@effect-kit/storage 0.0.0-stage → 0.1.0

package/dist/s3/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","names":[],"sources":["../../src/providers/s3/post.ts"],"sourcesContent":["import type { DateTime } from \"effect\";\nimport { Context, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport { createPresignedPost } from \"@aws-sdk/s3-presigned-post\";\n\nimport type { GrantConstraint } from \"../../core/capabilities.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport type { StorageError } from \"../../core/errors.js\";\nimport type { ObjectRef } from \"../../core/object.js\";\nimport { HeaderValue, ObjectKey } from \"../../core/object.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { S3Storage } from \"./index.js\";\nimport type { S3StorageService } from \"./index.js\";\nimport { signingCredentials } from \"./signing-credentials.js\";\nimport { request } from \"./transport.js\";\n\nconst PostRequest = Schema.Struct({\n  key: ObjectKey,\n  expiresInSeconds: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 604800 })),\n  maxBytes: Schema.Natural,\n  minBytes: Schema.optional(Schema.Natural),\n  contentType: Schema.optional(HeaderValue),\n  customMetadata: Schema.optional(\n    Schema.Record(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]+$/u)), HeaderValue),\n  ),\n});\nexport type S3PostRequest = typeof PostRequest.Type;\n\nexport interface S3PostGrant {\n  readonly method: \"POST\";\n  readonly ref: ObjectRef;\n  readonly url: Redacted.Redacted<string>;\n  readonly fields: Redacted.Redacted<Readonly<Record<string, string>>>;\n  readonly expiresAt: DateTime.Utc;\n  readonly constraints: ReadonlyArray<GrantConstraint>;\n}\n\nexport class S3Post extends Context.Service<\n  S3Post,\n  { readonly create: (input: S3PostRequest) => Effect.Effect<S3PostGrant, StorageError> }\n>()(\"@effect-kit/storage/s3/S3Post\") {\n  static make(storage: S3StorageService): S3Post[\"Service\"] {\n    return {\n      create: Effect.fnUntraced(function* (input) {\n        const value = yield* decodeRequest(PostRequest, input, \"post\", \"s3\");\n        if (\n          storage.profile &&\n          (!storage.profile.post || value.maxBytes > storage.profile.limits.maximumSinglePutBytes)\n        )\n          return yield* storageError(\n            \"post\",\n            storage.profile.provider,\n            { _tag: \"Unsupported\", capability: \"post-policy\" },\n            \"not-started\",\n          );\n        if ((value.minBytes ?? 0) > value.maxBytes || value.key.includes(`\\${filename}`))\n          return yield* storageError(\"post\", \"s3\", { _tag: \"InvalidInput\", field: \"policy\" });\n        if (\n          storage.config.encryption ||\n          storage.config.expectedBucketOwner ||\n          storage.config.requestPayer\n        )\n          return yield* storageError(\"post\", \"s3\", {\n            _tag: \"Unsupported\",\n            capability: \"post-config-authority\",\n          });\n        const credentials = yield* signingCredentials(storage, value.expiresInSeconds);\n        const fields: Record<string, string> = {};\n        if (value.contentType !== undefined) fields[\"Content-Type\"] = value.contentType;\n        for (const [name, content] of Object.entries(value.customMetadata ?? {}))\n          fields[`x-amz-meta-${name.toLowerCase()}`] = content;\n        const grant = yield* request(storage, \"post\", false, () =>\n          createPresignedPost(credentials.client, {\n            Bucket: storage.config.bucket,\n            Key: value.key,\n            Expires: credentials.seconds,\n            Fields: fields,\n            Conditions: [[\"content-length-range\", value.minBytes ?? 0, value.maxBytes]],\n          }),\n        );\n        const policy = yield* Schema.decodeUnknownEffect(\n          Schema.fromJsonString(\n            Schema.Struct({\n              expiration: Schema.DateTimeUtcFromString,\n              conditions: Schema.Array(Schema.Unknown),\n            }),\n          ),\n        )(Buffer.from(grant.fields.Policy ?? \"\", \"base64\").toString(\"utf8\")).pipe(\n          Effect.mapError(() =>\n            storageError(\"post\", \"s3\", { _tag: \"ProviderFailure\", code: \"InvalidPostPolicy\" }),\n          ),\n        );\n        return {\n          method: \"POST\",\n          ref: { storeId: storage.storeId, key: value.key },\n          url: Redacted.make(grant.url),\n          fields: Redacted.make(grant.fields),\n          expiresAt: policy.expiration,\n          constraints: [\n            { kind: \"minimum-bytes\", enforcement: \"provider\", value: value.minBytes ?? 0 },\n            { kind: \"maximum-bytes\", enforcement: \"provider\", value: value.maxBytes },\n            ...Object.keys(fields).map((name) => ({\n              kind: `field:${name}`,\n              enforcement: \"provider\" as const,\n              value: \"required\",\n            })),\n          ],\n        };\n      }),\n    };\n  }\n\n  static readonly layer = Layer.effect(S3Post, Effect.map(S3Storage, S3Post.make));\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,cAAc,OAAO,OAAO;CAChC,KAAK;CACL,kBAAkB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CACpF,UAAU,OAAO;CACjB,UAAU,OAAO,SAAS,OAAO,OAAO;CACxC,aAAa,OAAO,SAAS,WAAW;CACxC,gBAAgB,OAAO,SACrB,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,oBAAoB,CAAC,GAAG,WAAW,CACxF;AACF,CAAC;AAYD,IAAa,SAAb,MAAa,eAAe,QAAQ,QAGlC,CAAC,CAAC,+BAA+B,CAAC,CAAC;CACnC,OAAO,KAAK,SAA8C;EACxD,OAAO,EACL,QAAQ,OAAO,WAAW,WAAW,OAAO;GAC1C,MAAM,QAAQ,OAAO,cAAc,aAAa,OAAO,QAAQ,IAAI;GACnE,IACE,QAAQ,YACP,CAAC,QAAQ,QAAQ,QAAQ,MAAM,WAAW,QAAQ,QAAQ,OAAO,wBAElE,OAAO,OAAO,aACZ,QACA,QAAQ,QAAQ,UAChB;IAAE,MAAM;IAAe,YAAY;GAAc,GACjD,aACF;GACF,KAAK,MAAM,YAAY,KAAK,MAAM,YAAY,MAAM,IAAI,SAAS,cAAc,GAC7E,OAAO,OAAO,aAAa,QAAQ,MAAM;IAAE,MAAM;IAAgB,OAAO;GAAS,CAAC;GACpF,IACE,QAAQ,OAAO,cACf,QAAQ,OAAO,uBACf,QAAQ,OAAO,cAEf,OAAO,OAAO,aAAa,QAAQ,MAAM;IACvC,MAAM;IACN,YAAY;GACd,CAAC;GACH,MAAM,cAAc,OAAO,mBAAmB,SAAS,MAAM,gBAAgB;GAC7E,MAAM,SAAiC,CAAC;GACxC,IAAI,MAAM,gBAAgB,QAAW,OAAO,kBAAkB,MAAM;GACpE,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,MAAM,kBAAkB,CAAC,CAAC,GACrE,OAAO,cAAc,KAAK,YAAY,OAAO;GAC/C,MAAM,QAAQ,OAAO,QAAQ,SAAS,QAAQ,aAC5C,oBAAoB,YAAY,QAAQ;IACtC,QAAQ,QAAQ,OAAO;IACvB,KAAK,MAAM;IACX,SAAS,YAAY;IACrB,QAAQ;IACR,YAAY,CAAC;KAAC;KAAwB,MAAM,YAAY;KAAG,MAAM;IAAQ,CAAC;GAC5E,CAAC,CACH;GACA,MAAM,SAAS,OAAO,OAAO,oBAC3B,OAAO,eACL,OAAO,OAAO;IACZ,YAAY,OAAO;IACnB,YAAY,OAAO,MAAM,OAAO,OAAO;GACzC,CAAC,CACH,CACF,CAAC,CAAC,OAAO,KAAK,MAAM,OAAO,UAAU,IAAI,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,KACnE,OAAO,eACL,aAAa,QAAQ,MAAM;IAAE,MAAM;IAAmB,MAAM;GAAoB,CAAC,CACnF,CACF;GACA,OAAO;IACL,QAAQ;IACR,KAAK;KAAE,SAAS,QAAQ;KAAS,KAAK,MAAM;IAAI;IAChD,KAAK,SAAS,KAAK,MAAM,GAAG;IAC5B,QAAQ,SAAS,KAAK,MAAM,MAAM;IAClC,WAAW,OAAO;IAClB,aAAa;KACX;MAAE,MAAM;MAAiB,aAAa;MAAY,OAAO,MAAM,YAAY;KAAE;KAC7E;MAAE,MAAM;MAAiB,aAAa;MAAY,OAAO,MAAM;KAAS;KACxE,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,UAAU;MACpC,MAAM,SAAS;MACf,aAAa;MACb,OAAO;KACT,EAAE;IACJ;GACF;EACF,CAAC,EACH;CACF;CAEA,OAAgB,QAAQ,MAAM,OAAO,QAAQ,OAAO,IAAI,WAAW,OAAO,IAAI,CAAC;AACjF"}

package/dist/s3/signing.d.ts

@@ -0,0 +1,105 @@
+import { StorageError } from "../core/errors.js";
+import { SignedRequest, StorageSigning } from "../core/capabilities.js";
+import { S3Storage, S3StorageService } from "../s3.js";
+import { Context, Effect, Layer, Schema } from "effect";
+declare const SignRequest: Schema.Struct<{
+  readonly ref: Schema.Struct<{
+    readonly storeId: Schema.NonEmptyString;
+    readonly key: Schema.NonEmptyString;
+    readonly version: Schema.optional<Schema.Union<readonly [Schema.TaggedStruct<"S3Version", {
+      readonly id: Schema.NonEmptyString;
+    }>, Schema.TaggedStruct<"GcsGeneration", {
+      readonly id: Schema.NonEmptyString;
+      readonly metageneration: Schema.optional<Schema.NonEmptyString>;
+    }>, Schema.TaggedStruct<"AzureVersion", {
+      readonly id: Schema.NonEmptyString;
+    }>, Schema.TaggedStruct<"AzureSnapshot", {
+      readonly id: Schema.NonEmptyString;
+    }>, Schema.TaggedStruct<"OpaqueVersion", {
+      readonly provider: Schema.NonEmptyString;
+      readonly id: Schema.NonEmptyString;
+    }>]>>;
+  }>;
+  readonly method: Schema.Literals<readonly ["GET", "HEAD", "PUT", "DELETE"]>;
+  readonly expiresInSeconds: Schema.Int;
+  readonly headers: Schema.optional<Schema.Struct<{
+    readonly contentType: Schema.optional<Schema.String>;
+    readonly contentEncoding: Schema.optional<Schema.String>;
+    readonly contentLanguage: Schema.optional<Schema.String>;
+    readonly contentDisposition: Schema.optional<Schema.String>;
+    readonly cacheControl: Schema.optional<Schema.String>;
+    readonly customMetadata: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+  }>>;
+  readonly condition: Schema.optional<Schema.Union<readonly [Schema.TaggedStruct<"CreateOnly", {}>, Schema.TaggedStruct<"IfMatch", {
+    readonly etag: Schema.String;
+  }>]>>;
+  readonly checksum: Schema.optional<Schema.Struct<{
+    readonly ChecksumAlgorithm: Schema.optional<Schema.Literals<readonly ["CRC32", "CRC32C", "CRC64NVME", "SHA1", "SHA256", "SHA512", "MD5", "XXHASH64", "XXHASH3", "XXHASH128"]>>;
+    readonly ChecksumCRC32: Schema.optional<Schema.String>;
+    readonly ChecksumCRC32C: Schema.optional<Schema.String>;
+    readonly ChecksumCRC64NVME: Schema.optional<Schema.String>;
+    readonly ChecksumSHA1: Schema.optional<Schema.String>;
+    readonly ChecksumSHA256: Schema.optional<Schema.String>;
+    readonly ChecksumSHA512: Schema.optional<Schema.String>;
+    readonly ChecksumMD5: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH64: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH3: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH128: Schema.optional<Schema.String>;
+    readonly ChecksumType: Schema.optional<Schema.Literals<readonly ["FULL_OBJECT", "COMPOSITE"]>>;
+  }>>;
+  readonly contentLength: Schema.optional<Schema.Natural>;
+}>;
+export type S3SignRequest = typeof SignRequest.Type;
+declare const SignPart: Schema.Struct<{
+  readonly upload: Schema.Struct<{
+    readonly ref: Schema.Struct<{
+      readonly storeId: Schema.NonEmptyString;
+      readonly key: Schema.NonEmptyString;
+      readonly version: Schema.optional<Schema.Union<readonly [Schema.TaggedStruct<"S3Version", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"GcsGeneration", {
+        readonly id: Schema.NonEmptyString;
+        readonly metageneration: Schema.optional<Schema.NonEmptyString>;
+      }>, Schema.TaggedStruct<"AzureVersion", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"AzureSnapshot", {
+        readonly id: Schema.NonEmptyString;
+      }>, Schema.TaggedStruct<"OpaqueVersion", {
+        readonly provider: Schema.NonEmptyString;
+        readonly id: Schema.NonEmptyString;
+      }>]>>;
+    }>;
+    readonly uploadId: Schema.Redacted<Schema.NonEmptyString>;
+    readonly checksumAlgorithm: Schema.optional<Schema.Literals<readonly ["CRC32", "CRC32C", "CRC64NVME", "SHA1", "SHA256", "SHA512", "MD5", "XXHASH64", "XXHASH3", "XXHASH128"]>>;
+    readonly checksumType: Schema.optional<Schema.Literals<readonly ["FULL_OBJECT", "COMPOSITE"]>>;
+  }>;
+  readonly partNumber: Schema.Int;
+  readonly expiresInSeconds: Schema.Int;
+  readonly checksum: Schema.optional<Schema.Struct<{
+    readonly ChecksumAlgorithm: Schema.optional<Schema.Literals<readonly ["CRC32", "CRC32C", "CRC64NVME", "SHA1", "SHA256", "SHA512", "MD5", "XXHASH64", "XXHASH3", "XXHASH128"]>>;
+    readonly ChecksumCRC32: Schema.optional<Schema.String>;
+    readonly ChecksumCRC32C: Schema.optional<Schema.String>;
+    readonly ChecksumCRC64NVME: Schema.optional<Schema.String>;
+    readonly ChecksumSHA1: Schema.optional<Schema.String>;
+    readonly ChecksumSHA256: Schema.optional<Schema.String>;
+    readonly ChecksumSHA512: Schema.optional<Schema.String>;
+    readonly ChecksumMD5: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH64: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH3: Schema.optional<Schema.String>;
+    readonly ChecksumXXHASH128: Schema.optional<Schema.String>;
+    readonly ChecksumType: Schema.optional<Schema.Literals<readonly ["FULL_OBJECT", "COMPOSITE"]>>;
+  }>>;
+  readonly contentLength: Schema.optional<Schema.Natural>;
+}>;
+export type S3SignPartRequest = typeof SignPart.Type;
+export interface S3SigningService {
+  readonly sign: (input: S3SignRequest) => Effect.Effect<SignedRequest, StorageError>;
+  readonly signPart: (input: S3SignPartRequest) => Effect.Effect<SignedRequest, StorageError>;
+}
+declare const S3Signing_base: Context.ServiceClass<S3Signing, "@effect-kit/storage/s3/S3Signing", S3SigningService>;
+export declare class S3Signing extends S3Signing_base {
+  static make(storage: S3StorageService): S3SigningService;
+  static readonly layer: Layer.Layer<S3Signing | StorageSigning, never, S3Storage>;
+}
+export {};
+//# sourceMappingURL=signing.d.ts.map

package/dist/s3/signing.js

@@ -0,0 +1,198 @@
+import { ObjectHeaders, ObjectRef, ObjectSize } from "../core/object.js";
+import { storageError } from "../core/errors.js";
+import { decodeRequest } from "../internal/request-validation.js";
+import { WriteCondition } from "../core/requests.js";
+import { StorageSigning } from "../core/capabilities.js";
+import { authority, encryptionHeaders, readEncryption } from "../providers/s3/config.js";
+import { condition, headers, validateRef } from "../providers/s3/object-mapping.js";
+import { enforceProfile } from "../providers/s3/profile.js";
+import { request } from "../providers/s3/transport.js";
+import { ChecksumOptions, PartNumber, Upload } from "../providers/s3/native-models.js";
+import { S3Storage } from "../s3.js";
+import { signingCredentials } from "../providers/s3/signing-credentials.js";
+import { Context, DateTime, Effect, Layer, Predicate, Redacted, Schema } from "effect";
+import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, UploadPartCommand } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+
+// src/providers/s3/signing.ts
+const Expiry = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 604800
+}));
+const SignRequest = Schema.Struct({
+	ref: ObjectRef,
+	method: Schema.Literals([
+		"GET",
+		"HEAD",
+		"PUT",
+		"DELETE"
+	]),
+	expiresInSeconds: Expiry,
+	headers: Schema.optional(ObjectHeaders),
+	condition: Schema.optional(WriteCondition),
+	checksum: Schema.optional(ChecksumOptions),
+	contentLength: Schema.optional(ObjectSize)
+});
+const SignPart = Schema.Struct({
+	upload: Upload,
+	partNumber: PartNumber,
+	expiresInSeconds: Expiry,
+	checksum: Schema.optional(ChecksumOptions),
+	contentLength: Schema.optional(ObjectSize)
+});
+const nativeHeaderNames = {
+	ContentType: "content-type",
+	ContentEncoding: "content-encoding",
+	ContentLanguage: "content-language",
+	ContentDisposition: "content-disposition",
+	CacheControl: "cache-control",
+	ContentLength: "content-length",
+	IfMatch: "if-match",
+	IfNoneMatch: "if-none-match",
+	ExpectedBucketOwner: "x-amz-expected-bucket-owner",
+	RequestPayer: "x-amz-request-payer",
+	SSECustomerAlgorithm: "x-amz-server-side-encryption-customer-algorithm",
+	SSECustomerKey: "x-amz-server-side-encryption-customer-key",
+	SSECustomerKeyMD5: "x-amz-server-side-encryption-customer-key-md5",
+	ServerSideEncryption: "x-amz-server-side-encryption",
+	SSEKMSKeyId: "x-amz-server-side-encryption-aws-kms-key-id",
+	BucketKeyEnabled: "x-amz-server-side-encryption-bucket-key-enabled",
+	ChecksumCRC32: "x-amz-checksum-crc32",
+	ChecksumCRC32C: "x-amz-checksum-crc32c",
+	ChecksumCRC64NVME: "x-amz-checksum-crc64nvme",
+	ChecksumSHA1: "x-amz-checksum-sha1",
+	ChecksumSHA256: "x-amz-checksum-sha256",
+	ChecksumSHA512: "x-amz-checksum-sha512",
+	ChecksumMD5: "x-amz-checksum-md5",
+	ChecksumXXHASH64: "x-amz-checksum-xxhash64",
+	ChecksumXXHASH3: "x-amz-checksum-xxhash3",
+	ChecksumXXHASH128: "x-amz-checksum-xxhash128"
+};
+function requiredHeaders(input) {
+	const result = {};
+	for (const [native, name] of Object.entries(nativeHeaderNames)) {
+		const value = Reflect.get(input, native);
+		if (value !== void 0) result[name] = String(value);
+	}
+	const metadata = Reflect.get(input, "Metadata");
+	if (metadata && typeof metadata === "object") for (const [name, value] of Object.entries(metadata)) result[`x-amz-meta-${name.toLowerCase()}`] = String(value);
+	return result;
+}
+const signed = Effect.fnUntraced(function* (storage, ref, method, expiresInSeconds, command) {
+	const credentials = yield* signingCredentials(storage, expiresInSeconds);
+	const expected = requiredHeaders(command.input);
+	let captured = {};
+	credentials.client.middlewareStack.add((next) => async (args) => {
+		if (Predicate.isObject(args.request) && Predicate.isObject(args.request.headers)) captured = Object.fromEntries(Object.entries(args.request.headers).filter((entry) => typeof entry[1] === "string"));
+		return next(args);
+	}, {
+		name: "storageSigningHeaders",
+		step: "build",
+		priority: "low"
+	});
+	const options = {
+		expiresIn: credentials.seconds,
+		signingDate: DateTime.toDateUtc(credentials.now),
+		signableHeaders: new Set(Object.keys(expected)),
+		unhoistableHeaders: new Set(Object.keys(expected))
+	};
+	const url = yield* request(storage, "sign", false, () => {
+		if (command instanceof PutObjectCommand) return getSignedUrl(credentials.client, command, options);
+		if (command instanceof GetObjectCommand) return getSignedUrl(credentials.client, command, options);
+		if (command instanceof HeadObjectCommand) return getSignedUrl(credentials.client, command, options);
+		if (command instanceof UploadPartCommand) return getSignedUrl(credentials.client, command, options);
+		return getSignedUrl(credentials.client, command, options);
+	});
+	const names = new URL(url).searchParams.get("X-Amz-SignedHeaders")?.split(";") ?? [];
+	const required = {};
+	for (const name of names) {
+		if (name === "host") continue;
+		const value = captured[name];
+		if (value === void 0) return yield* storageError("sign", "s3", {
+			_tag: "ProviderFailure",
+			code: "UnknownSignedHeader"
+		});
+		required[name] = value;
+	}
+	const constraints = Object.keys(required).map((name) => ({
+		kind: `header:${name}`,
+		value: "required",
+		enforcement: "provider"
+	}));
+	return {
+		method,
+		ref,
+		url: Redacted.make(url),
+		headers: Redacted.make(required),
+		expiresAt: credentials.expiresAt,
+		constraints
+	};
+});
+var S3Signing = class S3Signing extends Context.Service()("@effect-kit/storage/s3/S3Signing") {
+	static make(storage) {
+		return {
+			sign: Effect.fnUntraced(function* (input) {
+				const value = yield* decodeRequest(SignRequest, input, "sign", "s3");
+				yield* enforceProfile(storage, "sign", value);
+				yield* validateRef(value.ref, storage.config, "sign");
+				if (value.method !== "PUT" && (value.headers || value.condition || value.checksum || value.contentLength !== void 0)) return yield* storageError("sign", "s3", {
+					_tag: "Unsupported",
+					capability: "write-fields-on-read-grant"
+				});
+				if (value.method === "PUT" && value.ref.version) return yield* storageError("sign", "s3", {
+					_tag: "Unsupported",
+					capability: "write-version"
+				});
+				if (value.checksum?.ChecksumAlgorithm || value.checksum?.ChecksumType) return yield* storageError("sign", "s3", {
+					_tag: "InvalidInput",
+					field: "checksum.value-required"
+				});
+				const base = {
+					...authority(storage.config),
+					Key: value.ref.key,
+					VersionId: value.ref.version?.id
+				};
+				const command = value.method === "GET" ? new GetObjectCommand({
+					...base,
+					...readEncryption(storage.config.encryption)
+				}) : value.method === "HEAD" ? new HeadObjectCommand({
+					...base,
+					...readEncryption(storage.config.encryption)
+				}) : value.method === "DELETE" ? new DeleteObjectCommand(base) : new PutObjectCommand({
+					...base,
+					...headers(value.headers ?? {}),
+					...encryptionHeaders(storage.config.encryption),
+					...condition(value.condition),
+					...value.checksum,
+					ContentLength: value.contentLength
+				});
+				return yield* signed(storage, value.ref, value.method, value.expiresInSeconds, command);
+			}),
+			signPart: Effect.fnUntraced(function* (input) {
+				const value = yield* decodeRequest(SignPart, input, "signPart", "s3");
+				yield* enforceProfile(storage, "signPart", value);
+				yield* validateRef(value.upload.ref, storage.config, "signPart");
+				if (value.upload.ref.version || value.checksum?.ChecksumAlgorithm || value.checksum?.ChecksumType) return yield* storageError("signPart", "s3", {
+					_tag: "InvalidInput",
+					field: "part"
+				});
+				return yield* signed(storage, value.upload.ref, "PUT", value.expiresInSeconds, new UploadPartCommand({
+					...authority(storage.config),
+					...encryptionHeaders(storage.config.encryption),
+					...value.checksum,
+					Key: value.upload.ref.key,
+					UploadId: Redacted.value(value.upload.uploadId),
+					PartNumber: value.partNumber,
+					ContentLength: value.contentLength
+				}));
+			})
+		};
+	}
+	static layer = Layer.effectContext(Effect.map(S3Storage, (storage) => {
+		const service = S3Signing.make(storage);
+		return Context.make(S3Signing, service).pipe(Context.add(StorageSigning, service));
+	}));
+};
+
+export { S3Signing };
+//# sourceMappingURL=signing.js.map

package/dist/s3/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","names":[],"sources":["../../src/providers/s3/signing.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Predicate, Redacted, Schema } from \"effect\";\n\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  UploadPartCommand,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\n\nimport { StorageSigning } from \"../../core/capabilities.js\";\nimport type { GrantConstraint, SignedRequest } from \"../../core/capabilities.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport type { StorageError } from \"../../core/errors.js\";\nimport { ObjectHeaders, ObjectRef, ObjectSize } from \"../../core/object.js\";\nimport { WriteCondition } from \"../../core/requests.js\";\nimport { decodeRequest } from \"../../internal/request-validation.js\";\nimport { authority, encryptionHeaders, readEncryption } from \"./config.js\";\nimport { S3Storage } from \"./index.js\";\nimport type { S3StorageService } from \"./index.js\";\nimport { ChecksumOptions, PartNumber, Upload } from \"./native-models.js\";\nimport { condition, headers, validateRef } from \"./object-mapping.js\";\nimport { enforceProfile } from \"./profile.js\";\nimport { signingCredentials } from \"./signing-credentials.js\";\nimport { request } from \"./transport.js\";\n\nconst Expiry = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 604800 }));\nconst SignRequest = Schema.Struct({\n  ref: ObjectRef,\n  method: Schema.Literals([\"GET\", \"HEAD\", \"PUT\", \"DELETE\"]),\n  expiresInSeconds: Expiry,\n  headers: Schema.optional(ObjectHeaders),\n  condition: Schema.optional(WriteCondition),\n  checksum: Schema.optional(ChecksumOptions),\n  contentLength: Schema.optional(ObjectSize),\n});\nexport type S3SignRequest = typeof SignRequest.Type;\n\nconst SignPart = Schema.Struct({\n  upload: Upload,\n  partNumber: PartNumber,\n  expiresInSeconds: Expiry,\n  checksum: Schema.optional(ChecksumOptions),\n  contentLength: Schema.optional(ObjectSize),\n});\nexport type S3SignPartRequest = typeof SignPart.Type;\n\nexport interface S3SigningService {\n  readonly sign: (input: S3SignRequest) => Effect.Effect<SignedRequest, StorageError>;\n  readonly signPart: (input: S3SignPartRequest) => Effect.Effect<SignedRequest, StorageError>;\n}\n\nconst nativeHeaderNames: Readonly<Record<string, string>> = {\n  ContentType: \"content-type\",\n  ContentEncoding: \"content-encoding\",\n  ContentLanguage: \"content-language\",\n  ContentDisposition: \"content-disposition\",\n  CacheControl: \"cache-control\",\n  ContentLength: \"content-length\",\n  IfMatch: \"if-match\",\n  IfNoneMatch: \"if-none-match\",\n  ExpectedBucketOwner: \"x-amz-expected-bucket-owner\",\n  RequestPayer: \"x-amz-request-payer\",\n  SSECustomerAlgorithm: \"x-amz-server-side-encryption-customer-algorithm\",\n  SSECustomerKey: \"x-amz-server-side-encryption-customer-key\",\n  SSECustomerKeyMD5: \"x-amz-server-side-encryption-customer-key-md5\",\n  ServerSideEncryption: \"x-amz-server-side-encryption\",\n  SSEKMSKeyId: \"x-amz-server-side-encryption-aws-kms-key-id\",\n  BucketKeyEnabled: \"x-amz-server-side-encryption-bucket-key-enabled\",\n  ChecksumCRC32: \"x-amz-checksum-crc32\",\n  ChecksumCRC32C: \"x-amz-checksum-crc32c\",\n  ChecksumCRC64NVME: \"x-amz-checksum-crc64nvme\",\n  ChecksumSHA1: \"x-amz-checksum-sha1\",\n  ChecksumSHA256: \"x-amz-checksum-sha256\",\n  ChecksumSHA512: \"x-amz-checksum-sha512\",\n  ChecksumMD5: \"x-amz-checksum-md5\",\n  ChecksumXXHASH64: \"x-amz-checksum-xxhash64\",\n  ChecksumXXHASH3: \"x-amz-checksum-xxhash3\",\n  ChecksumXXHASH128: \"x-amz-checksum-xxhash128\",\n};\n\nfunction requiredHeaders(input: object): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const [native, name] of Object.entries(nativeHeaderNames)) {\n    const value: unknown = Reflect.get(input, native);\n    if (value !== undefined) result[name] = String(value);\n  }\n  const metadata: unknown = Reflect.get(input, \"Metadata\");\n  if (metadata && typeof metadata === \"object\") {\n    for (const [name, value] of Object.entries(metadata))\n      result[`x-amz-meta-${name.toLowerCase()}`] = String(value);\n  }\n  return result;\n}\n\nconst signed = Effect.fnUntraced(function* (\n  storage: S3StorageService,\n  ref: ObjectRef,\n  method: SignedRequest[\"method\"],\n  expiresInSeconds: number,\n  command:\n    | GetObjectCommand\n    | PutObjectCommand\n    | HeadObjectCommand\n    | DeleteObjectCommand\n    | UploadPartCommand,\n) {\n  const credentials = yield* signingCredentials(storage, expiresInSeconds);\n  const expected = requiredHeaders(command.input);\n  let captured: Record<string, string> = {};\n  credentials.client.middlewareStack.add(\n    (next) => async (args) => {\n      if (Predicate.isObject(args.request) && Predicate.isObject(args.request.headers)) {\n        captured = Object.fromEntries(\n          Object.entries(args.request.headers).filter(\n            (entry): entry is [string, string] => typeof entry[1] === \"string\",\n          ),\n        );\n      }\n      return next(args);\n    },\n    { name: \"storageSigningHeaders\", step: \"build\", priority: \"low\" },\n  );\n  const options = {\n    expiresIn: credentials.seconds,\n    signingDate: DateTime.toDateUtc(credentials.now),\n    signableHeaders: new Set(Object.keys(expected)),\n    unhoistableHeaders: new Set(Object.keys(expected)),\n  };\n  const url = yield* request(storage, \"sign\", false, () => {\n    if (command instanceof PutObjectCommand)\n      return getSignedUrl(credentials.client, command, options);\n    if (command instanceof GetObjectCommand)\n      return getSignedUrl(credentials.client, command, options);\n    if (command instanceof HeadObjectCommand)\n      return getSignedUrl(credentials.client, command, options);\n    if (command instanceof UploadPartCommand)\n      return getSignedUrl(credentials.client, command, options);\n    return getSignedUrl(credentials.client, command, options);\n  });\n  const names = new URL(url).searchParams.get(\"X-Amz-SignedHeaders\")?.split(\";\") ?? [];\n  const required: Record<string, string> = {};\n  for (const name of names) {\n    if (name === \"host\") continue;\n    const value = captured[name];\n    if (value === undefined)\n      return yield* storageError(\"sign\", \"s3\", {\n        _tag: \"ProviderFailure\",\n        code: \"UnknownSignedHeader\",\n      });\n    required[name] = value;\n  }\n  const constraints: GrantConstraint[] = Object.keys(required).map((name) => ({\n    kind: `header:${name}`,\n    value: \"required\",\n    enforcement: \"provider\",\n  }));\n  return {\n    method,\n    ref,\n    url: Redacted.make(url),\n    headers: Redacted.make(required),\n    expiresAt: credentials.expiresAt,\n    constraints,\n  } satisfies SignedRequest;\n});\n\nexport class S3Signing extends Context.Service<S3Signing, S3SigningService>()(\n  \"@effect-kit/storage/s3/S3Signing\",\n) {\n  static make(storage: S3StorageService): S3SigningService {\n    return {\n      sign: Effect.fnUntraced(function* (input) {\n        const value = yield* decodeRequest(SignRequest, input, \"sign\", \"s3\");\n        yield* enforceProfile(storage, \"sign\", value);\n        yield* validateRef(value.ref, storage.config, \"sign\");\n        if (\n          value.method !== \"PUT\" &&\n          (value.headers || value.condition || value.checksum || value.contentLength !== undefined)\n        )\n          return yield* storageError(\"sign\", \"s3\", {\n            _tag: \"Unsupported\",\n            capability: \"write-fields-on-read-grant\",\n          });\n        if (value.method === \"PUT\" && value.ref.version)\n          return yield* storageError(\"sign\", \"s3\", {\n            _tag: \"Unsupported\",\n            capability: \"write-version\",\n          });\n        if (value.checksum?.ChecksumAlgorithm || value.checksum?.ChecksumType)\n          return yield* storageError(\"sign\", \"s3\", {\n            _tag: \"InvalidInput\",\n            field: \"checksum.value-required\",\n          });\n        const base = {\n          ...authority(storage.config),\n          Key: value.ref.key,\n          VersionId: value.ref.version?.id,\n        };\n        const command =\n          value.method === \"GET\"\n            ? new GetObjectCommand({ ...base, ...readEncryption(storage.config.encryption) })\n            : value.method === \"HEAD\"\n              ? new HeadObjectCommand({ ...base, ...readEncryption(storage.config.encryption) })\n              : value.method === \"DELETE\"\n                ? new DeleteObjectCommand(base)\n                : new PutObjectCommand({\n                    ...base,\n                    ...headers(value.headers ?? {}),\n                    ...encryptionHeaders(storage.config.encryption),\n                    ...condition(value.condition),\n                    ...value.checksum,\n                    ContentLength: value.contentLength,\n                  });\n        return yield* signed(storage, value.ref, value.method, value.expiresInSeconds, command);\n      }),\n      signPart: Effect.fnUntraced(function* (input) {\n        const value = yield* decodeRequest(SignPart, input, \"signPart\", \"s3\");\n        yield* enforceProfile(storage, \"signPart\", value);\n        yield* validateRef(value.upload.ref, storage.config, \"signPart\");\n        if (\n          value.upload.ref.version ||\n          value.checksum?.ChecksumAlgorithm ||\n          value.checksum?.ChecksumType\n        )\n          return yield* storageError(\"signPart\", \"s3\", { _tag: \"InvalidInput\", field: \"part\" });\n        return yield* signed(\n          storage,\n          value.upload.ref,\n          \"PUT\",\n          value.expiresInSeconds,\n          new UploadPartCommand({\n            ...authority(storage.config),\n            ...encryptionHeaders(storage.config.encryption),\n            ...value.checksum,\n            Key: value.upload.ref.key,\n            UploadId: Redacted.value(value.upload.uploadId),\n            PartNumber: value.partNumber,\n            ContentLength: value.contentLength,\n          }),\n        );\n      }),\n    };\n  }\n\n  static readonly layer = Layer.effectContext(\n    Effect.map(S3Storage, (storage) => {\n      const service = S3Signing.make(storage);\n      return Context.make(S3Signing, service).pipe(Context.add(StorageSigning, service));\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAM,SAAS,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AACjF,MAAM,cAAc,OAAO,OAAO;CAChC,KAAK;CACL,QAAQ,OAAO,SAAS;EAAC;EAAO;EAAQ;EAAO;CAAQ,CAAC;CACxD,kBAAkB;CAClB,SAAS,OAAO,SAAS,aAAa;CACtC,WAAW,OAAO,SAAS,cAAc;CACzC,UAAU,OAAO,SAAS,eAAe;CACzC,eAAe,OAAO,SAAS,UAAU;AAC3C,CAAC;AAGD,MAAM,WAAW,OAAO,OAAO;CAC7B,QAAQ;CACR,YAAY;CACZ,kBAAkB;CAClB,UAAU,OAAO,SAAS,eAAe;CACzC,eAAe,OAAO,SAAS,UAAU;AAC3C,CAAC;AAQD,MAAM,oBAAsD;CAC1D,aAAa;CACb,iBAAiB;CACjB,iBAAiB;CACjB,oBAAoB;CACpB,cAAc;CACd,eAAe;CACf,SAAS;CACT,aAAa;CACb,qBAAqB;CACrB,cAAc;CACd,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,sBAAsB;CACtB,aAAa;CACb,kBAAkB;CAClB,eAAe;CACf,gBAAgB;CAChB,mBAAmB;CACnB,cAAc;CACd,gBAAgB;CAChB,gBAAgB;CAChB,aAAa;CACb,kBAAkB;CAClB,iBAAiB;CACjB,mBAAmB;AACrB;AAEA,SAAS,gBAAgB,OAAuC;CAC9D,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,QAAQ,SAAS,OAAO,QAAQ,iBAAiB,GAAG;EAC9D,MAAM,QAAiB,QAAQ,IAAI,OAAO,MAAM;EAChD,IAAI,UAAU,QAAW,OAAO,QAAQ,OAAO,KAAK;CACtD;CACA,MAAM,WAAoB,QAAQ,IAAI,OAAO,UAAU;CACvD,IAAI,YAAY,OAAO,aAAa,UAClC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,GACjD,OAAO,cAAc,KAAK,YAAY,OAAO,OAAO,KAAK;CAE7D,OAAO;AACT;AAEA,MAAM,SAAS,OAAO,WAAW,WAC/B,SACA,KACA,QACA,kBACA,SAMA;CACA,MAAM,cAAc,OAAO,mBAAmB,SAAS,gBAAgB;CACvE,MAAM,WAAW,gBAAgB,QAAQ,KAAK;CAC9C,IAAI,WAAmC,CAAC;CACxC,YAAY,OAAO,gBAAgB,KAChC,SAAS,OAAO,SAAS;EACxB,IAAI,UAAU,SAAS,KAAK,OAAO,KAAK,UAAU,SAAS,KAAK,QAAQ,OAAO,GAC7E,WAAW,OAAO,YAChB,OAAO,QAAQ,KAAK,QAAQ,OAAO,CAAC,CAAC,QAClC,UAAqC,OAAO,MAAM,OAAO,QAC5D,CACF;EAEF,OAAO,KAAK,IAAI;CAClB,GACA;EAAE,MAAM;EAAyB,MAAM;EAAS,UAAU;CAAM,CAClE;CACA,MAAM,UAAU;EACd,WAAW,YAAY;EACvB,aAAa,SAAS,UAAU,YAAY,GAAG;EAC/C,iBAAiB,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;EAC9C,oBAAoB,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;CACnD;CACA,MAAM,MAAM,OAAO,QAAQ,SAAS,QAAQ,aAAa;EACvD,IAAI,mBAAmB,kBACrB,OAAO,aAAa,YAAY,QAAQ,SAAS,OAAO;EAC1D,IAAI,mBAAmB,kBACrB,OAAO,aAAa,YAAY,QAAQ,SAAS,OAAO;EAC1D,IAAI,mBAAmB,mBACrB,OAAO,aAAa,YAAY,QAAQ,SAAS,OAAO;EAC1D,IAAI,mBAAmB,mBACrB,OAAO,aAAa,YAAY,QAAQ,SAAS,OAAO;EAC1D,OAAO,aAAa,YAAY,QAAQ,SAAS,OAAO;CAC1D,CAAC;CACD,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACnF,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,SAAS,QAAQ;EACrB,MAAM,QAAQ,SAAS;EACvB,IAAI,UAAU,QACZ,OAAO,OAAO,aAAa,QAAQ,MAAM;GACvC,MAAM;GACN,MAAM;EACR,CAAC;EACH,SAAS,QAAQ;CACnB;CACA,MAAM,cAAiC,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAK,UAAU;EAC1E,MAAM,UAAU;EAChB,OAAO;EACP,aAAa;CACf,EAAE;CACF,OAAO;EACL;EACA;EACA,KAAK,SAAS,KAAK,GAAG;EACtB,SAAS,SAAS,KAAK,QAAQ;EAC/B,WAAW,YAAY;EACvB;CACF;AACF,CAAC;AAED,IAAa,YAAb,MAAa,kBAAkB,QAAQ,QAAqC,CAAC,CAC3E,kCACF,CAAC,CAAC;CACA,OAAO,KAAK,SAA6C;EACvD,OAAO;GACL,MAAM,OAAO,WAAW,WAAW,OAAO;IACxC,MAAM,QAAQ,OAAO,cAAc,aAAa,OAAO,QAAQ,IAAI;IACnE,OAAO,eAAe,SAAS,QAAQ,KAAK;IAC5C,OAAO,YAAY,MAAM,KAAK,QAAQ,QAAQ,MAAM;IACpD,IACE,MAAM,WAAW,UAChB,MAAM,WAAW,MAAM,aAAa,MAAM,YAAY,MAAM,kBAAkB,SAE/E,OAAO,OAAO,aAAa,QAAQ,MAAM;KACvC,MAAM;KACN,YAAY;IACd,CAAC;IACH,IAAI,MAAM,WAAW,SAAS,MAAM,IAAI,SACtC,OAAO,OAAO,aAAa,QAAQ,MAAM;KACvC,MAAM;KACN,YAAY;IACd,CAAC;IACH,IAAI,MAAM,UAAU,qBAAqB,MAAM,UAAU,cACvD,OAAO,OAAO,aAAa,QAAQ,MAAM;KACvC,MAAM;KACN,OAAO;IACT,CAAC;IACH,MAAM,OAAO;KACX,GAAG,UAAU,QAAQ,MAAM;KAC3B,KAAK,MAAM,IAAI;KACf,WAAW,MAAM,IAAI,SAAS;IAChC;IACA,MAAM,UACJ,MAAM,WAAW,QACb,IAAI,iBAAiB;KAAE,GAAG;KAAM,GAAG,eAAe,QAAQ,OAAO,UAAU;IAAE,CAAC,IAC9E,MAAM,WAAW,SACf,IAAI,kBAAkB;KAAE,GAAG;KAAM,GAAG,eAAe,QAAQ,OAAO,UAAU;IAAE,CAAC,IAC/E,MAAM,WAAW,WACf,IAAI,oBAAoB,IAAI,IAC5B,IAAI,iBAAiB;KACnB,GAAG;KACH,GAAG,QAAQ,MAAM,WAAW,CAAC,CAAC;KAC9B,GAAG,kBAAkB,QAAQ,OAAO,UAAU;KAC9C,GAAG,UAAU,MAAM,SAAS;KAC5B,GAAG,MAAM;KACT,eAAe,MAAM;IACvB,CAAC;IACX,OAAO,OAAO,OAAO,SAAS,MAAM,KAAK,MAAM,QAAQ,MAAM,kBAAkB,OAAO;GACxF,CAAC;GACD,UAAU,OAAO,WAAW,WAAW,OAAO;IAC5C,MAAM,QAAQ,OAAO,cAAc,UAAU,OAAO,YAAY,IAAI;IACpE,OAAO,eAAe,SAAS,YAAY,KAAK;IAChD,OAAO,YAAY,MAAM,OAAO,KAAK,QAAQ,QAAQ,UAAU;IAC/D,IACE,MAAM,OAAO,IAAI,WACjB,MAAM,UAAU,qBAChB,MAAM,UAAU,cAEhB,OAAO,OAAO,aAAa,YAAY,MAAM;KAAE,MAAM;KAAgB,OAAO;IAAO,CAAC;IACtF,OAAO,OAAO,OACZ,SACA,MAAM,OAAO,KACb,OACA,MAAM,kBACN,IAAI,kBAAkB;KACpB,GAAG,UAAU,QAAQ,MAAM;KAC3B,GAAG,kBAAkB,QAAQ,OAAO,UAAU;KAC9C,GAAG,MAAM;KACT,KAAK,MAAM,OAAO,IAAI;KACtB,UAAU,SAAS,MAAM,MAAM,OAAO,QAAQ;KAC9C,YAAY,MAAM;KAClB,eAAe,MAAM;IACvB,CAAC,CACH;GACF,CAAC;EACH;CACF;CAEA,OAAgB,QAAQ,MAAM,cAC5B,OAAO,IAAI,YAAY,YAAY;EACjC,MAAM,UAAU,UAAU,KAAK,OAAO;EACtC,OAAO,QAAQ,KAAK,WAAW,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,gBAAgB,OAAO,CAAC;CACnF,CAAC,CACH;AACF"}

package/dist/s3/uploads.d.ts

@@ -0,0 +1,11 @@
+import { UploadError } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { S3Storage } from "../s3.js";
+import { Layer } from "effect";
+export declare const S3UploadGrants: {
+  layer(options?: {
+    readonly partBytes?: number;
+    readonly multipartThreshold?: number;
+  }): Layer.Layer<UploadGrantDriver, UploadError, S3Storage>;
+};
+//# sourceMappingURL=uploads.d.ts.map

package/dist/s3/uploads.js

@@ -0,0 +1,173 @@
+import { failUpload } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { operationMetadata } from "../uploads/verification.js";
+import { S3Storage } from "../s3.js";
+import { S3Signing } from "./signing.js";
+import { DateTime, Effect, Layer, Redacted, Schema } from "effect";
+
+// src/providers/s3/uploads.ts
+const Remote = Schema.Union([
+	Schema.Struct({ kind: Schema.Literal("single") }),
+	Schema.Struct({ kind: Schema.Literal("post") }),
+	Schema.Struct({
+		kind: Schema.Literal("multipart"),
+		uploadId: Schema.String,
+		partBytes: Schema.Natural
+	})
+]);
+const remote = (record) => Schema.decodeUnknownEffect(Remote)(record.remote ? Redacted.value(record.remote) : void 0).pipe(Effect.mapError(() => failUpload("Conflict")));
+const seconds = (expiresAt) => Effect.map(DateTime.now, (now) => Math.max(1, Math.floor((expiresAt - DateTime.toEpochMillis(now)) / 1e3)));
+const S3UploadGrants = { layer(options = {}) {
+	return Layer.effect(UploadGrantDriver, Effect.gen(function* () {
+		const storage = yield* S3Storage;
+		const signing = S3Signing.make(storage);
+		const partBytes = options.partBytes ?? 8 * 1024 ** 2;
+		if (!Number.isSafeInteger(partBytes) || partBytes < storage.multipart.limits.minimumPartBytes || partBytes > Math.min(storage.multipart.limits.maximumPartBytes, 64 * 1024 ** 2)) return yield* failUpload("BadRequest");
+		const ref = (record) => ({
+			storeId: storage.storeId,
+			key: record.stagingKey
+		});
+		const handle = (record, uploadId) => ({
+			ref: ref(record),
+			uploadId: Redacted.make(uploadId),
+			checksumAlgorithm: "SHA256",
+			checksumType: "COMPOSITE"
+		});
+		const inventory = Effect.fnUntraced(function* (record, uploadId) {
+			const parts = [];
+			let cursor;
+			const seen = /* @__PURE__ */ new Set();
+			do {
+				const page = yield* storage.multipart.listParts({
+					upload: handle(record, uploadId),
+					...cursor ? { cursor } : {}
+				});
+				parts.push(...page.parts);
+				cursor = page.cursor;
+				if (parts.length > storage.multipart.limits.maximumParts || cursor && seen.has(cursor)) return yield* failUpload("Conflict");
+				if (cursor) seen.add(cursor);
+			} while (cursor);
+			return parts;
+		});
+		return UploadGrantDriver.of({
+			begin: Effect.fnUntraced(function* (record) {
+				if (storage.config.encryption?.mode === "customer") return yield* failUpload("Unsupported");
+				const strategy = record.input.strategy ?? "auto";
+				if (["resumable", "proxy"].includes(strategy)) return yield* failUpload("Unsupported");
+				if (strategy === "post") return { kind: "post" };
+				if (strategy === "single" || strategy === "auto" && record.input.file.size < (options.multipartThreshold ?? 16 * 1024 ** 2)) return { kind: "single" };
+				if (!record.input.file.size || Math.ceil(record.input.file.size / partBytes) > storage.multipart.limits.maximumParts || storage.multipart.limits.completeConditions !== void 0 && !storage.multipart.limits.completeConditions.includes("create-only")) return yield* failUpload("Unsupported");
+				const upload = yield* storage.multipart.initiate({
+					key: record.stagingKey,
+					checksum: {
+						ChecksumAlgorithm: "SHA256",
+						ChecksumType: "COMPOSITE"
+					},
+					headers: {
+						contentType: record.input.file.contentType,
+						customMetadata: operationMetadata(record)
+					}
+				});
+				return {
+					kind: "multipart",
+					uploadId: Redacted.value(upload.uploadId),
+					partBytes
+				};
+			}),
+			grant: Effect.fnUntraced(function* (record, expiresAt) {
+				const state = yield* remote(record);
+				const expiresInSeconds = yield* seconds(expiresAt);
+				if (state.kind === "multipart") return {
+					_tag: "Multipart",
+					checksum: "sha256",
+					partBytes: state.partBytes,
+					completed: (yield* inventory(record, state.uploadId)).map(({ partNumber, etag }) => ({
+						partNumber,
+						etag
+					})),
+					expiresAt
+				};
+				if (state.kind === "post") {
+					const { S3Post } = yield* Effect.tryPromise({
+						try: () => import("./post.js"),
+						catch: () => failUpload("Unsupported")
+					});
+					const policy = yield* S3Post.make(storage).create({
+						key: record.stagingKey,
+						minBytes: record.input.file.size,
+						maxBytes: record.input.file.size,
+						expiresInSeconds,
+						contentType: record.input.file.contentType
+					});
+					return {
+						_tag: "PostForm",
+						constraints: policy.constraints,
+						url: Redacted.value(policy.url),
+						fields: Redacted.value(policy.fields),
+						expiresAt: DateTime.toEpochMillis(policy.expiresAt)
+					};
+				}
+				const signed = yield* signing.sign({
+					ref: ref(record),
+					method: "PUT",
+					expiresInSeconds,
+					contentLength: record.input.file.size,
+					headers: {
+						contentType: record.input.file.contentType,
+						customMetadata: operationMetadata(record)
+					},
+					condition: { _tag: "CreateOnly" }
+				});
+				return {
+					_tag: "SignedRequest",
+					constraints: signed.constraints,
+					method: "PUT",
+					url: Redacted.value(signed.url),
+					headers: Redacted.value(signed.headers),
+					expiresAt: DateTime.toEpochMillis(signed.expiresAt)
+				};
+			}),
+			part: Effect.fnUntraced(function* (record, partNumber, expiresAt, checksum) {
+				const state = yield* remote(record);
+				if (state.kind !== "multipart" || partNumber > Math.ceil(record.input.file.size / state.partBytes)) return yield* failUpload("BadRequest");
+				if (!checksum || !/^[a-f0-9]{64}$/u.test(checksum)) return yield* failUpload("BadRequest");
+				const signed = yield* signing.signPart({
+					checksum: { ChecksumSHA256: Buffer.from(checksum, "hex").toString("base64") },
+					upload: handle(record, state.uploadId),
+					partNumber,
+					expiresInSeconds: yield* seconds(expiresAt),
+					contentLength: Math.min(state.partBytes, record.input.file.size - (partNumber - 1) * state.partBytes)
+				});
+				return {
+					_tag: "SignedRequest",
+					constraints: signed.constraints,
+					method: "PUT",
+					url: Redacted.value(signed.url),
+					headers: Redacted.value(signed.headers),
+					expiresAt: DateTime.toEpochMillis(signed.expiresAt)
+				};
+			}),
+			complete: Effect.fnUntraced(function* (record, supplied) {
+				const state = yield* remote(record);
+				if (state.kind !== "multipart") return yield* failUpload("Conflict");
+				const parts = yield* inventory(record, state.uploadId);
+				const count = Math.ceil(record.input.file.size / state.partBytes);
+				const sorted = parts.toSorted((a, b) => a.partNumber - b.partNumber);
+				if (sorted.length !== count || supplied.length !== count || new Set(supplied.map((p) => p.partNumber)).size !== count || sorted.some((part, index) => part.partNumber !== index + 1 || part.size !== Math.min(state.partBytes, record.input.file.size - index * state.partBytes) || !supplied.some((p) => p.partNumber === part.partNumber && p.receipt === part.etag))) return yield* failUpload("VerificationFailed");
+				yield* storage.multipart.complete({
+					upload: handle(record, state.uploadId),
+					parts: sorted,
+					condition: { _tag: "CreateOnly" }
+				});
+			}),
+			abort: Effect.fnUntraced(function* (record) {
+				if (record.remote === void 0) return;
+				const state = yield* remote(record);
+				if (state.kind === "multipart") yield* storage.multipart.abort(handle(record, state.uploadId));
+			})
+		});
+	}));
+} };
+
+export { S3UploadGrants };
+//# sourceMappingURL=uploads.js.map

package/dist/s3/uploads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.js","names":[],"sources":["../../src/providers/s3/uploads.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport { UploadGrantDriver } from \"../../uploads/driver.js\";\nimport { failUpload } from \"../../uploads/schema.js\";\nimport type { UploadRecord } from \"../../uploads/schema.js\";\nimport { operationMetadata } from \"../../uploads/verification.js\";\nimport { S3Storage } from \"./index.js\";\nimport { S3Signing } from \"./signing.js\";\n\nconst Remote = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"single\") }),\n  Schema.Struct({ kind: Schema.Literal(\"post\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"multipart\"),\n    uploadId: Schema.String,\n    partBytes: Schema.Natural,\n  }),\n]);\nconst remote = (record: UploadRecord) =>\n  Schema.decodeUnknownEffect(Remote)(\n    record.remote ? Redacted.value(record.remote) : undefined,\n  ).pipe(Effect.mapError(() => failUpload(\"Conflict\")));\n\nconst seconds = (expiresAt: number) =>\n  Effect.map(DateTime.now, (now) =>\n    Math.max(1, Math.floor((expiresAt - DateTime.toEpochMillis(now)) / 1000)),\n  );\n\nexport const S3UploadGrants = {\n  layer(options: { readonly partBytes?: number; readonly multipartThreshold?: number } = {}) {\n    return Layer.effect(\n      UploadGrantDriver,\n      Effect.gen(function* () {\n        const storage = yield* S3Storage;\n        const signing = S3Signing.make(storage);\n        const partBytes = options.partBytes ?? 8 * 1024 ** 2;\n        if (\n          !Number.isSafeInteger(partBytes) ||\n          partBytes < storage.multipart.limits.minimumPartBytes ||\n          partBytes > Math.min(storage.multipart.limits.maximumPartBytes, 64 * 1024 ** 2)\n        )\n          return yield* failUpload(\"BadRequest\");\n        const ref = (record: UploadRecord) => ({\n          storeId: storage.storeId,\n          key: record.stagingKey,\n        });\n        const handle = (record: UploadRecord, uploadId: string) => ({\n          ref: ref(record),\n          uploadId: Redacted.make(uploadId),\n          checksumAlgorithm: \"SHA256\" as const,\n          checksumType: \"COMPOSITE\" as const,\n        });\n        const inventory = Effect.fnUntraced(function* (record: UploadRecord, uploadId: string) {\n          const parts = [];\n          let cursor: string | undefined;\n          const seen = new Set<string>();\n          do {\n            const page = yield* storage.multipart.listParts({\n              upload: handle(record, uploadId),\n              ...(cursor ? { cursor } : {}),\n            });\n            parts.push(...page.parts);\n            cursor = page.cursor;\n            if (\n              parts.length > storage.multipart.limits.maximumParts ||\n              (cursor && seen.has(cursor))\n            )\n              return yield* failUpload(\"Conflict\");\n            if (cursor) seen.add(cursor);\n          } while (cursor);\n          return parts;\n        });\n        return UploadGrantDriver.of({\n          begin: Effect.fnUntraced(function* (record) {\n            if (storage.config.encryption?.mode === \"customer\")\n              return yield* failUpload(\"Unsupported\");\n            const strategy = record.input.strategy ?? \"auto\";\n            if ([\"resumable\", \"proxy\"].includes(strategy)) return yield* failUpload(\"Unsupported\");\n            if (strategy === \"post\") return { kind: \"post\" };\n            if (\n              strategy === \"single\" ||\n              (strategy === \"auto\" &&\n                record.input.file.size < (options.multipartThreshold ?? 16 * 1024 ** 2))\n            )\n              return { kind: \"single\" };\n            if (\n              !record.input.file.size ||\n              Math.ceil(record.input.file.size / partBytes) >\n                storage.multipart.limits.maximumParts ||\n              (storage.multipart.limits.completeConditions !== undefined &&\n                !storage.multipart.limits.completeConditions.includes(\"create-only\"))\n            )\n              return yield* failUpload(\"Unsupported\");\n            const upload = yield* storage.multipart.initiate({\n              key: record.stagingKey,\n              checksum: { ChecksumAlgorithm: \"SHA256\", ChecksumType: \"COMPOSITE\" },\n              headers: {\n                contentType: record.input.file.contentType,\n                customMetadata: operationMetadata(record),\n              },\n            });\n            return { kind: \"multipart\", uploadId: Redacted.value(upload.uploadId), partBytes };\n          }),\n          grant: Effect.fnUntraced(function* (record, expiresAt) {\n            const state = yield* remote(record);\n            const expiresInSeconds = yield* seconds(expiresAt);\n            if (state.kind === \"multipart\")\n              return {\n                _tag: \"Multipart\",\n                checksum: \"sha256\",\n                partBytes: state.partBytes,\n                completed: (yield* inventory(record, state.uploadId)).map(\n                  ({ partNumber, etag }) => ({ partNumber, etag }),\n                ),\n                expiresAt,\n              };\n            if (state.kind === \"post\") {\n              const { S3Post } = yield* Effect.tryPromise({\n                try: () => import(\"./post.js\"),\n                catch: () => failUpload(\"Unsupported\"),\n              });\n              const policy = yield* S3Post.make(storage).create({\n                key: record.stagingKey,\n                minBytes: record.input.file.size,\n                maxBytes: record.input.file.size,\n                expiresInSeconds,\n                contentType: record.input.file.contentType,\n              });\n              return {\n                _tag: \"PostForm\",\n                constraints: policy.constraints,\n                url: Redacted.value(policy.url),\n                fields: Redacted.value(policy.fields),\n                expiresAt: DateTime.toEpochMillis(policy.expiresAt),\n              };\n            }\n            const signed = yield* signing.sign({\n              ref: ref(record),\n              method: \"PUT\",\n              expiresInSeconds,\n              contentLength: record.input.file.size,\n              headers: {\n                contentType: record.input.file.contentType,\n                customMetadata: operationMetadata(record),\n              },\n              condition: { _tag: \"CreateOnly\" },\n            });\n            return {\n              _tag: \"SignedRequest\",\n              constraints: signed.constraints,\n              method: \"PUT\",\n              url: Redacted.value(signed.url),\n              headers: Redacted.value(signed.headers),\n              expiresAt: DateTime.toEpochMillis(signed.expiresAt),\n            };\n          }),\n          part: Effect.fnUntraced(function* (record, partNumber, expiresAt, checksum) {\n            const state = yield* remote(record);\n            if (\n              state.kind !== \"multipart\" ||\n              partNumber > Math.ceil(record.input.file.size / state.partBytes)\n            )\n              return yield* failUpload(\"BadRequest\");\n            if (!checksum || !/^[a-f0-9]{64}$/u.test(checksum))\n              return yield* failUpload(\"BadRequest\");\n            const signed = yield* signing.signPart({\n              checksum: { ChecksumSHA256: Buffer.from(checksum, \"hex\").toString(\"base64\") },\n              upload: handle(record, state.uploadId),\n              partNumber,\n              expiresInSeconds: yield* seconds(expiresAt),\n              contentLength: Math.min(\n                state.partBytes,\n                record.input.file.size - (partNumber - 1) * state.partBytes,\n              ),\n            });\n            return {\n              _tag: \"SignedRequest\",\n              constraints: signed.constraints,\n              method: \"PUT\",\n              url: Redacted.value(signed.url),\n              headers: Redacted.value(signed.headers),\n              expiresAt: DateTime.toEpochMillis(signed.expiresAt),\n            };\n          }),\n          complete: Effect.fnUntraced(function* (record, supplied) {\n            const state = yield* remote(record);\n            if (state.kind !== \"multipart\") return yield* failUpload(\"Conflict\");\n            const parts = yield* inventory(record, state.uploadId);\n            const count = Math.ceil(record.input.file.size / state.partBytes);\n            const sorted = parts.toSorted((a, b) => a.partNumber - b.partNumber);\n            if (\n              sorted.length !== count ||\n              supplied.length !== count ||\n              new Set(supplied.map((p) => p.partNumber)).size !== count ||\n              sorted.some(\n                (part, index) =>\n                  part.partNumber !== index + 1 ||\n                  part.size !==\n                    Math.min(state.partBytes, record.input.file.size - index * state.partBytes) ||\n                  !supplied.some(\n                    (p) => p.partNumber === part.partNumber && p.receipt === part.etag,\n                  ),\n              )\n            )\n              return yield* failUpload(\"VerificationFailed\");\n            yield* storage.multipart.complete({\n              upload: handle(record, state.uploadId),\n              parts: sorted,\n              condition: { _tag: \"CreateOnly\" },\n            });\n          }),\n          abort: Effect.fnUntraced(function* (record) {\n            if (record.remote === undefined) return;\n            const state = yield* remote(record);\n            if (state.kind === \"multipart\")\n              yield* storage.multipart.abort(handle(record, state.uploadId));\n          }),\n        });\n      }),\n    );\n  },\n};\n"],"mappings":";;;;;;;;AASA,MAAM,SAAS,OAAO,MAAM;CAC1B,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,QAAQ,EAAE,CAAC;CAChD,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,EAAE,CAAC;CAC9C,OAAO,OAAO;EACZ,MAAM,OAAO,QAAQ,WAAW;EAChC,UAAU,OAAO;EACjB,WAAW,OAAO;CACpB,CAAC;AACH,CAAC;AACD,MAAM,UAAU,WACd,OAAO,oBAAoB,MAAM,CAAC,CAChC,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM,IAAI,MAClD,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,UAAU,CAAC,CAAC;AAEtD,MAAM,WAAW,cACf,OAAO,IAAI,SAAS,MAAM,QACxB,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,SAAS,cAAc,GAAG,KAAK,GAAI,CAAC,CAC1E;AAEF,MAAa,iBAAiB,EAC5B,MAAM,UAAiF,CAAC,GAAG;CACzF,OAAO,MAAM,OACX,mBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,UAAU,UAAU,KAAK,OAAO;EACtC,MAAM,YAAY,QAAQ,aAAa,IAAI,QAAQ;EACnD,IACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,QAAQ,UAAU,OAAO,oBACrC,YAAY,KAAK,IAAI,QAAQ,UAAU,OAAO,kBAAkB,KAAK,QAAQ,CAAC,GAE9E,OAAO,OAAO,WAAW,YAAY;EACvC,MAAM,OAAO,YAA0B;GACrC,SAAS,QAAQ;GACjB,KAAK,OAAO;EACd;EACA,MAAM,UAAU,QAAsB,cAAsB;GAC1D,KAAK,IAAI,MAAM;GACf,UAAU,SAAS,KAAK,QAAQ;GAChC,mBAAmB;GACnB,cAAc;EAChB;EACA,MAAM,YAAY,OAAO,WAAW,WAAW,QAAsB,UAAkB;GACrF,MAAM,QAAQ,CAAC;GACf,IAAI;GACJ,MAAM,uBAAO,IAAI,IAAY;GAC7B,GAAG;IACD,MAAM,OAAO,OAAO,QAAQ,UAAU,UAAU;KAC9C,QAAQ,OAAO,QAAQ,QAAQ;KAC/B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,KAAK;IACxB,SAAS,KAAK;IACd,IACE,MAAM,SAAS,QAAQ,UAAU,OAAO,gBACvC,UAAU,KAAK,IAAI,MAAM,GAE1B,OAAO,OAAO,WAAW,UAAU;IACrC,IAAI,QAAQ,KAAK,IAAI,MAAM;GAC7B,SAAS;GACT,OAAO;EACT,CAAC;EACD,OAAO,kBAAkB,GAAG;GAC1B,OAAO,OAAO,WAAW,WAAW,QAAQ;IAC1C,IAAI,QAAQ,OAAO,YAAY,SAAS,YACtC,OAAO,OAAO,WAAW,aAAa;IACxC,MAAM,WAAW,OAAO,MAAM,YAAY;IAC1C,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,SAAS,QAAQ,GAAG,OAAO,OAAO,WAAW,aAAa;IACrF,IAAI,aAAa,QAAQ,OAAO,EAAE,MAAM,OAAO;IAC/C,IACE,aAAa,YACZ,aAAa,UACZ,OAAO,MAAM,KAAK,QAAQ,QAAQ,sBAAsB,KAAK,QAAQ,IAEvE,OAAO,EAAE,MAAM,SAAS;IAC1B,IACE,CAAC,OAAO,MAAM,KAAK,QACnB,KAAK,KAAK,OAAO,MAAM,KAAK,OAAO,SAAS,IAC1C,QAAQ,UAAU,OAAO,gBAC1B,QAAQ,UAAU,OAAO,uBAAuB,UAC/C,CAAC,QAAQ,UAAU,OAAO,mBAAmB,SAAS,aAAa,GAErE,OAAO,OAAO,WAAW,aAAa;IACxC,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS;KAC/C,KAAK,OAAO;KACZ,UAAU;MAAE,mBAAmB;MAAU,cAAc;KAAY;KACnE,SAAS;MACP,aAAa,OAAO,MAAM,KAAK;MAC/B,gBAAgB,kBAAkB,MAAM;KAC1C;IACF,CAAC;IACD,OAAO;KAAE,MAAM;KAAa,UAAU,SAAS,MAAM,OAAO,QAAQ;KAAG;IAAU;GACnF,CAAC;GACD,OAAO,OAAO,WAAW,WAAW,QAAQ,WAAW;IACrD,MAAM,QAAQ,OAAO,OAAO,MAAM;IAClC,MAAM,mBAAmB,OAAO,QAAQ,SAAS;IACjD,IAAI,MAAM,SAAS,aACjB,OAAO;KACL,MAAM;KACN,UAAU;KACV,WAAW,MAAM;KACjB,YAAY,OAAO,UAAU,QAAQ,MAAM,QAAQ,EAAC,CAAE,KACnD,EAAE,YAAY,YAAY;MAAE;MAAY;KAAK,EAChD;KACA;IACF;IACF,IAAI,MAAM,SAAS,QAAQ;KACzB,MAAM,EAAE,WAAW,OAAO,OAAO,WAAW;MAC1C,WAAW,OAAO;MAClB,aAAa,WAAW,aAAa;KACvC,CAAC;KACD,MAAM,SAAS,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,OAAO;MAChD,KAAK,OAAO;MACZ,UAAU,OAAO,MAAM,KAAK;MAC5B,UAAU,OAAO,MAAM,KAAK;MAC5B;MACA,aAAa,OAAO,MAAM,KAAK;KACjC,CAAC;KACD,OAAO;MACL,MAAM;MACN,aAAa,OAAO;MACpB,KAAK,SAAS,MAAM,OAAO,GAAG;MAC9B,QAAQ,SAAS,MAAM,OAAO,MAAM;MACpC,WAAW,SAAS,cAAc,OAAO,SAAS;KACpD;IACF;IACA,MAAM,SAAS,OAAO,QAAQ,KAAK;KACjC,KAAK,IAAI,MAAM;KACf,QAAQ;KACR;KACA,eAAe,OAAO,MAAM,KAAK;KACjC,SAAS;MACP,aAAa,OAAO,MAAM,KAAK;MAC/B,gBAAgB,kBAAkB,MAAM;KAC1C;KACA,WAAW,EAAE,MAAM,aAAa;IAClC,CAAC;IACD,OAAO;KACL,MAAM;KACN,aAAa,OAAO;KACpB,QAAQ;KACR,KAAK,SAAS,MAAM,OAAO,GAAG;KAC9B,SAAS,SAAS,MAAM,OAAO,OAAO;KACtC,WAAW,SAAS,cAAc,OAAO,SAAS;IACpD;GACF,CAAC;GACD,MAAM,OAAO,WAAW,WAAW,QAAQ,YAAY,WAAW,UAAU;IAC1E,MAAM,QAAQ,OAAO,OAAO,MAAM;IAClC,IACE,MAAM,SAAS,eACf,aAAa,KAAK,KAAK,OAAO,MAAM,KAAK,OAAO,MAAM,SAAS,GAE/D,OAAO,OAAO,WAAW,YAAY;IACvC,IAAI,CAAC,YAAY,CAAC,kBAAkB,KAAK,QAAQ,GAC/C,OAAO,OAAO,WAAW,YAAY;IACvC,MAAM,SAAS,OAAO,QAAQ,SAAS;KACrC,UAAU,EAAE,gBAAgB,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;KAC5E,QAAQ,OAAO,QAAQ,MAAM,QAAQ;KACrC;KACA,kBAAkB,OAAO,QAAQ,SAAS;KAC1C,eAAe,KAAK,IAClB,MAAM,WACN,OAAO,MAAM,KAAK,QAAQ,aAAa,KAAK,MAAM,SACpD;IACF,CAAC;IACD,OAAO;KACL,MAAM;KACN,aAAa,OAAO;KACpB,QAAQ;KACR,KAAK,SAAS,MAAM,OAAO,GAAG;KAC9B,SAAS,SAAS,MAAM,OAAO,OAAO;KACtC,WAAW,SAAS,cAAc,OAAO,SAAS;IACpD;GACF,CAAC;GACD,UAAU,OAAO,WAAW,WAAW,QAAQ,UAAU;IACvD,MAAM,QAAQ,OAAO,OAAO,MAAM;IAClC,IAAI,MAAM,SAAS,aAAa,OAAO,OAAO,WAAW,UAAU;IACnE,MAAM,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ;IACrD,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,KAAK,OAAO,MAAM,SAAS;IAChE,MAAM,SAAS,MAAM,UAAU,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;IACnE,IACE,OAAO,WAAW,SAClB,SAAS,WAAW,SACpB,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,SACpD,OAAO,MACJ,MAAM,UACL,KAAK,eAAe,QAAQ,KAC5B,KAAK,SACH,KAAK,IAAI,MAAM,WAAW,OAAO,MAAM,KAAK,OAAO,QAAQ,MAAM,SAAS,KAC5E,CAAC,SAAS,MACP,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,YAAY,KAAK,IAChE,CACJ,GAEA,OAAO,OAAO,WAAW,oBAAoB;IAC/C,OAAO,QAAQ,UAAU,SAAS;KAChC,QAAQ,OAAO,QAAQ,MAAM,QAAQ;KACrC,OAAO;KACP,WAAW,EAAE,MAAM,aAAa;IAClC,CAAC;GACH,CAAC;GACD,OAAO,OAAO,WAAW,WAAW,QAAQ;IAC1C,IAAI,OAAO,WAAW,QAAW;IACjC,MAAM,QAAQ,OAAO,OAAO,MAAM;IAClC,IAAI,MAAM,SAAS,aACjB,OAAO,QAAQ,UAAU,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC;GACjE,CAAC;EACH,CAAC;CACH,CAAC,CACH;AACF,EACF"}

package/dist/s3.d.ts

@@ -0,0 +1,37 @@
+import { ObjectMetadata } from "./core/object.js";
+import { StorageError } from "./core/errors.js";
+import { PutRequest } from "./core/requests.js";
+import { StorageCopy, StoragePublicUrls } from "./core/capabilities.js";
+import { Storage, StorageService } from "./core/storage.js";
+import { TransferDriver } from "./transfers/dependencies.js";
+import { S3CopyRequest, nativeLimits } from "./providers/s3/native-models.js";
+import { S3ChecksumOptions, S3MultipartHandle, S3MultipartUploads, multipart } from "./providers/s3/multipart.js";
+import { S3Profile } from "./providers/s3/profile.js";
+import { ResolvedS3Config, S3Config, S3Encryption } from "./providers/s3/config.js";
+import { S3DeleteOutcome, deleteObjects } from "./providers/s3/bulk-delete.js";
+import { S3CopyPartRequest, copyObject, copyPart } from "./providers/s3/copy.js";
+import { S3PutOptions } from "./providers/s3/primitives.js";
+import { Config, Context, Effect, Layer, Scope } from "effect";
+import { S3Client } from "@aws-sdk/client-s3";
+export interface S3StorageService extends StorageService {
+  /** Native escape hatch; ownership follows the constructor used to acquire this service. */
+  readonly profile?: S3Profile;
+  readonly client: S3Client;
+  readonly config: ResolvedS3Config;
+  readonly multipart: ReturnType<typeof multipart>;
+  readonly copyObject: (input: Parameters<typeof copyObject>[1], source?: S3StorageService) => ReturnType<typeof copyObject>;
+  readonly copyPart: (input: Parameters<typeof copyPart>[1], source?: S3StorageService) => ReturnType<typeof copyPart>;
+  readonly deleteObjects: (input: Parameters<typeof deleteObjects>[1]) => ReturnType<typeof deleteObjects>;
+  readonly putObject: <E = never, R = never>(input: PutRequest<E, R>, options?: S3PutOptions) => Effect.Effect<ObjectMetadata, StorageError | E, R>;
+}
+declare const S3Storage_base: Context.ServiceClass<S3Storage, "@effect-kit/storage/s3/S3Storage", S3StorageService>;
+export declare class S3Storage extends S3Storage_base {
+  static readonly make: (input: S3Config) => Effect.Effect<S3StorageService, StorageError, Scope.Scope>;
+  static readonly makeClient: (client: S3Client, input: S3Config) => Effect.Effect<S3StorageService, StorageError, never>;
+  static layer(config: S3Config): Layer.Layer<S3Storage | Storage | StorageCopy | TransferDriver, StorageError, never>;
+  static layerClient(client: S3Client, config: S3Config): Layer.Layer<S3Storage | Storage | StorageCopy | TransferDriver, StorageError, never>;
+  static layerConfig(config?: Config.Config<S3Config>): Layer.Layer<S3Storage | Storage | StorageCopy | TransferDriver, StorageError, never>;
+  static publicUrls(baseUrl: string): Layer.Layer<StoragePublicUrls, StorageError, S3Storage>;
+}
+export { type S3ChecksumOptions, type S3Config, type S3CopyPartRequest, type S3CopyRequest, type S3DeleteOutcome, type S3Encryption, type S3MultipartHandle, type S3MultipartUploads, type S3PutOptions, nativeLimits as s3Limits };
+//# sourceMappingURL=s3.d.ts.map