: Schema.optional(Schema.Unknown)
+});
+const Constraints = Schema.optional(Schema.Array(Schema.Struct({
+	kind: Schema.String,
+	enforcement: Schema.Literals([
+		"provider",
+		"backend",
+		"advisory"
+	]),
+	value: Schema.Union([Schema.String, Schema.Number])
+})));
+const RequestGrant = Schema.Struct({
+	_tag: Schema.Literal("SignedRequest"),
+	constraints: Constraints,
+	method: Schema.Literal("PUT"),
+	url: Schema.String,
+	headers: Schema.Record(Schema.String, Schema.String),
+	expiresAt: Schema.Number,
+	partReceipt: Schema.optional(Schema.String)
+});
+const PostGrant = Schema.Struct({
+	_tag: Schema.Literal("PostForm"),
+	constraints: Constraints,
+	url: Schema.String,
+	fields: Schema.Record(Schema.String, Schema.String),
+	expiresAt: Schema.Number
+});
+const MultipartGrant = Schema.Struct({
+	_tag: Schema.Literal("Multipart"),
+	constraints: Constraints,
+	partBytes: Schema.Int.check(Schema.isGreaterThan(0)),
+	checksum: Schema.optional(Schema.Literal("sha256")),
+	expiresAt: Schema.Number,
+	completed: Schema.Array(Schema.Struct({
+		partNumber: Schema.Natural,
+		etag: Schema.String
+	}))
+});
+const ResumableGrant = Schema.Struct({
+	_tag: Schema.Literal("Resumable"),
+	constraints: Constraints,
+	protocol: Schema.Literals(["gcs", "tus"]),
+	url: Schema.String,
+	headers: Schema.Record(Schema.String, Schema.String),
+	offset: ObjectSize,
+	chunkBytes: Schema.Int.check(Schema.isGreaterThan(0)),
+	expiresAt: Schema.Number
+});
+const BlocksGrant = Schema.Struct({
+	_tag: Schema.Literal("Blocks"),
+	constraints: Constraints,
+	partBytes: Schema.Int.check(Schema.isGreaterThan(0)),
+	completed: Schema.Array(Schema.Natural),
+	expiresAt: Schema.Number
+});
+const UploadGrant = Schema.Union([
+	RequestGrant,
+	PostGrant,
+	MultipartGrant,
+	BlocksGrant,
+	ResumableGrant,
+	Schema.Struct({
+		_tag: Schema.Literal("Proxy"),
+		constraints: Constraints,
+		expiresAt: Schema.Number
+	})
+]);
+const GrantResponse = Schema.Struct({
+	version: Schema.Literal(1),
+	id: UploadId,
+	grant: UploadGrant
+});
+const PartRequest = Schema.Struct({
+	sha256: Schema.optional(Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u))),
+	partNumber: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e4
+	}))
+});
+const PartsRequest = Schema.Struct({ parts: Schema.Array(Schema.Struct({
+	partNumber: PartRequest.fields.partNumber,
+	receipt: Schema.NonEmptyString
+})).check(Schema.isMaxLength(1e4)) });
+const UploadRecord = Schema.Struct({
+	version: Schema.Literal(1),
+	id: UploadId,
+	actor: UploadActor,
+	input: UploadInput,
+	storeId: Schema.String,
+	key: Schema.String,
+	stagingKey: Schema.String,
+	publishedKey: Schema.String,
+	context: Schema.Record(Schema.String, Schema.String),
+	expiresAt: Schema.Number,
+	grantExpiresAt: Schema.Number,
+	state: UploadState,
+	cleanupPending: Schema.Boolean,
+	remote: Schema.optional(Schema.Redacted(Schema.Unknown)),
+	object: Schema.optional(ObjectMetadata),
+	result: Schema.optional(Schema.Unknown)
+});
+
+export { GrantResponse, PartRequest, PartsRequest, UploadActor, UploadError, UploadErrorCode, UploadFile, UploadGrant, UploadId, UploadInput, UploadRecord, UploadRequest, UploadState, UploadStatus, failUpload };
+//# sourceMappingURL=schema.js.map

package/dist/uploads/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","names":[],"sources":["../../src/uploads/schema.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport type { ObjectRef } from \"../core/object.js\";\nimport { ObjectMetadata, ObjectSize } from \"../core/object.js\";\n\nexport const UploadId = Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u));\nexport const UploadActor = Schema.Struct({\n  subject: Schema.NonEmptyString,\n  tenantId: Schema.optional(Schema.NonEmptyString),\n});\nexport type UploadActor = typeof UploadActor.Type;\nexport const UploadFile = Schema.Struct({\n  name: Schema.String.check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(255),\n    Schema.isPattern(/^[^\\r\\n\\0/\\\\]+$/u),\n  ),\n  size: ObjectSize,\n  contentType: Schema.String.check(Schema.isPattern(/^[\\w!#$&^.+-]+\\/[\\w!#$&^.+-]+$/u)),\n  sha256: Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u)),\n});\nexport const UploadInput = Schema.Struct({\n  purpose: Schema.NonEmptyString,\n  file: UploadFile,\n  context: Schema.Record(Schema.String, Schema.String),\n  strategy: Schema.optional(\n    Schema.Literals([\"auto\", \"single\", \"post\", \"multipart\", \"resumable\", \"proxy\"]),\n  ),\n});\nexport type UploadInput = typeof UploadInput.Type;\nexport const UploadRequest = Schema.Struct({\n  version: Schema.Literal(1),\n  idempotencyKey: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(200)),\n  input: UploadInput,\n});\nexport const UploadErrorCode = Schema.Literals([\n  \"BadRequest\",\n  \"Unauthorized\",\n  \"Forbidden\",\n  \"NotFound\",\n  \"Conflict\",\n  \"Expired\",\n  \"Unsupported\",\n  \"VerificationFailed\",\n  \"Unavailable\",\n]);\nexport class UploadError extends Schema.TaggedError<UploadError>()(\"UploadError\", {\n  code: UploadErrorCode,\n}) {}\nexport const failUpload = (code: typeof UploadErrorCode.Type) => new UploadError({ code });\nexport const UploadState = Schema.Literals([\n  \"reserving\",\n  \"ready\",\n  \"initiating\",\n  \"uploading\",\n  \"verifying\",\n  \"publishing\",\n  \"published\",\n  \"aborted\",\n  \"rejected\",\n]);\nexport const UploadStatus = Schema.Struct({\n  version: Schema.Literal(1),\n  id: UploadId,\n  state: UploadState,\n  expiresAt: Schema.Number,\n  cleanupPending: Schema.Boolean,\n  result: Schema.optional(Schema.Unknown),\n});\nexport type UploadStatus = typeof UploadStatus.Type;\nconst Constraints = Schema.optional(\n  Schema.Array(\n    Schema.Struct({\n      kind: Schema.String,\n      enforcement: Schema.Literals([\"provider\", \"backend\", \"advisory\"]),\n      value: Schema.Union([Schema.String, Schema.Number]),\n    }),\n  ),\n);\nconst RequestGrant = Schema.Struct({\n  _tag: Schema.Literal(\"SignedRequest\"),\n  constraints: Constraints,\n  method: Schema.Literal(\"PUT\"),\n  url: Schema.String,\n  headers: Schema.Record(Schema.String, Schema.String),\n  expiresAt: Schema.Number,\n  partReceipt: Schema.optional(Schema.String),\n});\nconst PostGrant = Schema.Struct({\n  _tag: Schema.Literal(\"PostForm\"),\n  constraints: Constraints,\n  url: Schema.String,\n  fields: Schema.Record(Schema.String, Schema.String),\n  expiresAt: Schema.Number,\n});\nconst MultipartGrant = Schema.Struct({\n  _tag: Schema.Literal(\"Multipart\"),\n  constraints: Constraints,\n  partBytes: Schema.Int.check(Schema.isGreaterThan(0)),\n  checksum: Schema.optional(Schema.Literal(\"sha256\")),\n  expiresAt: Schema.Number,\n  completed: Schema.Array(Schema.Struct({ partNumber: Schema.Natural, etag: Schema.String })),\n});\nconst ResumableGrant = Schema.Struct({\n  _tag: Schema.Literal(\"Resumable\"),\n  constraints: Constraints,\n  protocol: Schema.Literals([\"gcs\", \"tus\"]),\n  url: Schema.String,\n  headers: Schema.Record(Schema.String, Schema.String),\n  offset: ObjectSize,\n  chunkBytes: Schema.Int.check(Schema.isGreaterThan(0)),\n  expiresAt: Schema.Number,\n});\nconst BlocksGrant = Schema.Struct({\n  _tag: Schema.Literal(\"Blocks\"),\n  constraints: Constraints,\n  partBytes: Schema.Int.check(Schema.isGreaterThan(0)),\n  completed: Schema.Array(Schema.Natural),\n  expiresAt: Schema.Number,\n});\nexport const UploadGrant = Schema.Union([\n  RequestGrant,\n  PostGrant,\n  MultipartGrant,\n  BlocksGrant,\n  ResumableGrant,\n  Schema.Struct({\n    _tag: Schema.Literal(\"Proxy\"),\n    constraints: Constraints,\n    expiresAt: Schema.Number,\n  }),\n]);\nexport type UploadGrant = typeof UploadGrant.Type;\nexport const GrantResponse = Schema.Struct({\n  version: Schema.Literal(1),\n  id: UploadId,\n  grant: UploadGrant,\n});\nexport const PartRequest = Schema.Struct({\n  sha256: Schema.optional(Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u))),\n  partNumber: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 10000 })),\n});\nexport const PartsRequest = Schema.Struct({\n  parts: Schema.Array(\n    Schema.Struct({ partNumber: PartRequest.fields.partNumber, receipt: Schema.NonEmptyString }),\n  ).check(Schema.isMaxLength(10000)),\n});\nexport const UploadRecord = Schema.Struct({\n  version: Schema.Literal(1),\n  id: UploadId,\n  actor: UploadActor,\n  input: UploadInput,\n  storeId: Schema.String,\n  key: Schema.String,\n  stagingKey: Schema.String,\n  publishedKey: Schema.String,\n  context: Schema.Record(Schema.String, Schema.String),\n  expiresAt: Schema.Number,\n  grantExpiresAt: Schema.Number,\n  state: UploadState,\n  cleanupPending: Schema.Boolean,\n  remote: Schema.optional(Schema.Redacted(Schema.Unknown)),\n  object: Schema.optional(ObjectMetadata),\n  result: Schema.optional(Schema.Unknown),\n});\nexport type UploadRecord = typeof UploadRecord.Type;\nexport type PublishedObject = typeof ObjectRef.Type;\n"],"mappings":";;;;AAKA,MAAa,WAAW,OAAO,OAAO,MAAM,OAAO,UAAU,iBAAiB,CAAC;AAC/E,MAAa,cAAc,OAAO,OAAO;CACvC,SAAS,OAAO;CAChB,UAAU,OAAO,SAAS,OAAO,cAAc;AACjD,CAAC;AAED,MAAa,aAAa,OAAO,OAAO;CACtC,MAAM,OAAO,OAAO,MAClB,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,kBAAkB,CACrC;CACA,MAAM;CACN,aAAa,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC;CACpF,QAAQ,OAAO,OAAO,MAAM,OAAO,UAAU,iBAAiB,CAAC;AACjE,CAAC;AACD,MAAa,cAAc,OAAO,OAAO;CACvC,SAAS,OAAO;CAChB,MAAM;CACN,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CACnD,UAAU,OAAO,SACf,OAAO,SAAS;EAAC;EAAQ;EAAU;EAAQ;EAAa;EAAa;CAAO,CAAC,CAC/E;AACF,CAAC;AAED,MAAa,gBAAgB,OAAO,OAAO;CACzC,SAAS,OAAO,QAAQ,CAAC;CACzB,gBAAgB,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC;CAClF,OAAO;AACT,CAAC;AACD,MAAa,kBAAkB,OAAO,SAAS;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,MAAM,gBACR,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,cAAc,SAAsC,IAAI,YAAY,EAAE,KAAK,CAAC;AACzF,MAAa,cAAc,OAAO,SAAS;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAa,eAAe,OAAO,OAAO;CACxC,SAAS,OAAO,QAAQ,CAAC;CACzB,IAAI;CACJ,OAAO;CACP,WAAW,OAAO;CAClB,gBAAgB,OAAO;CACvB,QAAQ,OAAO,SAAS,OAAO,OAAO;AACxC,CAAC;AAED,MAAM,cAAc,OAAO,SACzB,OAAO,MACL,OAAO,OAAO;CACZ,MAAM,OAAO;CACb,aAAa,OAAO,SAAS;EAAC;EAAY;EAAW;CAAU,CAAC;CAChE,OAAO,OAAO,MAAM,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AACpD,CAAC,CACH,CACF;AACA,MAAM,eAAe,OAAO,OAAO;CACjC,MAAM,OAAO,QAAQ,eAAe;CACpC,aAAa;CACb,QAAQ,OAAO,QAAQ,KAAK;CAC5B,KAAK,OAAO;CACZ,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CACnD,WAAW,OAAO;CAClB,aAAa,OAAO,SAAS,OAAO,MAAM;AAC5C,CAAC;AACD,MAAM,YAAY,OAAO,OAAO;CAC9B,MAAM,OAAO,QAAQ,UAAU;CAC/B,aAAa;CACb,KAAK,OAAO;CACZ,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CAClD,WAAW,OAAO;AACpB,CAAC;AACD,MAAM,iBAAiB,OAAO,OAAO;CACnC,MAAM,OAAO,QAAQ,WAAW;CAChC,aAAa;CACb,WAAW,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;CACnD,UAAU,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC;CAClD,WAAW,OAAO;CAClB,WAAW,OAAO,MAAM,OAAO,OAAO;EAAE,YAAY,OAAO;EAAS,MAAM,OAAO;CAAO,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,iBAAiB,OAAO,OAAO;CACnC,MAAM,OAAO,QAAQ,WAAW;CAChC,aAAa;CACb,UAAU,OAAO,SAAS,CAAC,OAAO,KAAK,CAAC;CACxC,KAAK,OAAO;CACZ,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CACnD,QAAQ;CACR,YAAY,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;CACpD,WAAW,OAAO;AACpB,CAAC;AACD,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,OAAO,QAAQ,QAAQ;CAC7B,aAAa;CACb,WAAW,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;CACnD,WAAW,OAAO,MAAM,OAAO,OAAO;CACtC,WAAW,OAAO;AACpB,CAAC;AACD,MAAa,cAAc,OAAO,MAAM;CACtC;CACA;CACA;CACA;CACA;CACA,OAAO,OAAO;EACZ,MAAM,OAAO,QAAQ,OAAO;EAC5B,aAAa;EACb,WAAW,OAAO;CACpB,CAAC;AACH,CAAC;AAED,MAAa,gBAAgB,OAAO,OAAO;CACzC,SAAS,OAAO,QAAQ,CAAC;CACzB,IAAI;CACJ,OAAO;AACT,CAAC;AACD,MAAa,cAAc,OAAO,OAAO;CACvC,QAAQ,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,iBAAiB,CAAC,CAAC;CAChF,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAM,CAAC,CAAC;AAC/E,CAAC;AACD,MAAa,eAAe,OAAO,OAAO,EACxC,OAAO,OAAO,MACZ,OAAO,OAAO;CAAE,YAAY,YAAY,OAAO;CAAY,SAAS,OAAO;AAAe,CAAC,CAC7F,CAAC,CAAC,MAAM,OAAO,YAAY,GAAK,CAAC,EACnC,CAAC;AACD,MAAa,eAAe,OAAO,OAAO;CACxC,SAAS,OAAO,QAAQ,CAAC;CACzB,IAAI;CACJ,OAAO;CACP,OAAO;CACP,SAAS,OAAO;CAChB,KAAK,OAAO;CACZ,YAAY,OAAO;CACnB,cAAc,OAAO;CACrB,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CACnD,WAAW,OAAO;CAClB,gBAAgB,OAAO;CACvB,OAAO;CACP,gBAAgB,OAAO;CACvB,QAAQ,OAAO,SAAS,OAAO,SAAS,OAAO,OAAO,CAAC;CACvD,QAAQ,OAAO,SAAS,cAAc;CACtC,QAAQ,OAAO,SAAS,OAAO,OAAO;AACxC,CAAC"}

package/dist/uploads/signed-driver.d.ts

@@ -0,0 +1,8 @@
+import "./schema.js";
+import "../core/errors.js";
+import { StorageSigning } from "../core/capabilities.js";
+import { Storage } from "../core/storage.js";
+import { UploadGrantDriver } from "./driver.js";
+import { Effect, Layer } from "effect";
+export declare const SignedUploadGrants: Layer.Layer<UploadGrantDriver, never, Storage | StorageSigning>;
+//# sourceMappingURL=signed-driver.d.ts.map

package/dist/uploads/signed-driver.js

@@ -0,0 +1,36 @@
+import { failUpload } from "./schema.js";
+import { Storage } from "../core/storage.js";
+import { UploadGrantDriver } from "./driver.js";
+import { StorageSigning } from "../core/capabilities.js";
+import { Clock, DateTime, Effect, Layer, Redacted } from "effect";
+
+// src/uploads/signed-driver.ts
+const signedUploadDriver = (issue) => Layer.effect(UploadGrantDriver, Effect.gen(function* () {
+	const storage = yield* Storage;
+	return UploadGrantDriver.of({
+		begin: (record) => !["auto", "single"].includes(record.input.strategy ?? "auto") ? Effect.fail(failUpload("Unsupported")) : Effect.succeed(null),
+		grant: Effect.fnUntraced(function* (record, expiresAt) {
+			const grant = yield* issue(record, Math.max(1, Math.floor((expiresAt - (yield* Clock.currentTimeMillis)) / 1e3)), storage);
+			return {
+				_tag: "SignedRequest",
+				constraints: grant.constraints,
+				method: "PUT",
+				url: Redacted.value(grant.url),
+				headers: Redacted.value(grant.headers),
+				expiresAt: DateTime.toEpochMillis(grant.expiresAt)
+			};
+		}),
+		abort: () => Effect.void
+	});
+}));
+const SignedUploadGrants = Layer.unwrap(Effect.map(StorageSigning, (signing) => signedUploadDriver((record, expiresInSeconds, storage) => signing.sign({
+	ref: {
+		storeId: storage.storeId,
+		key: record.stagingKey
+	},
+	method: "PUT",
+	expiresInSeconds
+}))));
+
+export { SignedUploadGrants, signedUploadDriver };
+//# sourceMappingURL=signed-driver.js.map

package/dist/uploads/signed-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-driver.js","names":[],"sources":["../../src/uploads/signed-driver.ts"],"sourcesContent":["import { Clock, DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport { StorageSigning } from \"../core/capabilities.js\";\nimport type { SignedRequest } from \"../core/capabilities.js\";\nimport type { StorageError } from \"../core/errors.js\";\nimport { Storage, type StorageService } from \"../core/storage.js\";\nimport { UploadGrantDriver } from \"./driver.js\";\nimport { failUpload } from \"./schema.js\";\nimport type { UploadRecord } from \"./schema.js\";\n\nexport const signedUploadDriver = (\n  issue: (\n    record: UploadRecord,\n    seconds: number,\n    storage: StorageService,\n  ) => Effect.Effect<SignedRequest, StorageError>,\n) =>\n  Layer.effect(\n    UploadGrantDriver,\n    Effect.gen(function* () {\n      const storage = yield* Storage;\n      return UploadGrantDriver.of({\n        begin: (record) =>\n          ![\"auto\", \"single\"].includes(record.input.strategy ?? \"auto\")\n            ? Effect.fail(failUpload(\"Unsupported\"))\n            : Effect.succeed(null),\n        grant: Effect.fnUntraced(function* (record, expiresAt) {\n          const seconds = Math.max(\n            1,\n            Math.floor((expiresAt - (yield* Clock.currentTimeMillis)) / 1000),\n          );\n          const grant = yield* issue(record, seconds, storage);\n          return {\n            _tag: \"SignedRequest\",\n            constraints: grant.constraints,\n            method: \"PUT\",\n            url: Redacted.value(grant.url),\n            headers: Redacted.value(grant.headers),\n            expiresAt: DateTime.toEpochMillis(grant.expiresAt),\n          };\n        }),\n        abort: () => Effect.void,\n      });\n    }),\n  );\nexport const SignedUploadGrants = Layer.unwrap(\n  Effect.map(StorageSigning, (signing) =>\n    signedUploadDriver((record, expiresInSeconds, storage) =>\n      signing.sign({\n        ref: { storeId: storage.storeId, key: record.stagingKey },\n        method: \"PUT\",\n        expiresInSeconds,\n      }),\n    ),\n  ),\n);\n"],"mappings":";;;;;;;AAUA,MAAa,sBACX,UAMA,MAAM,OACJ,mBACA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO;CACvB,OAAO,kBAAkB,GAAG;EAC1B,QAAQ,WACN,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,SAAS,OAAO,MAAM,YAAY,MAAM,IACxD,OAAO,KAAK,WAAW,aAAa,CAAC,IACrC,OAAO,QAAQ,IAAI;EACzB,OAAO,OAAO,WAAW,WAAW,QAAQ,WAAW;GAKrD,MAAM,QAAQ,OAAO,MAAM,QAJX,KAAK,IACnB,GACA,KAAK,OAAO,aAAa,OAAO,MAAM,sBAAsB,GAAI,CAEzB,GAAG,OAAO;GACnD,OAAO;IACL,MAAM;IACN,aAAa,MAAM;IACnB,QAAQ;IACR,KAAK,SAAS,MAAM,MAAM,GAAG;IAC7B,SAAS,SAAS,MAAM,MAAM,OAAO;IACrC,WAAW,SAAS,cAAc,MAAM,SAAS;GACnD;EACF,CAAC;EACD,aAAa,OAAO;CACtB,CAAC;AACH,CAAC,CACH;AACF,MAAa,qBAAqB,MAAM,OACtC,OAAO,IAAI,iBAAiB,YAC1B,oBAAoB,QAAQ,kBAAkB,YAC5C,QAAQ,KAAK;CACX,KAAK;EAAE,SAAS,QAAQ;EAAS,KAAK,OAAO;CAAW;CACxD,QAAQ;CACR;AACF,CAAC,CACH,CACF,CACF"}

package/dist/uploads/store.d.ts

@@ -0,0 +1,26 @@
+import { UploadError, UploadRecord, failUpload } from "./schema.js";
+import { StorageError } from "../core/errors.js";
+import { CheckpointProtection, SessionOwnership } from "../sessions/store.js";
+import { Context, Effect, Layer } from "effect";
+import { KeyValueStore } from "effect/persistence";
+export interface UploadStoreOptions {
+  readonly namespace: string;
+  readonly ownership: "exclusive" | SessionOwnership;
+  readonly protection: CheckpointProtection;
+  readonly maximumRecordBytes?: number;
+}
+declare const UploadStore_base: Context.ServiceClass<UploadStore, "@effect-kit/storage/UploadStore", {
+  readonly exclusive: SessionOwnership["withExclusive"];
+  readonly read: (id: string) => Effect.Effect<UploadRecord | undefined, StorageError | ReturnType<typeof failUpload>>;
+  readonly write: (record: UploadRecord) => Effect.Effect<void, StorageError | ReturnType<typeof failUpload>>;
+}>;
+export declare class UploadStore extends UploadStore_base {
+  static readonly make: (options: UploadStoreOptions) => Effect.Effect<{
+    readonly exclusive: SessionOwnership["withExclusive"];
+    readonly read: (id: string) => Effect.Effect<UploadRecord | undefined, StorageError | ReturnType<typeof failUpload>>;
+    readonly write: (record: UploadRecord) => Effect.Effect<void, StorageError | ReturnType<typeof failUpload>>;
+  }, UploadError, KeyValueStore.KeyValueStore>;
+  static layer(options: UploadStoreOptions): Layer.Layer<UploadStore, UploadError, KeyValueStore.KeyValueStore>;
+}
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/uploads/store.js

@@ -0,0 +1,51 @@
+import { UploadId, UploadRecord, failUpload } from "./schema.js";
+import { Context, Effect, Layer, Redacted, Schema, Semaphore } from "effect";
+import { KeyValueStore } from "effect/persistence";
+
+// src/uploads/store.ts
+var UploadStore = class UploadStore extends Context.Service()("@effect-kit/storage/UploadStore") {
+	static make = Effect.fnUntraced(function* (options) {
+		if (!/^[A-Za-z0-9_-]{1,100}$/u.test(options.namespace) || !options.ownership) return yield* failUpload("BadRequest");
+		const limit = options.maximumRecordBytes ?? 1048576;
+		if (!Number.isSafeInteger(limit) || limit < 1024) return yield* failUpload("BadRequest");
+		const kvs = yield* KeyValueStore.KeyValueStore;
+		let semaphore = locks.get(kvs);
+		if (!semaphore) {
+			semaphore = Semaphore.makeUnsafe(1);
+			locks.set(kvs, semaphore);
+		}
+		const lock = semaphore;
+		const key = (id) => `${options.namespace}:upload-intent:${id}`;
+		return UploadStore.of({
+			exclusive: (program) => lock.withPermit(options.ownership === "exclusive" ? program : options.ownership.withExclusive(program)),
+			read: Effect.fnUntraced(function* (id) {
+				yield* Schema.decodeUnknownEffect(UploadId)(id).pipe(Effect.mapError(() => failUpload("BadRequest")));
+				const encrypted = yield* kvs.get(key(id)).pipe(Effect.mapError(() => failUpload("Unavailable")));
+				if (encrypted === void 0) return void 0;
+				if (encrypted.length > limit * 2 + 4096) return yield* failUpload("Unavailable");
+				const json = yield* options.protection.open(Redacted.make(encrypted), key(id));
+				if (new TextEncoder().encode(json).length > limit) return yield* failUpload("Unavailable");
+				const record = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.toCodecJson(UploadRecord)))(json).pipe(Effect.mapError(() => failUpload("Unavailable")));
+				if (record.id !== id) return yield* failUpload("Unavailable");
+				return record;
+			}),
+			write: Effect.fnUntraced(function* (record) {
+				const value = yield* Schema.encodeEffect(Schema.toCodecJson(UploadRecord))(record).pipe(Effect.mapError(() => failUpload("BadRequest")));
+				const json = yield* Effect.try({
+					try: () => JSON.stringify(value),
+					catch: () => failUpload("BadRequest")
+				});
+				if (new TextEncoder().encode(json).length > limit) return yield* failUpload("BadRequest");
+				const encrypted = yield* options.protection.seal(json, key(record.id));
+				yield* kvs.set(key(record.id), Redacted.value(encrypted)).pipe(Effect.mapError(() => failUpload("Unavailable")));
+			})
+		});
+	});
+	static layer(options) {
+		return Layer.effect(UploadStore, UploadStore.make(options));
+	}
+};
+const locks = /* @__PURE__ */ new WeakMap();
+
+export { UploadStore };
+//# sourceMappingURL=store.js.map

package/dist/uploads/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","names":[],"sources":["../../src/uploads/store.ts"],"sourcesContent":["import { Context, Effect, Layer, Redacted, Schema, Semaphore } from \"effect\";\nimport { KeyValueStore } from \"effect/persistence\";\n\nimport type { StorageError } from \"../core/errors.js\";\nimport type { CheckpointProtection, SessionOwnership } from \"../sessions/store.js\";\nimport { UploadId, UploadRecord, failUpload } from \"./schema.js\";\n\nexport interface UploadStoreOptions {\n  readonly namespace: string;\n  readonly ownership: \"exclusive\" | SessionOwnership;\n  readonly protection: CheckpointProtection;\n  readonly maximumRecordBytes?: number;\n}\nexport class UploadStore extends Context.Service<\n  UploadStore,\n  {\n    readonly exclusive: SessionOwnership[\"withExclusive\"];\n    readonly read: (\n      id: string,\n    ) => Effect.Effect<UploadRecord | undefined, StorageError | ReturnType<typeof failUpload>>;\n    readonly write: (\n      record: UploadRecord,\n    ) => Effect.Effect<void, StorageError | ReturnType<typeof failUpload>>;\n  }\n>()(\"@effect-kit/storage/UploadStore\") {\n  static readonly make = Effect.fnUntraced(function* (options: UploadStoreOptions) {\n    if (!/^[A-Za-z0-9_-]{1,100}$/u.test(options.namespace) || !options.ownership)\n      return yield* failUpload(\"BadRequest\");\n    const limit = options.maximumRecordBytes ?? 1024 * 1024;\n    if (!Number.isSafeInteger(limit) || limit < 1024) return yield* failUpload(\"BadRequest\");\n    const kvs = yield* KeyValueStore.KeyValueStore;\n    let semaphore = locks.get(kvs);\n    if (!semaphore) {\n      semaphore = Semaphore.makeUnsafe(1);\n      locks.set(kvs, semaphore);\n    }\n    const lock = semaphore;\n    const key = (id: string) => `${options.namespace}:upload-intent:${id}`;\n    return UploadStore.of({\n      exclusive: (program) =>\n        lock.withPermit(\n          options.ownership === \"exclusive\" ? program : options.ownership.withExclusive(program),\n        ),\n      read: Effect.fnUntraced(function* (id) {\n        yield* Schema.decodeUnknownEffect(UploadId)(id).pipe(\n          Effect.mapError(() => failUpload(\"BadRequest\")),\n        );\n        const encrypted = yield* kvs\n          .get(key(id))\n          .pipe(Effect.mapError(() => failUpload(\"Unavailable\")));\n        if (encrypted === undefined) return undefined;\n        if (encrypted.length > limit * 2 + 4096) return yield* failUpload(\"Unavailable\");\n        const json = yield* options.protection.open(Redacted.make(encrypted), key(id));\n        if (new TextEncoder().encode(json).length > limit) return yield* failUpload(\"Unavailable\");\n        const record = yield* Schema.decodeUnknownEffect(\n          Schema.fromJsonString(Schema.toCodecJson(UploadRecord)),\n        )(json).pipe(Effect.mapError(() => failUpload(\"Unavailable\")));\n        if (record.id !== id) return yield* failUpload(\"Unavailable\");\n        return record;\n      }),\n      write: Effect.fnUntraced(function* (record) {\n        const value = yield* Schema.encodeEffect(Schema.toCodecJson(UploadRecord))(record).pipe(\n          Effect.mapError(() => failUpload(\"BadRequest\")),\n        );\n        const json = yield* Effect.try({\n          try: () => JSON.stringify(value),\n          catch: () => failUpload(\"BadRequest\"),\n        });\n        if (new TextEncoder().encode(json).length > limit) return yield* failUpload(\"BadRequest\");\n        const encrypted = yield* options.protection.seal(json, key(record.id));\n        yield* kvs\n          .set(key(record.id), Redacted.value(encrypted))\n          .pipe(Effect.mapError(() => failUpload(\"Unavailable\")));\n      }),\n    });\n  });\n  static layer(options: UploadStoreOptions) {\n    return Layer.effect(UploadStore, UploadStore.make(options));\n  }\n}\nconst locks = new WeakMap<KeyValueStore.KeyValueStore, Semaphore.Semaphore>();\n"],"mappings":";;;;;AAaA,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAWvC,CAAC,CAAC,iCAAiC,CAAC,CAAC;CACrC,OAAgB,OAAO,OAAO,WAAW,WAAW,SAA6B;EAC/E,IAAI,CAAC,0BAA0B,KAAK,QAAQ,SAAS,KAAK,CAAC,QAAQ,WACjE,OAAO,OAAO,WAAW,YAAY;EACvC,MAAM,QAAQ,QAAQ,sBAAsB;EAC5C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,MAAM,OAAO,OAAO,WAAW,YAAY;EACvF,MAAM,MAAM,OAAO,cAAc;EACjC,IAAI,YAAY,MAAM,IAAI,GAAG;EAC7B,IAAI,CAAC,WAAW;GACd,YAAY,UAAU,WAAW,CAAC;GAClC,MAAM,IAAI,KAAK,SAAS;EAC1B;EACA,MAAM,OAAO;EACb,MAAM,OAAO,OAAe,GAAG,QAAQ,UAAU,iBAAiB;EAClE,OAAO,YAAY,GAAG;GACpB,YAAY,YACV,KAAK,WACH,QAAQ,cAAc,cAAc,UAAU,QAAQ,UAAU,cAAc,OAAO,CACvF;GACF,MAAM,OAAO,WAAW,WAAW,IAAI;IACrC,OAAO,OAAO,oBAAoB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,KAC9C,OAAO,eAAe,WAAW,YAAY,CAAC,CAChD;IACA,MAAM,YAAY,OAAO,IACtB,IAAI,IAAI,EAAE,CAAC,CAAC,CACZ,KAAK,OAAO,eAAe,WAAW,aAAa,CAAC,CAAC;IACxD,IAAI,cAAc,QAAW,OAAO;IACpC,IAAI,UAAU,SAAS,QAAQ,IAAI,MAAM,OAAO,OAAO,WAAW,aAAa;IAC/E,MAAM,OAAO,OAAO,QAAQ,WAAW,KAAK,SAAS,KAAK,SAAS,GAAG,IAAI,EAAE,CAAC;IAC7E,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,OAAO,WAAW,aAAa;IACzF,MAAM,SAAS,OAAO,OAAO,oBAC3B,OAAO,eAAe,OAAO,YAAY,YAAY,CAAC,CACxD,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,aAAa,CAAC,CAAC;IAC7D,IAAI,OAAO,OAAO,IAAI,OAAO,OAAO,WAAW,aAAa;IAC5D,OAAO;GACT,CAAC;GACD,OAAO,OAAO,WAAW,WAAW,QAAQ;IAC1C,MAAM,QAAQ,OAAO,OAAO,aAAa,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KACjF,OAAO,eAAe,WAAW,YAAY,CAAC,CAChD;IACA,MAAM,OAAO,OAAO,OAAO,IAAI;KAC7B,WAAW,KAAK,UAAU,KAAK;KAC/B,aAAa,WAAW,YAAY;IACtC,CAAC;IACD,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,OAAO,WAAW,YAAY;IACxF,MAAM,YAAY,OAAO,QAAQ,WAAW,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC;IACrE,OAAO,IACJ,IAAI,IAAI,OAAO,EAAE,GAAG,SAAS,MAAM,SAAS,CAAC,CAAC,CAC9C,KAAK,OAAO,eAAe,WAAW,aAAa,CAAC,CAAC;GAC1D,CAAC;EACH,CAAC;CACH,CAAC;CACD,OAAO,MAAM,SAA6B;EACxC,OAAO,MAAM,OAAO,aAAa,YAAY,KAAK,OAAO,CAAC;CAC5D;AACF;AACA,MAAM,wBAAQ,IAAI,QAA0D"}