@effect-kit/storage 0.0.0-stage → 0.1.0

package/dist/gcs/lifecycle.d.ts

@@ -0,0 +1,161 @@
+import { StorageError } from "../core/errors.js";
+import { MetadataService, StorageMetadata, StorageVersions, VersionsService } from "../lifecycle.js";
+import "../index.js";
+import { GcsStorage, GcsStorageService } from "../gcs.js";
+import { Context, Effect, Layer } from "effect";
+declare const GcsVersions_base: Context.ServiceClass<GcsVersions, "@effect-kit/storage/gcs/GcsVersions", VersionsService>;
+export declare class GcsVersions extends GcsVersions_base {
+  static make(storage: GcsStorageService): VersionsService;
+  static readonly layer: Layer.Layer<GcsVersions | StorageVersions, never, GcsStorage>;
+}
+declare const GcsMetadata_base: Context.ServiceClass<GcsMetadata, "@effect-kit/storage/gcs/GcsMetadata", MetadataService>;
+export declare class GcsMetadata extends GcsMetadata_base {
+  static make(storage: GcsStorageService): MetadataService;
+  static readonly layer: Layer.Layer<GcsMetadata | StorageMetadata, never, GcsStorage>;
+}
+declare const recovery: (storage: GcsStorageService) => {
+  restoreDeleted: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly restoreToken?: string | undefined;
+    readonly copySourceAcl?: boolean | undefined;
+  }) => Effect.Effect<{
+    readonly contentType?: string | undefined;
+    readonly contentEncoding?: string | undefined;
+    readonly contentLanguage?: string | undefined;
+    readonly contentDisposition?: string | undefined;
+    readonly cacheControl?: string | undefined;
+    readonly customMetadata?: {
+      readonly [x: string]: string;
+    } | undefined;
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version?: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      } | undefined;
+    };
+    readonly size?: number | undefined;
+    readonly etag?: string | undefined;
+    readonly lastModified?: import("effect/DateTime").Utc | undefined;
+    readonly checksums?: readonly {
+      readonly algorithm: string;
+      readonly encoding: "base64" | "hex";
+      readonly scope: "composite" | "full-object";
+      readonly value: string;
+      readonly partCount?: number | undefined;
+    }[] | undefined;
+    readonly storageClass?: string | undefined;
+  }, StorageError, never>;
+};
+declare const GcsRecovery_base: Context.ServiceClass<GcsRecovery, "@effect-kit/storage/gcs/GcsRecovery", {
+  restoreDeleted: (input: {
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      };
+    };
+    readonly restoreToken?: string | undefined;
+    readonly copySourceAcl?: boolean | undefined;
+  }) => Effect.Effect<{
+    readonly contentType?: string | undefined;
+    readonly contentEncoding?: string | undefined;
+    readonly contentLanguage?: string | undefined;
+    readonly contentDisposition?: string | undefined;
+    readonly cacheControl?: string | undefined;
+    readonly customMetadata?: {
+      readonly [x: string]: string;
+    } | undefined;
+    readonly ref: {
+      readonly storeId: string;
+      readonly key: string;
+      readonly version?: {
+        readonly _tag: "S3Version";
+        readonly id: string;
+      } | {
+        readonly _tag: "GcsGeneration";
+        readonly id: string;
+        readonly metageneration?: string | undefined;
+      } | {
+        readonly _tag: "AzureVersion";
+        readonly id: string;
+      } | {
+        readonly _tag: "AzureSnapshot";
+        readonly id: string;
+      } | {
+        readonly _tag: "OpaqueVersion";
+        readonly provider: string;
+        readonly id: string;
+      } | undefined;
+    };
+    readonly size?: number | undefined;
+    readonly etag?: string | undefined;
+    readonly lastModified?: import("effect/DateTime").Utc | undefined;
+    readonly checksums?: readonly {
+      readonly algorithm: string;
+      readonly encoding: "base64" | "hex";
+      readonly scope: "composite" | "full-object";
+      readonly value: string;
+      readonly partCount?: number | undefined;
+    }[] | undefined;
+    readonly storageClass?: string | undefined;
+  }, StorageError, never>;
+}>;
+export declare class GcsRecovery extends GcsRecovery_base {
+  static readonly make: typeof recovery;
+  static readonly layer: Layer.Layer<GcsRecovery, never, GcsStorage>;
+}
+export {};
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/gcs/lifecycle.js

@@ -0,0 +1,174 @@
+import { storageError } from "../core/errors.js";
+import { decodeRequest } from "../internal/request-validation.js";
+import { decodeCursor, encodeCursor } from "../internal/listing-cursor.js";
+import { decodeJson, jsonRequest } from "../providers/gcs/transport.js";
+import { metadata, nativeHeaders, objectPath, target } from "../providers/gcs/mapping.js";
+import { GcsStorage } from "../gcs.js";
+import { MetadataMerge, MetadataReplace, RestoreVersion, StorageMetadata, StorageVersions, VersionQuery, VersionRef } from "../lifecycle.js";
+import { mergeHeaders, replaceHeaders } from "../lifecycle/metadata.js";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+
+// src/providers/gcs/lifecycle.ts
+var GcsVersions = class GcsVersions extends Context.Service()("@effect-kit/storage/gcs/GcsVersions") {
+	static make(storage) {
+		return StorageVersions.make({
+			listPage: Effect.fnUntraced(function* (input = {}) {
+				const value = yield* decodeRequest(VersionQuery, input, "listVersions", "gcs");
+				const identity = JSON.stringify([
+					"versions",
+					value.prefix,
+					value.limit,
+					value.deleted
+				]);
+				const token = yield* decodeCursor("gcs", value.cursor, storage.storeId, identity, "listVersions");
+				const response = yield* jsonRequest(storage, "listVersions", false, {
+					uri: `${storage.config.apiEndpoint}/storage/v1/b/${encodeURIComponent(storage.config.bucket)}/o`,
+					qs: {
+						prefix: value.prefix,
+						maxResults: value.limit ?? 1e3,
+						pageToken: token,
+						...value.deleted ? { softDeleted: "true" } : { versions: "true" }
+					},
+					json: true
+				});
+				const page = yield* decodeJson(Schema.Struct({
+					items: Schema.optional(Schema.Array(Schema.Unknown)),
+					nextPageToken: Schema.optional(Schema.String)
+				}), response.body, "listVersions");
+				return {
+					entries: yield* Effect.forEach(page.items ?? [], (raw) => Effect.gen(function* () {
+						const observed = yield* metadata(storage, raw, "listVersions");
+						const recovery = yield* decodeJson(Schema.Struct({ restoreToken: Schema.optional(Schema.String) }), raw, "listVersions");
+						return {
+							_tag: "Version",
+							metadata: observed,
+							deleted: value.deleted ?? false,
+							...recovery.restoreToken ? { recoveryToken: Redacted.make(recovery.restoreToken) } : {}
+						};
+					})),
+					...page.nextPageToken ? { cursor: encodeCursor(storage.storeId, identity, page.nextPageToken) } : {}
+				};
+			}),
+			deleteVersion: Effect.fnUntraced(function* (input) {
+				const { ref } = yield* decodeRequest(Schema.Struct({ ref: VersionRef }), input, "deleteVersion", "gcs", true);
+				const address = yield* target(storage, { ref }, "delete");
+				yield* jsonRequest(storage, "deleteVersion", true, {
+					uri: address.uri,
+					method: "DELETE",
+					qs: {
+						...address.qs,
+						ifGenerationMatch: ref.version.id
+					},
+					json: true
+				});
+			}),
+			removeDeleteMarker: () => Effect.fail(storageError("removeDeleteMarker", "gcs", {
+				_tag: "Unsupported",
+				capability: "s3-delete-markers"
+			}, "not-started")),
+			restore: Effect.fnUntraced(function* (input) {
+				const value = yield* decodeRequest(RestoreVersion, input, "restoreVersion", "gcs", true);
+				yield* target(storage, { ref: value.source }, "restoreVersion");
+				if (value.condition._tag !== "CreateOnly") return yield* storageError("restoreVersion", "gcs", {
+					_tag: "Unsupported",
+					capability: "etag-destination-generation-condition"
+				}, "not-started");
+				let token;
+				for (let attempt = 0; attempt < 1e3; attempt++) {
+					const result = yield* storage.rewrite({
+						source: value.source,
+						destinationKey: value.destinationKey,
+						preconditions: { ifGenerationMatch: "0" },
+						...token ? { token } : {}
+					});
+					if (result._tag === "Completed") return result.metadata;
+					token = result.token;
+				}
+				return yield* storageError("restoreVersion", "gcs", {
+					_tag: "TransportFailure",
+					code: "RewriteBudgetExceeded"
+				}, "unknown");
+			})
+		});
+	}
+	static layer = Layer.effectContext(Effect.map(GcsStorage, (storage) => {
+		const service = GcsVersions.make(storage);
+		return Context.make(GcsVersions, service).pipe(Context.add(StorageVersions, service));
+	}));
+};
+var GcsMetadata = class GcsMetadata extends Context.Service()("@effect-kit/storage/gcs/GcsMetadata") {
+	static make(storage) {
+		const update = Effect.fnUntraced(function* (input, patch) {
+			const address = yield* target(storage, { ref: input.ref }, "updateMetadata");
+			if (input.condition) return yield* storageError("updateMetadata", "gcs", {
+				_tag: "Unsupported",
+				capability: "etag-metadata-write-condition"
+			}, "not-started");
+			if (input.ref.version?._tag !== "GcsGeneration" || !input.ref.version.metageneration) return yield* storageError("updateMetadata", "gcs", {
+				_tag: "InvalidInput",
+				field: "generation-and-metageneration"
+			}, "not-started");
+			const current = yield* storage.head({ ref: input.ref });
+			const headers = patch ? mergeHeaders(current, patch) : replaceHeaders(current, input.headers);
+			const body = nativeHeaders(headers);
+			const response = yield* jsonRequest(storage, "updateMetadata", true, {
+				uri: address.uri,
+				method: "PATCH",
+				qs: {
+					...address.qs,
+					ifGenerationMatch: input.ref.version.id,
+					ifMetagenerationMatch: input.ref.version.metageneration
+				},
+				json: {
+					contentType: body.contentType ?? null,
+					contentEncoding: body.contentEncoding ?? null,
+					contentLanguage: body.contentLanguage ?? null,
+					contentDisposition: body.contentDisposition ?? null,
+					cacheControl: body.cacheControl ?? null,
+					metadata: body.metadata ?? null
+				}
+			});
+			return yield* metadata(storage, response.body, "updateMetadata");
+		});
+		return {
+			replace: (input) => decodeRequest(MetadataReplace, input, "updateMetadata", "gcs", true).pipe(Effect.flatMap((value) => update(value))),
+			merge: (input) => decodeRequest(MetadataMerge, input, "updateMetadata", "gcs", true).pipe(Effect.flatMap((value) => update({
+				ref: value.ref,
+				headers: {},
+				condition: value.condition
+			}, value.patch)))
+		};
+	}
+	static layer = Layer.effectContext(Effect.map(GcsStorage, (storage) => {
+		const service = GcsMetadata.make(storage);
+		return Context.make(GcsMetadata, service).pipe(Context.add(StorageMetadata, service));
+	}));
+};
+const RecoveryRequest = Schema.Struct({
+	ref: VersionRef,
+	restoreToken: Schema.optional(Schema.NonEmptyString),
+	copySourceAcl: Schema.optional(Schema.Boolean)
+});
+const recovery = (storage) => ({ restoreDeleted: Effect.fnUntraced(function* (input) {
+	const value = yield* decodeRequest(RecoveryRequest, input, "restoreDeleted", "gcs", true);
+	const address = yield* target(storage, { ref: value.ref }, "restoreDeleted");
+	const response = yield* jsonRequest(storage, "restoreDeleted", true, {
+		uri: `${storage.config.apiEndpoint}${objectPath(storage, value.ref.key)}/restore`,
+		method: "POST",
+		qs: {
+			...address.qs,
+			restoreToken: value.restoreToken,
+			copySourceAcl: value.copySourceAcl === void 0 ? void 0 : String(value.copySourceAcl),
+			ifGenerationMatch: "0"
+		},
+		json: {}
+	});
+	return yield* metadata(storage, response.body, "restoreDeleted");
+}) });
+var GcsRecovery = class GcsRecovery extends Context.Service()("@effect-kit/storage/gcs/GcsRecovery") {
+	static make = recovery;
+	static layer = Layer.effect(GcsRecovery, Effect.map(GcsStorage, recovery));
+};
+
+export { GcsMetadata, GcsRecovery, GcsVersions };
+//# sourceMappingURL=lifecycle.js.map

package/dist/gcs/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","names":[],"sources":["../../src/providers/gcs/lifecycle.ts"],"sourcesContent":["import { Context, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport { storageError } from \"../../core/errors.js\";\nimport { decodeCursor, encodeCursor } from \"../../internal/listing-cursor.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport {\n  MetadataMerge,\n  MetadataReplace,\n  RestoreVersion,\n  StorageMetadata,\n  StorageVersions,\n  VersionQuery,\n  VersionRef,\n} from \"../../lifecycle/index.js\";\nimport type { MetadataService, VersionEntry, VersionsService } from \"../../lifecycle/index.js\";\nimport { mergeHeaders, replaceHeaders } from \"../../lifecycle/metadata.js\";\nimport { GcsStorage } from \"./index.js\";\nimport type { GcsStorageService } from \"./index.js\";\nimport { metadata, nativeHeaders, objectPath, target } from \"./mapping.js\";\nimport { decodeJson, jsonRequest } from \"./transport.js\";\n\nexport class GcsVersions extends Context.Service<GcsVersions, VersionsService>()(\n  \"@effect-kit/storage/gcs/GcsVersions\",\n) {\n  static make(storage: GcsStorageService): VersionsService {\n    return StorageVersions.make({\n      listPage: Effect.fnUntraced(function* (input = {}) {\n        const value = yield* decodeRequest(VersionQuery, input, \"listVersions\", \"gcs\");\n        const identity = JSON.stringify([\"versions\", value.prefix, value.limit, value.deleted]);\n        const token = yield* decodeCursor(\n          \"gcs\",\n          value.cursor,\n          storage.storeId,\n          identity,\n          \"listVersions\",\n        );\n        const response = yield* jsonRequest(storage, \"listVersions\", false, {\n          uri: `${storage.config.apiEndpoint}/storage/v1/b/${encodeURIComponent(storage.config.bucket)}/o`,\n          qs: {\n            prefix: value.prefix,\n            maxResults: value.limit ?? 1000,\n            pageToken: token,\n            ...(value.deleted ? { softDeleted: \"true\" } : { versions: \"true\" }),\n          },\n          json: true,\n        });\n        const page = yield* decodeJson(\n          Schema.Struct({\n            items: Schema.optional(Schema.Array(Schema.Unknown)),\n            nextPageToken: Schema.optional(Schema.String),\n          }),\n          response.body,\n          \"listVersions\",\n        );\n        const entries: VersionEntry[] = yield* Effect.forEach(page.items ?? [], (raw) =>\n          Effect.gen(function* () {\n            const observed = yield* metadata(storage, raw, \"listVersions\");\n            const recovery = yield* decodeJson(\n              Schema.Struct({ restoreToken: Schema.optional(Schema.String) }),\n              raw,\n              \"listVersions\",\n            );\n            return {\n              _tag: \"Version\" as const,\n              metadata: observed,\n              deleted: value.deleted ?? false,\n              ...(recovery.restoreToken\n                ? { recoveryToken: Redacted.make(recovery.restoreToken) }\n                : {}),\n            };\n          }),\n        );\n        return {\n          entries,\n          ...(page.nextPageToken\n            ? { cursor: encodeCursor(storage.storeId, identity, page.nextPageToken) }\n            : {}),\n        };\n      }),\n      deleteVersion: Effect.fnUntraced(function* (input) {\n        const { ref } = yield* decodeRequest(\n          Schema.Struct({ ref: VersionRef }),\n          input,\n          \"deleteVersion\",\n          \"gcs\",\n          true,\n        );\n        const address = yield* target(storage, { ref }, \"delete\");\n        yield* jsonRequest(storage, \"deleteVersion\", true, {\n          uri: address.uri,\n          method: \"DELETE\",\n          qs: { ...address.qs, ifGenerationMatch: ref.version.id },\n          json: true,\n        });\n      }),\n      removeDeleteMarker: () =>\n        Effect.fail(\n          storageError(\n            \"removeDeleteMarker\",\n            \"gcs\",\n            { _tag: \"Unsupported\", capability: \"s3-delete-markers\" },\n            \"not-started\",\n          ),\n        ),\n      restore: Effect.fnUntraced(function* (input) {\n        const value = yield* decodeRequest(RestoreVersion, input, \"restoreVersion\", \"gcs\", true);\n        yield* target(storage, { ref: value.source }, \"restoreVersion\");\n        if (value.condition._tag !== \"CreateOnly\")\n          return yield* storageError(\n            \"restoreVersion\",\n            \"gcs\",\n            { _tag: \"Unsupported\", capability: \"etag-destination-generation-condition\" },\n            \"not-started\",\n          );\n        let token: string | undefined;\n        for (let attempt = 0; attempt < 1000; attempt++) {\n          const result = yield* storage.rewrite({\n            source: value.source,\n            destinationKey: value.destinationKey,\n            preconditions: { ifGenerationMatch: \"0\" },\n            ...(token ? { token } : {}),\n          });\n          if (result._tag === \"Completed\") return result.metadata;\n          token = result.token;\n        }\n        return yield* storageError(\n          \"restoreVersion\",\n          \"gcs\",\n          { _tag: \"TransportFailure\", code: \"RewriteBudgetExceeded\" },\n          \"unknown\",\n        );\n      }),\n    });\n  }\n  static readonly layer = Layer.effectContext(\n    Effect.map(GcsStorage, (storage) => {\n      const service = GcsVersions.make(storage);\n      return Context.make(GcsVersions, service).pipe(Context.add(StorageVersions, service));\n    }),\n  );\n}\nexport class GcsMetadata extends Context.Service<GcsMetadata, MetadataService>()(\n  \"@effect-kit/storage/gcs/GcsMetadata\",\n) {\n  static make(storage: GcsStorageService): MetadataService {\n    const update = Effect.fnUntraced(function* (\n      input: typeof MetadataReplace.Type,\n      patch?: (typeof MetadataMerge.Type)[\"patch\"],\n    ) {\n      const address = yield* target(storage, { ref: input.ref }, \"updateMetadata\");\n      if (input.condition)\n        return yield* storageError(\n          \"updateMetadata\",\n          \"gcs\",\n          { _tag: \"Unsupported\", capability: \"etag-metadata-write-condition\" },\n          \"not-started\",\n        );\n      if (input.ref.version?._tag !== \"GcsGeneration\" || !input.ref.version.metageneration)\n        return yield* storageError(\n          \"updateMetadata\",\n          \"gcs\",\n          { _tag: \"InvalidInput\", field: \"generation-and-metageneration\" },\n          \"not-started\",\n        );\n      const current = yield* storage.head({ ref: input.ref });\n      const headers = patch ? mergeHeaders(current, patch) : replaceHeaders(current, input.headers);\n      const body = nativeHeaders(headers);\n      const response = yield* jsonRequest(storage, \"updateMetadata\", true, {\n        uri: address.uri,\n        method: \"PATCH\",\n        qs: {\n          ...address.qs,\n          ifGenerationMatch: input.ref.version.id,\n          ifMetagenerationMatch: input.ref.version.metageneration,\n        },\n        json: {\n          contentType: body.contentType ?? null,\n          contentEncoding: body.contentEncoding ?? null,\n          contentLanguage: body.contentLanguage ?? null,\n          contentDisposition: body.contentDisposition ?? null,\n          cacheControl: body.cacheControl ?? null,\n          metadata: body.metadata ?? null,\n        },\n      });\n      return yield* metadata(storage, response.body, \"updateMetadata\");\n    });\n    return {\n      replace: (input) =>\n        decodeRequest(MetadataReplace, input, \"updateMetadata\", \"gcs\", true).pipe(\n          Effect.flatMap((value) => update(value)),\n        ),\n      merge: (input) =>\n        decodeRequest(MetadataMerge, input, \"updateMetadata\", \"gcs\", true).pipe(\n          Effect.flatMap((value) =>\n            update({ ref: value.ref, headers: {}, condition: value.condition }, value.patch),\n          ),\n        ),\n    };\n  }\n  static readonly layer = Layer.effectContext(\n    Effect.map(GcsStorage, (storage) => {\n      const service = GcsMetadata.make(storage);\n      return Context.make(GcsMetadata, service).pipe(Context.add(StorageMetadata, service));\n    }),\n  );\n}\nconst RecoveryRequest = Schema.Struct({\n  ref: VersionRef,\n  restoreToken: Schema.optional(Schema.NonEmptyString),\n  copySourceAcl: Schema.optional(Schema.Boolean),\n});\nconst recovery = (storage: GcsStorageService) => ({\n  restoreDeleted: Effect.fnUntraced(function* (input: typeof RecoveryRequest.Type) {\n    const value = yield* decodeRequest(RecoveryRequest, input, \"restoreDeleted\", \"gcs\", true);\n    const address = yield* target(storage, { ref: value.ref }, \"restoreDeleted\");\n    const response = yield* jsonRequest(storage, \"restoreDeleted\", true, {\n      uri: `${storage.config.apiEndpoint}${objectPath(storage, value.ref.key)}/restore`,\n      method: \"POST\",\n      qs: {\n        ...address.qs,\n        restoreToken: value.restoreToken,\n        copySourceAcl: value.copySourceAcl === undefined ? undefined : String(value.copySourceAcl),\n        ifGenerationMatch: \"0\",\n      },\n      json: {},\n    });\n    return yield* metadata(storage, response.body, \"restoreDeleted\");\n  }),\n});\nexport class GcsRecovery extends Context.Service<GcsRecovery, ReturnType<typeof recovery>>()(\n  \"@effect-kit/storage/gcs/GcsRecovery\",\n) {\n  static readonly make = recovery;\n  static readonly layer = Layer.effect(GcsRecovery, Effect.map(GcsStorage, recovery));\n}\n"],"mappings":";;;;;;;;;;;AAqBA,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAAsC,CAAC,CAC9E,qCACF,CAAC,CAAC;CACA,OAAO,KAAK,SAA6C;EACvD,OAAO,gBAAgB,KAAK;GAC1B,UAAU,OAAO,WAAW,WAAW,QAAQ,CAAC,GAAG;IACjD,MAAM,QAAQ,OAAO,cAAc,cAAc,OAAO,gBAAgB,KAAK;IAC7E,MAAM,WAAW,KAAK,UAAU;KAAC;KAAY,MAAM;KAAQ,MAAM;KAAO,MAAM;IAAO,CAAC;IACtF,MAAM,QAAQ,OAAO,aACnB,OACA,MAAM,QACN,QAAQ,SACR,UACA,cACF;IACA,MAAM,WAAW,OAAO,YAAY,SAAS,gBAAgB,OAAO;KAClE,KAAK,GAAG,QAAQ,OAAO,YAAY,gBAAgB,mBAAmB,QAAQ,OAAO,MAAM,EAAE;KAC7F,IAAI;MACF,QAAQ,MAAM;MACd,YAAY,MAAM,SAAS;MAC3B,WAAW;MACX,GAAI,MAAM,UAAU,EAAE,aAAa,OAAO,IAAI,EAAE,UAAU,OAAO;KACnE;KACA,MAAM;IACR,CAAC;IACD,MAAM,OAAO,OAAO,WAClB,OAAO,OAAO;KACZ,OAAO,OAAO,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC;KACnD,eAAe,OAAO,SAAS,OAAO,MAAM;IAC9C,CAAC,GACD,SAAS,MACT,cACF;IAmBA,OAAO;KACL,gBAnBqC,OAAO,QAAQ,KAAK,SAAS,CAAC,IAAI,QACvE,OAAO,IAAI,aAAa;MACtB,MAAM,WAAW,OAAO,SAAS,SAAS,KAAK,cAAc;MAC7D,MAAM,WAAW,OAAO,WACtB,OAAO,OAAO,EAAE,cAAc,OAAO,SAAS,OAAO,MAAM,EAAE,CAAC,GAC9D,KACA,cACF;MACA,OAAO;OACL,MAAM;OACN,UAAU;OACV,SAAS,MAAM,WAAW;OAC1B,GAAI,SAAS,eACT,EAAE,eAAe,SAAS,KAAK,SAAS,YAAY,EAAE,IACtD,CAAC;MACP;KACF,CAAC,CACH;KAGE,GAAI,KAAK,gBACL,EAAE,QAAQ,aAAa,QAAQ,SAAS,UAAU,KAAK,aAAa,EAAE,IACtE,CAAC;IACP;GACF,CAAC;GACD,eAAe,OAAO,WAAW,WAAW,OAAO;IACjD,MAAM,EAAE,QAAQ,OAAO,cACrB,OAAO,OAAO,EAAE,KAAK,WAAW,CAAC,GACjC,OACA,iBACA,OACA,IACF;IACA,MAAM,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,GAAG,QAAQ;IACxD,OAAO,YAAY,SAAS,iBAAiB,MAAM;KACjD,KAAK,QAAQ;KACb,QAAQ;KACR,IAAI;MAAE,GAAG,QAAQ;MAAI,mBAAmB,IAAI,QAAQ;KAAG;KACvD,MAAM;IACR,CAAC;GACH,CAAC;GACD,0BACE,OAAO,KACL,aACE,sBACA,OACA;IAAE,MAAM;IAAe,YAAY;GAAoB,GACvD,aACF,CACF;GACF,SAAS,OAAO,WAAW,WAAW,OAAO;IAC3C,MAAM,QAAQ,OAAO,cAAc,gBAAgB,OAAO,kBAAkB,OAAO,IAAI;IACvF,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,OAAO,GAAG,gBAAgB;IAC9D,IAAI,MAAM,UAAU,SAAS,cAC3B,OAAO,OAAO,aACZ,kBACA,OACA;KAAE,MAAM;KAAe,YAAY;IAAwC,GAC3E,aACF;IACF,IAAI;IACJ,KAAK,IAAI,UAAU,GAAG,UAAU,KAAM,WAAW;KAC/C,MAAM,SAAS,OAAO,QAAQ,QAAQ;MACpC,QAAQ,MAAM;MACd,gBAAgB,MAAM;MACtB,eAAe,EAAE,mBAAmB,IAAI;MACxC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;KAC3B,CAAC;KACD,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO;KAC/C,QAAQ,OAAO;IACjB;IACA,OAAO,OAAO,aACZ,kBACA,OACA;KAAE,MAAM;KAAoB,MAAM;IAAwB,GAC1D,SACF;GACF,CAAC;EACH,CAAC;CACH;CACA,OAAgB,QAAQ,MAAM,cAC5B,OAAO,IAAI,aAAa,YAAY;EAClC,MAAM,UAAU,YAAY,KAAK,OAAO;EACxC,OAAO,QAAQ,KAAK,aAAa,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,iBAAiB,OAAO,CAAC;CACtF,CAAC,CACH;AACF;AACA,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAAsC,CAAC,CAC9E,qCACF,CAAC,CAAC;CACA,OAAO,KAAK,SAA6C;EACvD,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,GAAG,gBAAgB;GAC3E,IAAI,MAAM,WACR,OAAO,OAAO,aACZ,kBACA,OACA;IAAE,MAAM;IAAe,YAAY;GAAgC,GACnE,aACF;GACF,IAAI,MAAM,IAAI,SAAS,SAAS,mBAAmB,CAAC,MAAM,IAAI,QAAQ,gBACpE,OAAO,OAAO,aACZ,kBACA,OACA;IAAE,MAAM;IAAgB,OAAO;GAAgC,GAC/D,aACF;GACF,MAAM,UAAU,OAAO,QAAQ,KAAK,EAAE,KAAK,MAAM,IAAI,CAAC;GACtD,MAAM,UAAU,QAAQ,aAAa,SAAS,KAAK,IAAI,eAAe,SAAS,MAAM,OAAO;GAC5F,MAAM,OAAO,cAAc,OAAO;GAClC,MAAM,WAAW,OAAO,YAAY,SAAS,kBAAkB,MAAM;IACnE,KAAK,QAAQ;IACb,QAAQ;IACR,IAAI;KACF,GAAG,QAAQ;KACX,mBAAmB,MAAM,IAAI,QAAQ;KACrC,uBAAuB,MAAM,IAAI,QAAQ;IAC3C;IACA,MAAM;KACJ,aAAa,KAAK,eAAe;KACjC,iBAAiB,KAAK,mBAAmB;KACzC,iBAAiB,KAAK,mBAAmB;KACzC,oBAAoB,KAAK,sBAAsB;KAC/C,cAAc,KAAK,gBAAgB;KACnC,UAAU,KAAK,YAAY;IAC7B;GACF,CAAC;GACD,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM,gBAAgB;EACjE,CAAC;EACD,OAAO;GACL,UAAU,UACR,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,IAAI,CAAC,CAAC,KACnE,OAAO,SAAS,UAAU,OAAO,KAAK,CAAC,CACzC;GACF,QAAQ,UACN,cAAc,eAAe,OAAO,kBAAkB,OAAO,IAAI,CAAC,CAAC,KACjE,OAAO,SAAS,UACd,OAAO;IAAE,KAAK,MAAM;IAAK,SAAS,CAAC;IAAG,WAAW,MAAM;GAAU,GAAG,MAAM,KAAK,CACjF,CACF;EACJ;CACF;CACA,OAAgB,QAAQ,MAAM,cAC5B,OAAO,IAAI,aAAa,YAAY;EAClC,MAAM,UAAU,YAAY,KAAK,OAAO;EACxC,OAAO,QAAQ,KAAK,aAAa,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,iBAAiB,OAAO,CAAC;CACtF,CAAC,CACH;AACF;AACA,MAAM,kBAAkB,OAAO,OAAO;CACpC,KAAK;CACL,cAAc,OAAO,SAAS,OAAO,cAAc;CACnD,eAAe,OAAO,SAAS,OAAO,OAAO;AAC/C,CAAC;AACD,MAAM,YAAY,aAAgC,EAChD,gBAAgB,OAAO,WAAW,WAAW,OAAoC;CAC/E,MAAM,QAAQ,OAAO,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,IAAI;CACxF,MAAM,UAAU,OAAO,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,GAAG,gBAAgB;CAC3E,MAAM,WAAW,OAAO,YAAY,SAAS,kBAAkB,MAAM;EACnE,KAAK,GAAG,QAAQ,OAAO,cAAc,WAAW,SAAS,MAAM,IAAI,GAAG,EAAE;EACxE,QAAQ;EACR,IAAI;GACF,GAAG,QAAQ;GACX,cAAc,MAAM;GACpB,eAAe,MAAM,kBAAkB,SAAY,SAAY,OAAO,MAAM,aAAa;GACzF,mBAAmB;EACrB;EACA,MAAM,CAAC;CACT,CAAC;CACD,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjE,CAAC,EACH;AACA,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAAkD,CAAC,CAC1F,qCACF,CAAC,CAAC;CACA,OAAgB,OAAO;CACvB,OAAgB,QAAQ,MAAM,OAAO,aAAa,OAAO,IAAI,YAAY,QAAQ,CAAC;AACpF"}

package/dist/gcs/post.d.ts

@@ -0,0 +1,31 @@
+import { ObjectRef } from "../core/object.js";
+import { StorageError } from "../core/errors.js";
+import { GrantConstraint } from "../core/capabilities.js";
+import { GcsStorage } from "../gcs.js";
+import { Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+declare const PostRequest: Schema.Struct<{
+  readonly key: Schema.NonEmptyString;
+  readonly expiresInSeconds: Schema.Int;
+  readonly minBytes: Schema.optional<Schema.Natural>;
+  readonly maxBytes: Schema.Natural;
+  readonly contentType: Schema.optional<Schema.String>;
+}>;
+export type GcsPostRequest = typeof PostRequest.Type;
+export interface GcsPostGrant {
+  readonly method: "POST";
+  readonly ref: ObjectRef;
+  readonly url: Redacted.Redacted<string>;
+  readonly fields: Redacted.Redacted<Readonly<Record<string, string>>>;
+  readonly expiresAt: DateTime.Utc;
+  readonly constraints: ReadonlyArray<GrantConstraint>;
+}
+declare const GcsPost_base: Context.ServiceClass<GcsPost, "@effect-kit/storage/gcs/GcsPost", {
+  readonly create: (input: GcsPostRequest) => Effect.Effect<GcsPostGrant, StorageError>;
+}>;
+export declare class GcsPost extends GcsPost_base {
+  static layer(options?: {
+    readonly authorityExpiresAt?: DateTime.Utc;
+  }): Layer.Layer<GcsPost, never, GcsStorage>;
+}
+export {};
+//# sourceMappingURL=post.d.ts.map

package/dist/gcs/post.js

@@ -0,0 +1,70 @@
+import { HeaderValue } from "../core/object.js";
+import { storageError } from "../core/errors.js";
+import { GcsKey } from "../providers/gcs/validation.js";
+import { GcsStorage } from "../gcs.js";
+import { Clock, Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+
+// src/providers/gcs/post.ts
+const PostRequest = Schema.Struct({
+	key: GcsKey,
+	expiresInSeconds: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 604800
+	})),
+	minBytes: Schema.optional(Schema.Natural),
+	maxBytes: Schema.Natural,
+	contentType: Schema.optional(HeaderValue)
+});
+var GcsPost = class GcsPost extends Context.Service()("@effect-kit/storage/gcs/GcsPost") {
+	static layer(options = {}) {
+		return Layer.effect(GcsPost, Effect.gen(function* () {
+			const storage = yield* GcsStorage;
+			return GcsPost.of({ create: Effect.fnUntraced(function* (input) {
+				const value = yield* Schema.decodeUnknownEffect(PostRequest, { onExcessProperty: "error" })(input).pipe(Effect.mapError(() => storageError("post", "gcs", {
+					_tag: "InvalidInput",
+					field: "policy"
+				}, "not-started")));
+				const now = yield* Clock.currentTimeMillis;
+				const expiry = Math.floor(Math.min(now + value.expiresInSeconds * 1e3, options.authorityExpiresAt ? DateTime.toEpochMillis(options.authorityExpiresAt) : Infinity) / 1e3) * 1e3;
+				if ((value.minBytes ?? 0) > value.maxBytes || value.key.includes(`\${filename}`) || expiry <= now || storage.config.apiEndpoint !== "https://storage.googleapis.com" || storage.config.kmsKeyName || storage.config.customerKey) return yield* storageError("post", "gcs", {
+					_tag: "Unsupported",
+					capability: "policy-or-authority"
+				}, "not-started");
+				const [grant] = yield* Effect.tryPromise({
+					try: () => storage.client.bucket(storage.config.bucket).file(value.key).generateSignedPostPolicyV4({
+						expires: expiry,
+						fields: value.contentType ? { "Content-Type": value.contentType } : {},
+						conditions: [[
+							"content-length-range",
+							value.minBytes ?? 0,
+							value.maxBytes
+						]]
+					}),
+					catch: () => storageError("post", "gcs", { _tag: "AccessDenied" }, "not-started")
+				});
+				return {
+					method: "POST",
+					ref: {
+						storeId: storage.storeId,
+						key: value.key
+					},
+					url: Redacted.make(grant.url),
+					fields: Redacted.make(grant.fields),
+					expiresAt: DateTime.makeUnsafe(expiry),
+					constraints: [{
+						kind: "minimum-bytes",
+						enforcement: "provider",
+						value: value.minBytes ?? 0
+					}, {
+						kind: "maximum-bytes",
+						enforcement: "provider",
+						value: value.maxBytes
+					}]
+				};
+			}) });
+		}));
+	}
+};
+
+export { GcsPost };
+//# sourceMappingURL=post.js.map

package/dist/gcs/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","names":[],"sources":["../../src/providers/gcs/post.ts"],"sourcesContent":["import { Clock, Context, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport type { GrantConstraint } from \"../../core/capabilities.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport type { StorageError } from \"../../core/errors.js\";\nimport { HeaderValue } from \"../../core/object.js\";\nimport type { ObjectRef } from \"../../core/object.js\";\nimport { GcsStorage } from \"./index.js\";\nimport { GcsKey } from \"./validation.js\";\n\nconst PostRequest = Schema.Struct({\n  key: GcsKey,\n  expiresInSeconds: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 604800 })),\n  minBytes: Schema.optional(Schema.Natural),\n  maxBytes: Schema.Natural,\n  contentType: Schema.optional(HeaderValue),\n});\nexport type GcsPostRequest = typeof PostRequest.Type;\nexport interface GcsPostGrant {\n  readonly method: \"POST\";\n  readonly ref: ObjectRef;\n  readonly url: Redacted.Redacted<string>;\n  readonly fields: Redacted.Redacted<Readonly<Record<string, string>>>;\n  readonly expiresAt: DateTime.Utc;\n  readonly constraints: ReadonlyArray<GrantConstraint>;\n}\nexport class GcsPost extends Context.Service<\n  GcsPost,\n  { readonly create: (input: GcsPostRequest) => Effect.Effect<GcsPostGrant, StorageError> }\n>()(\"@effect-kit/storage/gcs/GcsPost\") {\n  static layer(options: { readonly authorityExpiresAt?: DateTime.Utc } = {}) {\n    return Layer.effect(\n      GcsPost,\n      Effect.gen(function* () {\n        const storage = yield* GcsStorage;\n        return GcsPost.of({\n          create: Effect.fnUntraced(function* (input) {\n            const value = yield* Schema.decodeUnknownEffect(PostRequest, {\n              onExcessProperty: \"error\",\n            })(input).pipe(\n              Effect.mapError(() =>\n                storageError(\n                  \"post\",\n                  \"gcs\",\n                  { _tag: \"InvalidInput\", field: \"policy\" },\n                  \"not-started\",\n                ),\n              ),\n            );\n            const now = yield* Clock.currentTimeMillis;\n            const expiry =\n              Math.floor(\n                Math.min(\n                  now + value.expiresInSeconds * 1000,\n                  options.authorityExpiresAt\n                    ? DateTime.toEpochMillis(options.authorityExpiresAt)\n                    : Infinity,\n                ) / 1000,\n              ) * 1000;\n            if (\n              (value.minBytes ?? 0) > value.maxBytes ||\n              value.key.includes(`\\${filename}`) ||\n              expiry <= now ||\n              storage.config.apiEndpoint !== \"https://storage.googleapis.com\" ||\n              storage.config.kmsKeyName ||\n              storage.config.customerKey\n            )\n              return yield* storageError(\n                \"post\",\n                \"gcs\",\n                { _tag: \"Unsupported\", capability: \"policy-or-authority\" },\n                \"not-started\",\n              );\n            const [grant] = yield* Effect.tryPromise({\n              try: () =>\n                storage.client\n                  .bucket(storage.config.bucket)\n                  .file(value.key)\n                  .generateSignedPostPolicyV4({\n                    expires: expiry,\n                    fields: value.contentType ? { \"Content-Type\": value.contentType } : {},\n                    conditions: [[\"content-length-range\", value.minBytes ?? 0, value.maxBytes]],\n                  }),\n              catch: () => storageError(\"post\", \"gcs\", { _tag: \"AccessDenied\" }, \"not-started\"),\n            });\n            return {\n              method: \"POST\" as const,\n              ref: { storeId: storage.storeId, key: value.key },\n              url: Redacted.make(grant.url),\n              fields: Redacted.make(grant.fields),\n              expiresAt: DateTime.makeUnsafe(expiry),\n              constraints: [\n                {\n                  kind: \"minimum-bytes\",\n                  enforcement: \"provider\" as const,\n                  value: value.minBytes ?? 0,\n                },\n                { kind: \"maximum-bytes\", enforcement: \"provider\" as const, value: value.maxBytes },\n              ],\n            };\n          }),\n        });\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;;;AAUA,MAAM,cAAc,OAAO,OAAO;CAChC,KAAK;CACL,kBAAkB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CACpF,UAAU,OAAO,SAAS,OAAO,OAAO;CACxC,UAAU,OAAO;CACjB,aAAa,OAAO,SAAS,WAAW;AAC1C,CAAC;AAUD,IAAa,UAAb,MAAa,gBAAgB,QAAQ,QAGnC,CAAC,CAAC,iCAAiC,CAAC,CAAC;CACrC,OAAO,MAAM,UAA0D,CAAC,GAAG;EACzE,OAAO,MAAM,OACX,SACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GACvB,OAAO,QAAQ,GAAG,EAChB,QAAQ,OAAO,WAAW,WAAW,OAAO;IAC1C,MAAM,QAAQ,OAAO,OAAO,oBAAoB,aAAa,EAC3D,kBAAkB,QACpB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACR,OAAO,eACL,aACE,QACA,OACA;KAAE,MAAM;KAAgB,OAAO;IAAS,GACxC,aACF,CACF,CACF;IACA,MAAM,MAAM,OAAO,MAAM;IACzB,MAAM,SACJ,KAAK,MACH,KAAK,IACH,MAAM,MAAM,mBAAmB,KAC/B,QAAQ,qBACJ,SAAS,cAAc,QAAQ,kBAAkB,IACjD,QACN,IAAI,GACN,IAAI;IACN,KACG,MAAM,YAAY,KAAK,MAAM,YAC9B,MAAM,IAAI,SAAS,cAAc,KACjC,UAAU,OACV,QAAQ,OAAO,gBAAgB,oCAC/B,QAAQ,OAAO,cACf,QAAQ,OAAO,aAEf,OAAO,OAAO,aACZ,QACA,OACA;KAAE,MAAM;KAAe,YAAY;IAAsB,GACzD,aACF;IACF,MAAM,CAAC,SAAS,OAAO,OAAO,WAAW;KACvC,WACE,QAAQ,OACL,OAAO,QAAQ,OAAO,MAAM,CAAC,CAC7B,KAAK,MAAM,GAAG,CAAC,CACf,2BAA2B;MAC1B,SAAS;MACT,QAAQ,MAAM,cAAc,EAAE,gBAAgB,MAAM,YAAY,IAAI,CAAC;MACrE,YAAY,CAAC;OAAC;OAAwB,MAAM,YAAY;OAAG,MAAM;MAAQ,CAAC;KAC5E,CAAC;KACL,aAAa,aAAa,QAAQ,OAAO,EAAE,MAAM,eAAe,GAAG,aAAa;IAClF,CAAC;IACD,OAAO;KACL,QAAQ;KACR,KAAK;MAAE,SAAS,QAAQ;MAAS,KAAK,MAAM;KAAI;KAChD,KAAK,SAAS,KAAK,MAAM,GAAG;KAC5B,QAAQ,SAAS,KAAK,MAAM,MAAM;KAClC,WAAW,SAAS,WAAW,MAAM;KACrC,aAAa,CACX;MACE,MAAM;MACN,aAAa;MACb,OAAO,MAAM,YAAY;KAC3B,GACA;MAAE,MAAM;MAAiB,aAAa;MAAqB,OAAO,MAAM;KAAS,CACnF;IACF;GACF,CAAC,EACH,CAAC;EACH,CAAC,CACH;CACF;AACF"}

package/dist/gcs/signing.d.ts

@@ -0,0 +1,10 @@
+import { StorageSigning } from "../core/capabilities.js";
+import { GcsStorage } from "../gcs.js";
+import { DateTime, Layer } from "effect";
+/** Explicitly selected signing authority; ADC data access alone need not permit signBlob. */
+export declare const GcsSigning: {
+  layer(options?: {
+    readonly authorityExpiresAt?: DateTime.Utc;
+  }): Layer.Layer<StorageSigning, never, GcsStorage>;
+};
+//# sourceMappingURL=signing.d.ts.map

package/dist/gcs/signing.js

@@ -0,0 +1,61 @@
+import { storageError } from "../core/errors.js";
+import { StorageSigning } from "../core/capabilities.js";
+import { target } from "../providers/gcs/mapping.js";
+import { GcsStorage } from "../gcs.js";
+import { signingRequest } from "../internal/signing-request.js";
+import { Clock, DateTime, Effect, Layer, Redacted } from "effect";
+
+// src/providers/gcs/signing.ts
+/** Explicitly selected signing authority; ADC data access alone need not permit signBlob. */
+const GcsSigning = { layer(options = {}) {
+	return Layer.effect(StorageSigning, Effect.gen(function* () {
+		const storage = yield* GcsStorage;
+		return StorageSigning.of({ sign: Effect.fnUntraced(function* (request) {
+			yield* signingRequest(request, "gcs");
+			if (storage.config.customerKey) return yield* storageError("sign", "gcs", {
+				_tag: "Unsupported",
+				capability: "customer-key-signing"
+			}, "not-started");
+			const address = yield* target(storage, { ref: request.ref }, "sign");
+			if (request.method === "PUT" && (request.ref.version || storage.config.kmsKeyName)) return yield* storageError("sign", "gcs", {
+				_tag: "Unsupported",
+				capability: "generation-or-kms-write-signing"
+			}, "not-started");
+			const now = yield* Clock.currentTimeMillis;
+			const expiry = Math.floor(Math.min(now + request.expiresInSeconds * 1e3, options.authorityExpiresAt ? DateTime.toEpochMillis(options.authorityExpiresAt) : Infinity) / 1e3) * 1e3;
+			if (!Number.isSafeInteger(request.expiresInSeconds) || request.expiresInSeconds <= 0 || request.expiresInSeconds > 604800 || expiry <= now || storage.config.apiEndpoint !== "https://storage.googleapis.com") return yield* storageError("sign", "gcs", {
+				_tag: "InvalidInput",
+				field: "expiry-or-endpoint"
+			}, "not-started");
+			if (request.method === "HEAD") return yield* storageError("sign", "gcs", {
+				_tag: "Unsupported",
+				capability: "head-signing"
+			}, "not-started");
+			const action = {
+				GET: "read",
+				PUT: "write",
+				DELETE: "delete"
+			}[request.method];
+			const [url] = yield* Effect.tryPromise({
+				try: () => storage.client.bucket(storage.config.bucket).file(address.ref.key).getSignedUrl({
+					version: "v4",
+					action,
+					expires: expiry,
+					...address.ref.version ? { queryParams: { generation: address.ref.version.id } } : {}
+				}),
+				catch: () => storageError("sign", "gcs", { _tag: "AccessDenied" }, "not-started")
+			});
+			return {
+				method: request.method,
+				url: Redacted.make(url),
+				headers: Redacted.make({}),
+				ref: address.ref,
+				expiresAt: DateTime.makeUnsafe(expiry),
+				constraints: []
+			};
+		}) });
+	}));
+} };
+
+export { GcsSigning };
+//# sourceMappingURL=signing.js.map

package/dist/gcs/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","names":[],"sources":["../../src/providers/gcs/signing.ts"],"sourcesContent":["import { Clock, DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport { StorageSigning } from \"../../core/capabilities.js\";\nimport type { SignedRequest } from \"../../core/capabilities.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport { signingRequest } from \"../../internal/signing-request.js\";\nimport { GcsStorage } from \"./index.js\";\nimport { target } from \"./mapping.js\";\n\n/** Explicitly selected signing authority; ADC data access alone need not permit signBlob. */\nexport const GcsSigning = {\n  layer(options: { readonly authorityExpiresAt?: DateTime.Utc } = {}) {\n    return Layer.effect(\n      StorageSigning,\n      Effect.gen(function* () {\n        const storage = yield* GcsStorage;\n        return StorageSigning.of({\n          sign: Effect.fnUntraced(function* (request) {\n            yield* signingRequest(request, \"gcs\");\n            if (storage.config.customerKey)\n              return yield* storageError(\n                \"sign\",\n                \"gcs\",\n                { _tag: \"Unsupported\", capability: \"customer-key-signing\" },\n                \"not-started\",\n              );\n            const address = yield* target(storage, { ref: request.ref }, \"sign\");\n            if (request.method === \"PUT\" && (request.ref.version || storage.config.kmsKeyName))\n              return yield* storageError(\n                \"sign\",\n                \"gcs\",\n                { _tag: \"Unsupported\", capability: \"generation-or-kms-write-signing\" },\n                \"not-started\",\n              );\n            const now = yield* Clock.currentTimeMillis;\n            const expiry =\n              Math.floor(\n                Math.min(\n                  now + request.expiresInSeconds * 1000,\n                  options.authorityExpiresAt\n                    ? DateTime.toEpochMillis(options.authorityExpiresAt)\n                    : Infinity,\n                ) / 1000,\n              ) * 1000;\n            if (\n              !Number.isSafeInteger(request.expiresInSeconds) ||\n              request.expiresInSeconds <= 0 ||\n              request.expiresInSeconds > 604800 ||\n              expiry <= now ||\n              storage.config.apiEndpoint !== \"https://storage.googleapis.com\"\n            )\n              return yield* storageError(\n                \"sign\",\n                \"gcs\",\n                { _tag: \"InvalidInput\", field: \"expiry-or-endpoint\" },\n                \"not-started\",\n              );\n            if (request.method === \"HEAD\")\n              return yield* storageError(\n                \"sign\",\n                \"gcs\",\n                { _tag: \"Unsupported\", capability: \"head-signing\" },\n                \"not-started\",\n              );\n            const actions = { GET: \"read\", PUT: \"write\", DELETE: \"delete\" } as const;\n            const action = actions[request.method];\n            const [url] = yield* Effect.tryPromise({\n              try: () =>\n                storage.client\n                  .bucket(storage.config.bucket)\n                  .file(address.ref.key)\n                  .getSignedUrl({\n                    version: \"v4\",\n                    action,\n                    expires: expiry,\n                    ...(address.ref.version\n                      ? { queryParams: { generation: address.ref.version.id } }\n                      : {}),\n                  }),\n              catch: () => storageError(\"sign\", \"gcs\", { _tag: \"AccessDenied\" }, \"not-started\"),\n            });\n            return {\n              method: request.method,\n              url: Redacted.make(url),\n              headers: Redacted.make({}),\n              ref: address.ref,\n              expiresAt: DateTime.makeUnsafe(expiry),\n              constraints: [],\n            } satisfies SignedRequest;\n          }),\n        });\n      }),\n    );\n  },\n};\n"],"mappings":";;;;;;;;;AAUA,MAAa,aAAa,EACxB,MAAM,UAA0D,CAAC,GAAG;CAClE,OAAO,MAAM,OACX,gBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,OAAO,eAAe,GAAG,EACvB,MAAM,OAAO,WAAW,WAAW,SAAS;GAC1C,OAAO,eAAe,SAAS,KAAK;GACpC,IAAI,QAAQ,OAAO,aACjB,OAAO,OAAO,aACZ,QACA,OACA;IAAE,MAAM;IAAe,YAAY;GAAuB,GAC1D,aACF;GACF,MAAM,UAAU,OAAO,OAAO,SAAS,EAAE,KAAK,QAAQ,IAAI,GAAG,MAAM;GACnE,IAAI,QAAQ,WAAW,UAAU,QAAQ,IAAI,WAAW,QAAQ,OAAO,aACrE,OAAO,OAAO,aACZ,QACA,OACA;IAAE,MAAM;IAAe,YAAY;GAAkC,GACrE,aACF;GACF,MAAM,MAAM,OAAO,MAAM;GACzB,MAAM,SACJ,KAAK,MACH,KAAK,IACH,MAAM,QAAQ,mBAAmB,KACjC,QAAQ,qBACJ,SAAS,cAAc,QAAQ,kBAAkB,IACjD,QACN,IAAI,GACN,IAAI;GACN,IACE,CAAC,OAAO,cAAc,QAAQ,gBAAgB,KAC9C,QAAQ,oBAAoB,KAC5B,QAAQ,mBAAmB,UAC3B,UAAU,OACV,QAAQ,OAAO,gBAAgB,kCAE/B,OAAO,OAAO,aACZ,QACA,OACA;IAAE,MAAM;IAAgB,OAAO;GAAqB,GACpD,aACF;GACF,IAAI,QAAQ,WAAW,QACrB,OAAO,OAAO,aACZ,QACA,OACA;IAAE,MAAM;IAAe,YAAY;GAAe,GAClD,aACF;GAEF,MAAM,SAAS;IADG,KAAK;IAAQ,KAAK;IAAS,QAAQ;GAChC,EAAE,QAAQ;GAC/B,MAAM,CAAC,OAAO,OAAO,OAAO,WAAW;IACrC,WACE,QAAQ,OACL,OAAO,QAAQ,OAAO,MAAM,CAAC,CAC7B,KAAK,QAAQ,IAAI,GAAG,CAAC,CACrB,aAAa;KACZ,SAAS;KACT;KACA,SAAS;KACT,GAAI,QAAQ,IAAI,UACZ,EAAE,aAAa,EAAE,YAAY,QAAQ,IAAI,QAAQ,GAAG,EAAE,IACtD,CAAC;IACP,CAAC;IACL,aAAa,aAAa,QAAQ,OAAO,EAAE,MAAM,eAAe,GAAG,aAAa;GAClF,CAAC;GACD,OAAO;IACL,QAAQ,QAAQ;IAChB,KAAK,SAAS,KAAK,GAAG;IACtB,SAAS,SAAS,KAAK,CAAC,CAAC;IACzB,KAAK,QAAQ;IACb,WAAW,SAAS,WAAW,MAAM;IACrC,aAAa,CAAC;GAChB;EACF,CAAC,EACH,CAAC;CACH,CAAC,CACH;AACF,EACF"}

package/dist/gcs/uploads.d.ts

@@ -0,0 +1,10 @@
+import { UploadError } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { GcsStorage } from "../gcs.js";
+import { Layer } from "effect";
+export declare const GcsUploadGrants: {
+  layer(options?: {
+    readonly chunkBytes?: number;
+  }): Layer.Layer<UploadGrantDriver, UploadError, GcsStorage>;
+};
+//# sourceMappingURL=uploads.d.ts.map

package/dist/gcs/uploads.js

@@ -0,0 +1,76 @@
+import { failUpload } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { operationMetadata } from "../uploads/verification.js";
+import { GcsStorage } from "../gcs.js";
+import { Clock, Effect, Layer, Redacted, Schema } from "effect";
+
+// src/providers/gcs/uploads.ts
+const decode = (remote) => Schema.decodeUnknownEffect(Schema.Struct({
+	url: Schema.String,
+	total: Schema.Natural,
+	expiresAt: Schema.Number
+}))(remote).pipe(Effect.mapError(() => failUpload("Conflict")));
+const GcsUploadGrants = { layer(options = {}) {
+	return Layer.effect(UploadGrantDriver, Effect.gen(function* () {
+		const storage = yield* GcsStorage;
+		const chunkBytes = options.chunkBytes ?? 8 * 1024 ** 2;
+		if (chunkBytes < 262144 || chunkBytes % 262144 || chunkBytes > 64 * 1024 ** 2) return yield* failUpload("BadRequest");
+		return UploadGrantDriver.of({
+			maximumGrantLifetimeMillis: 60486e4,
+			begin: Effect.fnUntraced(function* (record) {
+				if (storage.config.customerKey || !["auto", "resumable"].includes(record.input.strategy ?? "auto")) return yield* failUpload("Unsupported");
+				const upload = yield* storage.offsets.create({
+					key: record.stagingKey,
+					contentLength: record.input.file.size,
+					contentType: record.input.file.contentType,
+					customMetadata: operationMetadata(record),
+					condition: { _tag: "CreateOnly" }
+				});
+				return {
+					...yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+						url: Schema.String,
+						total: Schema.Natural
+					})))(Redacted.value(upload.handle)).pipe(Effect.mapError(() => failUpload("Unavailable"))),
+					expiresAt: (yield* Clock.currentTimeMillis) + 6048e5
+				};
+			}),
+			grant: Effect.fnUntraced(function* (record, expiresAt) {
+				const remote = yield* decode(record.remote ? Redacted.value(record.remote) : void 0);
+				const state = yield* storage.offsets.query({
+					protocol: "gcs-resumable-v1",
+					ref: {
+						storeId: storage.storeId,
+						key: record.stagingKey
+					},
+					handle: Redacted.make(JSON.stringify(remote))
+				});
+				if (state._tag === "Expired") return yield* failUpload("Expired");
+				if (state._tag === "Unknown") return yield* failUpload("Unavailable");
+				return {
+					_tag: "Resumable",
+					protocol: "gcs",
+					url: remote.url,
+					headers: {},
+					offset: state._tag === "Completed" ? record.input.file.size : state.committedOffset,
+					chunkBytes,
+					expiresAt: Math.min(expiresAt, remote.expiresAt)
+				};
+			}),
+			abort: Effect.fnUntraced(function* (record) {
+				if (record.remote === void 0) return;
+				const remote = yield* decode(record.remote ? Redacted.value(record.remote) : void 0);
+				yield* storage.offsets.cancel({
+					protocol: "gcs-resumable-v1",
+					ref: {
+						storeId: storage.storeId,
+						key: record.stagingKey
+					},
+					handle: Redacted.make(JSON.stringify(remote))
+				});
+			})
+		});
+	}));
+} };
+
+export { GcsUploadGrants };
+//# sourceMappingURL=uploads.js.map