@geekmidas/storage 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/index.d.cts

@@ -1,7 +1,5 @@
-import { StorageClient, StorageDriver, createStorageClient, registerStorageDriver, registeredStorageSchemes } from "./registry-DBsAUTT3.cjs";
-
+import { i as registeredStorageSchemes, l as StorageClient, n as createStorageClient, r as registerStorageDriver, t as StorageDriver } from "./registry-ClEvHGpM.cjs";
 //#region src/errors.d.ts
-
 /**
  * Storage errors — shared by every implementation, not just S3.
  *
@@ -15,13 +13,26 @@ import { StorageClient, StorageDriver, createStorageClient, registerStorageDrive
  * is thrown, and carries user input into every log line that touches it.
  */
 /** Base for anything wrong with a storage URL, so callers may catch broadly. */
-declare abstract class StorageUrlError extends Error {
-  /** The URL that could not be used. */
+export declare abstract class StorageUrlError extends Error {
+  /**
+   * The URL that could not be used, with any credentials it carried replaced
+   * by `REDACTED` — an error is logged, and a key in its userinfo would be
+   * logged with it.
+   */
   readonly url: string;
   constructor(url: string, message: string);
 }
+/**
+ * Replace a URL's userinfo with `REDACTED`, so `s3://KEY:SECRET@uploads` can be
+ * logged as `s3://REDACTED@uploads`. A URL without userinfo comes back as is.
+ *
+ * A string the URL parser rejects is still redacted, up to its last `@`: an
+ * unencoded `/` in a secret is the commonest way to write a malformed one, and
+ * that string is exactly the one that ends up in an error.
+ */
+export declare function redactStorageUrl(url: string): string;
 /** The string is not a URL at all. */
-declare class MalformedStorageUrl extends StorageUrlError {
+export declare class MalformedStorageUrl extends StorageUrlError {
   constructor(url: string);
 }
 /**
@@ -29,7 +40,7 @@ declare class MalformedStorageUrl extends StorageUrlError {
  * or the reverse. The usual cause is a construct resolving against the wrong
  * target, which is worth distinguishing from a malformed string.
  */
-declare class UnexpectedStorageScheme extends StorageUrlError {
+export declare class UnexpectedStorageScheme extends StorageUrlError {
   /** The scheme this client handles, e.g. `'s3:'`. */
   readonly expected: string;
   /** The scheme the URL actually carried, e.g. `'gs:'`. */
@@ -43,9 +54,20 @@ declare class UnexpectedStorageScheme extends StorageUrlError {
  * container. One error covers all three — the word in the message is the
  * common one rather than a new abstraction nobody uses.
  */
-declare class MissingStorageBucket extends StorageUrlError {
+export declare class MissingStorageBucket extends StorageUrlError {
   constructor(url: string);
 }
+/**
+ * The URL's userinfo carries one half of a key pair: an access key with no
+ * secret, or a secret with no access key. Either both are in the URL, or
+ * neither is and the provider's default credential chain applies — half a pair
+ * is never silently completed from the environment.
+ */
+export declare class IncompleteStorageCredentials extends StorageUrlError {
+  /** Which half is missing: `'accessKeyId'` or `'secretAccessKey'`. */
+  readonly missing: 'accessKeyId' | 'secretAccessKey';
+  constructor(url: string, missing: 'accessKeyId' | 'secretAccessKey');
+}
 /**
  * No driver is registered for the URL's scheme.
  *
@@ -53,14 +75,13 @@ declare class MissingStorageBucket extends StorageUrlError {
  * point registered nothing at all — so the registered schemes are carried
  * alongside, since "what *is* available" is the actionable half.
  */
-declare class UnregisteredStorageScheme extends StorageUrlError {
+export declare class UnregisteredStorageScheme extends StorageUrlError {
   /** The scheme that had no driver, e.g. `'gs:'`. */
   readonly scheme: string;
   /** What is registered, so the caller can see what was pinned instead. */
   readonly registered: readonly string[];
   constructor(url: string, scheme: string, registered: readonly string[]);
 }
-//# sourceMappingURL=errors.d.ts.map
 //#endregion
-export { MalformedStorageUrl, MissingStorageBucket, StorageClient, StorageDriver, StorageUrlError, UnexpectedStorageScheme, UnregisteredStorageScheme, createStorageClient, registerStorageDriver, registeredStorageSchemes };
+export { type StorageClient, type StorageDriver, createStorageClient, registerStorageDriver, registeredStorageSchemes };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;;;;;;AAcA;AAYA;AAWA;AAoBA;AAaA;;;;;;uBAxDsB,eAAA,SAAwB,KAAK;;;;;;cAYtC,mBAAA,SAA4B,eAAe;;;;;;;;cAW3C,uBAAA,SAAgC,eAAe;;;;;;;;;;;;;;cAoB/C,oBAAA,SAA6B,eAAe;;;;;;;;;;cAa5C,yBAAA,SAAkC,eAAe"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;;;;;;8BAcsB,wBAAwB;;;;;;WAMpC;EAET,YAAY,aAAa;;;;;;;;;;wBAeV,iBAAiB;;qBAapB,4BAA4B;EACxC,YAAY;;;;;;;qBAUA,gCAAgC;;WAEnC;;WAEA;EAET,YAAY,aAAa,kBAAkB;;;;;;;;;qBAc/B,6BAA6B;EACzC,YAAY;;;;;;;;qBAWA,qCAAqC;;WAExC;EAET,YAAY,aAAa;;;;;;;;;qBAgBb,kCAAkC;;WAErC;;WAEA;EAET,YAAY,aAAa,gBAAgB"}

package/dist/index.d.mts

@@ -1,7 +1,5 @@
-import { StorageClient, StorageDriver, createStorageClient, registerStorageDriver, registeredStorageSchemes } from "./registry-DEqSHjx-.mjs";
-
+import { i as registeredStorageSchemes, l as StorageClient, n as createStorageClient, r as registerStorageDriver, t as StorageDriver } from "./registry-ClEvHGpM.mjs";
 //#region src/errors.d.ts
-
 /**
  * Storage errors — shared by every implementation, not just S3.
  *
@@ -15,13 +13,26 @@ import { StorageClient, StorageDriver, createStorageClient, registerStorageDrive
  * is thrown, and carries user input into every log line that touches it.
  */
 /** Base for anything wrong with a storage URL, so callers may catch broadly. */
-declare abstract class StorageUrlError extends Error {
-  /** The URL that could not be used. */
+export declare abstract class StorageUrlError extends Error {
+  /**
+   * The URL that could not be used, with any credentials it carried replaced
+   * by `REDACTED` — an error is logged, and a key in its userinfo would be
+   * logged with it.
+   */
   readonly url: string;
   constructor(url: string, message: string);
 }
+/**
+ * Replace a URL's userinfo with `REDACTED`, so `s3://KEY:SECRET@uploads` can be
+ * logged as `s3://REDACTED@uploads`. A URL without userinfo comes back as is.
+ *
+ * A string the URL parser rejects is still redacted, up to its last `@`: an
+ * unencoded `/` in a secret is the commonest way to write a malformed one, and
+ * that string is exactly the one that ends up in an error.
+ */
+export declare function redactStorageUrl(url: string): string;
 /** The string is not a URL at all. */
-declare class MalformedStorageUrl extends StorageUrlError {
+export declare class MalformedStorageUrl extends StorageUrlError {
   constructor(url: string);
 }
 /**
@@ -29,7 +40,7 @@ declare class MalformedStorageUrl extends StorageUrlError {
  * or the reverse. The usual cause is a construct resolving against the wrong
  * target, which is worth distinguishing from a malformed string.
  */
-declare class UnexpectedStorageScheme extends StorageUrlError {
+export declare class UnexpectedStorageScheme extends StorageUrlError {
   /** The scheme this client handles, e.g. `'s3:'`. */
   readonly expected: string;
   /** The scheme the URL actually carried, e.g. `'gs:'`. */
@@ -43,9 +54,20 @@ declare class UnexpectedStorageScheme extends StorageUrlError {
  * container. One error covers all three — the word in the message is the
  * common one rather than a new abstraction nobody uses.
  */
-declare class MissingStorageBucket extends StorageUrlError {
+export declare class MissingStorageBucket extends StorageUrlError {
   constructor(url: string);
 }
+/**
+ * The URL's userinfo carries one half of a key pair: an access key with no
+ * secret, or a secret with no access key. Either both are in the URL, or
+ * neither is and the provider's default credential chain applies — half a pair
+ * is never silently completed from the environment.
+ */
+export declare class IncompleteStorageCredentials extends StorageUrlError {
+  /** Which half is missing: `'accessKeyId'` or `'secretAccessKey'`. */
+  readonly missing: 'accessKeyId' | 'secretAccessKey';
+  constructor(url: string, missing: 'accessKeyId' | 'secretAccessKey');
+}
 /**
  * No driver is registered for the URL's scheme.
  *
@@ -53,14 +75,13 @@ declare class MissingStorageBucket extends StorageUrlError {
  * point registered nothing at all — so the registered schemes are carried
  * alongside, since "what *is* available" is the actionable half.
  */
-declare class UnregisteredStorageScheme extends StorageUrlError {
+export declare class UnregisteredStorageScheme extends StorageUrlError {
   /** The scheme that had no driver, e.g. `'gs:'`. */
   readonly scheme: string;
   /** What is registered, so the caller can see what was pinned instead. */
   readonly registered: readonly string[];
   constructor(url: string, scheme: string, registered: readonly string[]);
 }
-//# sourceMappingURL=errors.d.ts.map
 //#endregion
-export { MalformedStorageUrl, MissingStorageBucket, StorageClient, StorageDriver, StorageUrlError, UnexpectedStorageScheme, UnregisteredStorageScheme, createStorageClient, registerStorageDriver, registeredStorageSchemes };
+export { type StorageClient, type StorageDriver, createStorageClient, registerStorageDriver, registeredStorageSchemes };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;;;;;;AAcA;AAYA;AAWA;AAoBA;AAaA;;;;;;uBAxDsB,eAAA,SAAwB,KAAK;;;;;;cAYtC,mBAAA,SAA4B,eAAe;;;;;;;;cAW3C,uBAAA,SAAgC,eAAe;;;;;;;;;;;;;;cAoB/C,oBAAA,SAA6B,eAAe;;;;;;;;;;cAa5C,yBAAA,SAAkC,eAAe"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;;;;;;8BAcsB,wBAAwB;;;;;;WAMpC;EAET,YAAY,aAAa;;;;;;;;;;wBAeV,iBAAiB;;qBAapB,4BAA4B;EACxC,YAAY;;;;;;;qBAUA,gCAAgC;;WAEnC;;WAEA;EAET,YAAY,aAAa,kBAAkB;;;;;;;;;qBAc/B,6BAA6B;EACzC,YAAY;;;;;;;;qBAWA,qCAAqC;;WAExC;EAET,YAAY,aAAa;;;;;;;;;qBAgBb,kCAAkC;;WAErC;;WAEA;EAET,YAAY,aAAa,gBAAgB"}

package/dist/index.mjs

@@ -1,6 +1,19 @@
-import { MalformedStorageUrl, MissingStorageBucket, StorageUrlError, UnexpectedStorageScheme, UnregisteredStorageScheme } from "./errors-D5UnAd-X.mjs";
-
+import { a as UnexpectedStorageScheme, i as StorageUrlError, n as MalformedStorageUrl, o as UnregisteredStorageScheme, r as MissingStorageBucket, s as redactStorageUrl, t as IncompleteStorageCredentials } from "./errors-COXs1iNg.mjs";
 //#region src/registry.ts
+/**
+* Driver registry — how a storage URL becomes a client without the caller
+* naming a cloud.
+*
+* A construct declares that it needs object storage and receives one URL. It
+* must not import `AmazonStorageClient` to use it: that would name a provider in
+* the neutral layer and drag the AWS SDK into an app that only ever talks to
+* GCS. So the protocol selects the driver, and whoever assembles the
+* application decides which drivers exist — a generated handler registering the
+* one its target needs, or a dev entry registering several.
+*
+* Registration is explicit rather than an import side effect, because a
+* side-effecting module is exactly what a bundler is entitled to drop.
+*/
 const drivers = /* @__PURE__ */ new Map();
 /** Make a driver available to {@link createStorageClient}. Idempotent. */
 function registerStorageDriver(driver) {
@@ -26,7 +39,7 @@ function schemeOf(url) {
 	const separator = url.indexOf(":");
 	return separator === -1 ? "" : url.slice(0, separator + 1);
 }
-
 //#endregion
-export { MalformedStorageUrl, MissingStorageBucket, StorageUrlError, UnexpectedStorageScheme, UnregisteredStorageScheme, createStorageClient, registerStorageDriver, registeredStorageSchemes };
+export { IncompleteStorageCredentials, MalformedStorageUrl, MissingStorageBucket, StorageUrlError, UnexpectedStorageScheme, UnregisteredStorageScheme, createStorageClient, redactStorageUrl, registerStorageDriver, registeredStorageSchemes };
+
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["driver: StorageDriver","url: string"],"sources":["../src/registry.ts"],"sourcesContent":["/**\n * Driver registry — how a storage URL becomes a client without the caller\n * naming a cloud.\n *\n * A construct declares that it needs object storage and receives one URL. It\n * must not import `AmazonStorageClient` to use it: that would name a provider in\n * the neutral layer and drag the AWS SDK into an app that only ever talks to\n * GCS. So the protocol selects the driver, and whoever assembles the\n * application decides which drivers exist — a generated handler registering the\n * one its target needs, or a dev entry registering several.\n *\n * Registration is explicit rather than an import side effect, because a\n * side-effecting module is exactly what a bundler is entitled to drop.\n */\n\nimport { UnregisteredStorageScheme } from './errors';\nimport type { StorageClient } from './StorageClient';\n\n/**\n * Builds a client from a URL it recognises.\n *\n * The driver owns parsing: the shape of an `s3://` URL is S3's business, and a\n * `gs://` driver shares nothing with it beyond this signature.\n */\nexport interface StorageDriver {\n\t/** The URL scheme this driver handles, including the colon — e.g. `'s3:'`. */\n\treadonly scheme: string;\n\tcreate(url: string): StorageClient;\n}\n\nconst drivers = new Map<string, StorageDriver>();\n\n/** Make a driver available to {@link createStorageClient}. Idempotent. */\nexport function registerStorageDriver(driver: StorageDriver): void {\n\tdrivers.set(driver.scheme, driver);\n}\n\n/** Which schemes are currently registered — the useful half of a failure. */\nexport function registeredStorageSchemes(): string[] {\n\treturn [...drivers.keys()].sort();\n}\n\n/**\n * Build a client for a URL.\n *\n * @throws {UnregisteredStorageScheme} when no driver handles the scheme, which\n * in practice means the build pinned a different one, or nothing registered.\n */\nexport function createStorageClient(url: string): StorageClient {\n\tconst scheme = schemeOf(url);\n\tconst driver = drivers.get(scheme);\n\n\tif (!driver) {\n\t\tthrow new UnregisteredStorageScheme(\n\t\t\turl,\n\t\t\tscheme,\n\t\t\tregisteredStorageSchemes(),\n\t\t);\n\t}\n\n\treturn driver.create(url);\n}\n\nfunction schemeOf(url: string): string {\n\tconst separator = url.indexOf(':');\n\treturn separator === -1 ? '' : url.slice(0, separator + 1);\n}\n"],"mappings":";;;AA8BA,MAAM,0BAAU,IAAI;;AAGpB,SAAgB,sBAAsBA,QAA6B;AAClE,SAAQ,IAAI,OAAO,QAAQ,OAAO;AAClC;;AAGD,SAAgB,2BAAqC;AACpD,QAAO,CAAC,GAAG,QAAQ,MAAM,AAAC,EAAC,MAAM;AACjC;;;;;;;AAQD,SAAgB,oBAAoBC,KAA4B;CAC/D,MAAM,SAAS,SAAS,IAAI;CAC5B,MAAM,SAAS,QAAQ,IAAI,OAAO;AAElC,MAAK,OACJ,OAAM,IAAI,0BACT,KACA,QACA,0BAA0B;AAI5B,QAAO,OAAO,OAAO,IAAI;AACzB;AAED,SAAS,SAASA,KAAqB;CACtC,MAAM,YAAY,IAAI,QAAQ,IAAI;AAClC,QAAO,cAAc,KAAK,KAAK,IAAI,MAAM,GAAG,YAAY,EAAE;AAC1D"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/registry.ts"],"sourcesContent":["/**\n * Driver registry — how a storage URL becomes a client without the caller\n * naming a cloud.\n *\n * A construct declares that it needs object storage and receives one URL. It\n * must not import `AmazonStorageClient` to use it: that would name a provider in\n * the neutral layer and drag the AWS SDK into an app that only ever talks to\n * GCS. So the protocol selects the driver, and whoever assembles the\n * application decides which drivers exist — a generated handler registering the\n * one its target needs, or a dev entry registering several.\n *\n * Registration is explicit rather than an import side effect, because a\n * side-effecting module is exactly what a bundler is entitled to drop.\n */\n\nimport { UnregisteredStorageScheme } from './errors';\nimport type { StorageClient } from './StorageClient';\n\n/**\n * Builds a client from a URL it recognises.\n *\n * The driver owns parsing: the shape of an `s3://` URL is S3's business, and a\n * `gs://` driver shares nothing with it beyond this signature.\n */\nexport interface StorageDriver {\n\t/** The URL scheme this driver handles, including the colon — e.g. `'s3:'`. */\n\treadonly scheme: string;\n\tcreate(url: string): StorageClient;\n}\n\nconst drivers = new Map<string, StorageDriver>();\n\n/** Make a driver available to {@link createStorageClient}. Idempotent. */\nexport function registerStorageDriver(driver: StorageDriver): void {\n\tdrivers.set(driver.scheme, driver);\n}\n\n/** Which schemes are currently registered — the useful half of a failure. */\nexport function registeredStorageSchemes(): string[] {\n\treturn [...drivers.keys()].sort();\n}\n\n/**\n * Build a client for a URL.\n *\n * @throws {UnregisteredStorageScheme} when no driver handles the scheme, which\n * in practice means the build pinned a different one, or nothing registered.\n */\nexport function createStorageClient(url: string): StorageClient {\n\tconst scheme = schemeOf(url);\n\tconst driver = drivers.get(scheme);\n\n\tif (!driver) {\n\t\tthrow new UnregisteredStorageScheme(\n\t\t\turl,\n\t\t\tscheme,\n\t\t\tregisteredStorageSchemes(),\n\t\t);\n\t}\n\n\treturn driver.create(url);\n}\n\nfunction schemeOf(url: string): string {\n\tconst separator = url.indexOf(':');\n\treturn separator === -1 ? '' : url.slice(0, separator + 1);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,MAAM,0BAAU,IAAI,IAA2B;;AAG/C,SAAgB,sBAAsB,QAA6B;CAClE,QAAQ,IAAI,OAAO,QAAQ,MAAM;AAClC;;AAGA,SAAgB,2BAAqC;CACpD,OAAO,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK;AACjC;;;;;;;AAQA,SAAgB,oBAAoB,KAA4B;CAC/D,MAAM,SAAS,SAAS,GAAG;CAC3B,MAAM,SAAS,QAAQ,IAAI,MAAM;CAEjC,IAAI,CAAC,QACJ,MAAM,IAAI,0BACT,KACA,QACA,yBAAyB,CAC1B;CAGD,OAAO,OAAO,OAAO,GAAG;AACzB;AAEA,SAAS,SAAS,KAAqB;CACtC,MAAM,YAAY,IAAI,QAAQ,GAAG;CACjC,OAAO,cAAc,KAAK,KAAK,IAAI,MAAM,GAAG,YAAY,CAAC;AAC1D"}

package/dist/{registry-DBsAUTT3.d.cts → registry-ClEvHGpM.d.cts}

@@ -1,5 +1,4 @@
 import { Cache } from "@geekmidas/cache";
-
 //#region src/StorageClient.d.ts
 interface DocumentVersion {
   id: string;
@@ -8,7 +7,7 @@ interface DocumentVersion {
 declare enum StorageProvider {
   AWSS3 = "geekimdas.toolbox.storage.aws.s3",
   GCP = "geekimdas.toolbox.storage.gcp",
-  AZURE = "geekimdas.toolbox.storage.azure",
+  AZURE = "geekimdas.toolbox.storage.azure"
 }
 interface StorageClient {
   readonly provider: StorageProvider;
@@ -93,7 +92,6 @@ interface File {
    */
   disposition?: 'inline' | 'attachment';
 }
-//# sourceMappingURL=StorageClient.d.ts.map
 //#endregion
 //#region src/registry.d.ts
 /**
@@ -118,7 +116,6 @@ declare function registeredStorageSchemes(): string[];
  * in practice means the build pinned a different one, or nothing registered.
  */
 declare function createStorageClient(url: string): StorageClient;
-//# sourceMappingURL=registry.d.ts.map
 //#endregion
-export { DocumentVersion, File, GetUploadParams, GetUploadResponse, StorageClient, StorageDriver, StorageProvider, createStorageClient, registerStorageDriver, registeredStorageSchemes };
-//# sourceMappingURL=registry-DBsAUTT3.d.cts.map
+export { DocumentVersion as a, GetUploadResponse as c, registeredStorageSchemes as i, StorageClient as l, createStorageClient as n, File as o, registerStorageDriver as r, GetUploadParams as s, StorageDriver as t, StorageProvider as u };
+//# sourceMappingURL=registry-ClEvHGpM.d.cts.map

package/dist/registry-ClEvHGpM.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-ClEvHGpM.d.cts","names":[],"sources":["../src/StorageClient.ts","../src/registry.ts"],"mappings":";;UACiB;EAChB;EACA,WAAW;;aAGA;EACX;EACA;EACA;;UAGgB;WACP,UAAU;WACV,QAAQ;;;;;;;;;EASjB,aAAa,QAAQ,iBAAiB,qBAAqB;;;;;;;;;EAU3D,eAAe,MAAM,MAAM,qBAAqB;;;;;;EAMhD,YAAY,cAAc,QAAQ;;;;;;;EAQlC,sBAAsB,MAAM,MAAM,oBAAoB;;;;;;;EAOtD,OACC,aACA,eAAe,QACf,sBACE;;;;;;;EAOH,UACC,QAAQ,iBACR,qBACE,QAAQ;;;;;;EAMX,OAAO,cAAc;;UAGL;EAChB;EACA;EACA;;KAGW;EACX;EACA;;KAGW;EACX;EACA,QAAQ;;UAGQ;EAChB;EACA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;UClFgB;;WAEP;EACT,OAAO,cAAc;;;iBAMN,sBAAsB,QAAQ;;iBAK9B;;;;;;;iBAUA,oBAAoB,cAAc"}

package/dist/{registry-DEqSHjx-.d.mts → registry-ClEvHGpM.d.mts}

@@ -1,5 +1,4 @@
 import { Cache } from "@geekmidas/cache";
-
 //#region src/StorageClient.d.ts
 interface DocumentVersion {
   id: string;
@@ -8,7 +7,7 @@ interface DocumentVersion {
 declare enum StorageProvider {
   AWSS3 = "geekimdas.toolbox.storage.aws.s3",
   GCP = "geekimdas.toolbox.storage.gcp",
-  AZURE = "geekimdas.toolbox.storage.azure",
+  AZURE = "geekimdas.toolbox.storage.azure"
 }
 interface StorageClient {
   readonly provider: StorageProvider;
@@ -93,7 +92,6 @@ interface File {
    */
   disposition?: 'inline' | 'attachment';
 }
-//# sourceMappingURL=StorageClient.d.ts.map
 //#endregion
 //#region src/registry.d.ts
 /**
@@ -118,7 +116,6 @@ declare function registeredStorageSchemes(): string[];
  * in practice means the build pinned a different one, or nothing registered.
  */
 declare function createStorageClient(url: string): StorageClient;
-//# sourceMappingURL=registry.d.ts.map
 //#endregion
-export { DocumentVersion, File, GetUploadParams, GetUploadResponse, StorageClient, StorageDriver, StorageProvider, createStorageClient, registerStorageDriver, registeredStorageSchemes };
-//# sourceMappingURL=registry-DEqSHjx-.d.mts.map
+export { DocumentVersion as a, GetUploadResponse as c, registeredStorageSchemes as i, StorageClient as l, createStorageClient as n, File as o, registerStorageDriver as r, GetUploadParams as s, StorageDriver as t, StorageProvider as u };
+//# sourceMappingURL=registry-ClEvHGpM.d.mts.map

package/dist/registry-ClEvHGpM.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-ClEvHGpM.d.mts","names":[],"sources":["../src/StorageClient.ts","../src/registry.ts"],"mappings":";;UACiB;EAChB;EACA,WAAW;;aAGA;EACX;EACA;EACA;;UAGgB;WACP,UAAU;WACV,QAAQ;;;;;;;;;EASjB,aAAa,QAAQ,iBAAiB,qBAAqB;;;;;;;;;EAU3D,eAAe,MAAM,MAAM,qBAAqB;;;;;;EAMhD,YAAY,cAAc,QAAQ;;;;;;;EAQlC,sBAAsB,MAAM,MAAM,oBAAoB;;;;;;;EAOtD,OACC,aACA,eAAe,QACf,sBACE;;;;;;;EAOH,UACC,QAAQ,iBACR,qBACE,QAAQ;;;;;;EAMX,OAAO,cAAc;;UAGL;EAChB;EACA;EACA;;KAGW;EACX;EACA;;KAGW;EACX;EACA,QAAQ;;UAGQ;EAChB;EACA;;;;;EAKA;;;;;;EAMA;;;;;;;;;;UClFgB;;WAEP;EACT,OAAO,cAAc;;;iBAMN,sBAAsB,QAAQ;;iBAK9B;;;;;;;iBAUA,oBAAoB,cAAc"}

package/dist/rolldown-runtime-D7D4PA-g.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/dist/s3Url.cjs

@@ -1,5 +1,109 @@
-const require_s3Url = require('./s3Url-Bo32UTTA.cjs');
-require('./errors-Bce0CJ11.cjs');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+const require_errors = require("./errors-BB8jdHif.cjs");
+//#region src/s3Url.ts
+/**
+* The `s3://` URL codec — how an S3 bucket is addressed as a single string.
+*
+* It lives beside the client rather than in a neutral package because `bucket`,
+* `region`, and `forcePathStyle` are S3's vocabulary. The neutral layer only
+* knows that a construct provides *one URL*; what that URL says is between the
+* component that composes it and the client that parses it. A `gs://` codec
+* would sit beside its own client and share nothing with this one.
+*
+* Both directions live here so they cannot drift: `parse(build(x))` is `x`.
+*/
+var s3Url_exports = /* @__PURE__ */ __exportAll({
+	build: () => build,
+	parse: () => parse
+});
+const SCHEME = "s3:";
+/**
+* Compose an address into a URL.
+*
+* Credentials appear only when the address carries them, percent-encoded —
+* AWS secrets routinely contain `/` and `+`. An address without them builds a
+* URL with no userinfo, which leaves the caller to the SDK's own chain.
+*/
+function build(address) {
+	const { bucket, region, endpoint, forcePathStyle, accessKeyId, secretAccessKey } = address;
+	if (!bucket) throw new require_errors.MissingStorageBucket("");
+	const url = new URL(`${SCHEME}//${bucket}`);
+	if (accessKeyId || secretAccessKey) {
+		if (!accessKeyId) throw new require_errors.IncompleteStorageCredentials(url.toString(), "accessKeyId");
+		if (!secretAccessKey) throw new require_errors.IncompleteStorageCredentials(url.toString(), "secretAccessKey");
+		url.username = encodeURIComponent(accessKeyId);
+		url.password = encodeURIComponent(secretAccessKey);
+	}
+	if (region) url.searchParams.set("region", region);
+	if (endpoint) url.searchParams.set("endpoint", endpoint);
+	if (forcePathStyle) url.searchParams.set("forcePathStyle", "true");
+	return url.toString();
+}
+/**
+* Parse a URL back into an address. Throws if it is not an `s3://` URL, or if
+* its userinfo carries only one half of a key pair.
+*/
+function parse(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new require_errors.MalformedStorageUrl(url);
+	}
+	if (parsed.protocol !== SCHEME) throw new require_errors.UnexpectedStorageScheme(url, SCHEME, parsed.protocol);
+	const bucket = parsed.hostname;
+	if (!bucket) throw new require_errors.MissingStorageBucket(url);
+	const region = parsed.searchParams.get("region") ?? void 0;
+	const endpoint = parsed.searchParams.get("endpoint") ?? void 0;
+	const forcePathStyle = parsed.searchParams.get("forcePathStyle") === "true" ? true : void 0;
+	const credentials = credentialsOf(url, parsed);
+	return {
+		bucket,
+		...region ? { region } : {},
+		...endpoint ? { endpoint } : {},
+		...forcePathStyle ? { forcePathStyle } : {},
+		...credentials
+	};
+}
+/** The URL's userinfo as a key pair: both halves, or nothing. */
+function credentialsOf(url, parsed) {
+	const accessKeyId = decode(url, parsed.username);
+	const secretAccessKey = decode(url, parsed.password);
+	if (!accessKeyId && !secretAccessKey) return {};
+	if (!accessKeyId) throw new require_errors.IncompleteStorageCredentials(url, "accessKeyId");
+	if (!secretAccessKey) throw new require_errors.IncompleteStorageCredentials(url, "secretAccessKey");
+	return {
+		accessKeyId,
+		secretAccessKey
+	};
+}
+function decode(url, value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		throw new require_errors.MalformedStorageUrl(url);
+	}
+}
+//#endregion
+exports.build = build;
+exports.parse = parse;
+Object.defineProperty(exports, "s3Url_exports", {
+	enumerable: true,
+	get: function() {
+		return s3Url_exports;
+	}
+});
 
-exports.build = require_s3Url.build;
-exports.parse = require_s3Url.parse;
+//# sourceMappingURL=s3Url.cjs.map

package/dist/s3Url.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3Url.cjs","names":["MissingStorageBucket","IncompleteStorageCredentials","MalformedStorageUrl","UnexpectedStorageScheme"],"sources":["../src/s3Url.ts"],"sourcesContent":["/**\n * The `s3://` URL codec — how an S3 bucket is addressed as a single string.\n *\n * It lives beside the client rather than in a neutral package because `bucket`,\n * `region`, and `forcePathStyle` are S3's vocabulary. The neutral layer only\n * knows that a construct provides *one URL*; what that URL says is between the\n * component that composes it and the client that parses it. A `gs://` codec\n * would sit beside its own client and share nothing with this one.\n *\n * Both directions live here so they cannot drift: `parse(build(x))` is `x`.\n */\n\nimport {\n\tIncompleteStorageCredentials,\n\tMalformedStorageUrl,\n\tMissingStorageBucket,\n\tUnexpectedStorageScheme,\n} from './errors';\n\n/**\n * What an S3 URL addresses, and optionally who it calls as.\n *\n * Credentials are optional and come as a pair. With them, the URL is a key\n * scoped to this one bucket (`s3://KEY:SECRET@uploads`); without them the AWS\n * SDK resolves its own chain — an execution role when deployed,\n * `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` otherwise. The URL's pair wins\n * over that chain.\n */\nexport interface S3Address {\n\tbucket: string;\n\t/** Read off the bucket, never inherited: a bucket may live in another region. */\n\tregion?: string;\n\t/** Set for S3-compatible backends such as MinIO. */\n\tendpoint?: string;\n\t/** MinIO and most S3-compatible servers need path-style addressing. */\n\tforcePathStyle?: boolean;\n\t/** The URL's own access key; always paired with `secretAccessKey`. */\n\taccessKeyId?: string;\n\t/** The URL's own secret; always paired with `accessKeyId`. */\n\tsecretAccessKey?: string;\n}\n\nconst SCHEME = 's3:';\n\n/**\n * Compose an address into a URL.\n *\n * Credentials appear only when the address carries them, percent-encoded —\n * AWS secrets routinely contain `/` and `+`. An address without them builds a\n * URL with no userinfo, which leaves the caller to the SDK's own chain.\n */\nexport function build(address: S3Address): string {\n\tconst {\n\t\tbucket,\n\t\tregion,\n\t\tendpoint,\n\t\tforcePathStyle,\n\t\taccessKeyId,\n\t\tsecretAccessKey,\n\t} = address;\n\tif (!bucket) throw new MissingStorageBucket('');\n\n\tconst url = new URL(`${SCHEME}//${bucket}`);\n\tif (accessKeyId || secretAccessKey) {\n\t\tif (!accessKeyId) {\n\t\t\tthrow new IncompleteStorageCredentials(url.toString(), 'accessKeyId');\n\t\t}\n\t\tif (!secretAccessKey) {\n\t\t\tthrow new IncompleteStorageCredentials(url.toString(), 'secretAccessKey');\n\t\t}\n\t\turl.username = encodeURIComponent(accessKeyId);\n\t\turl.password = encodeURIComponent(secretAccessKey);\n\t}\n\tif (region) url.searchParams.set('region', region);\n\tif (endpoint) url.searchParams.set('endpoint', endpoint);\n\tif (forcePathStyle) url.searchParams.set('forcePathStyle', 'true');\n\treturn url.toString();\n}\n\n/**\n * Parse a URL back into an address. Throws if it is not an `s3://` URL, or if\n * its userinfo carries only one half of a key pair.\n */\nexport function parse(url: string): S3Address {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new MalformedStorageUrl(url);\n\t}\n\n\tif (parsed.protocol !== SCHEME) {\n\t\tthrow new UnexpectedStorageScheme(url, SCHEME, parsed.protocol);\n\t}\n\n\tconst bucket = parsed.hostname;\n\tif (!bucket) throw new MissingStorageBucket(url);\n\n\tconst region = parsed.searchParams.get('region') ?? undefined;\n\tconst endpoint = parsed.searchParams.get('endpoint') ?? undefined;\n\tconst forcePathStyle =\n\t\tparsed.searchParams.get('forcePathStyle') === 'true' ? true : undefined;\n\tconst credentials = credentialsOf(url, parsed);\n\n\treturn {\n\t\tbucket,\n\t\t...(region ? { region } : {}),\n\t\t...(endpoint ? { endpoint } : {}),\n\t\t...(forcePathStyle ? { forcePathStyle } : {}),\n\t\t...credentials,\n\t};\n}\n\n/** The URL's userinfo as a key pair: both halves, or nothing. */\nfunction credentialsOf(\n\turl: string,\n\tparsed: URL,\n): Pick<S3Address, 'accessKeyId' | 'secretAccessKey'> {\n\tconst accessKeyId = decode(url, parsed.username);\n\tconst secretAccessKey = decode(url, parsed.password);\n\tif (!accessKeyId && !secretAccessKey) return {};\n\tif (!accessKeyId) {\n\t\tthrow new IncompleteStorageCredentials(url, 'accessKeyId');\n\t}\n\tif (!secretAccessKey) {\n\t\tthrow new IncompleteStorageCredentials(url, 'secretAccessKey');\n\t}\n\treturn { accessKeyId, secretAccessKey };\n}\n\nfunction decode(url: string, value: string): string {\n\ttry {\n\t\treturn decodeURIComponent(value);\n\t} catch {\n\t\tthrow new MalformedStorageUrl(url);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,SAAS;;;;;;;;AASf,SAAgB,MAAM,SAA4B;CACjD,MAAM,EACL,QACA,QACA,UACA,gBACA,aACA,oBACG;CACJ,IAAI,CAAC,QAAQ,MAAM,IAAIA,eAAAA,qBAAqB,EAAE;CAE9C,MAAM,MAAM,IAAI,IAAI,GAAG,OAAO,IAAI,QAAQ;CAC1C,IAAI,eAAe,iBAAiB;EACnC,IAAI,CAAC,aACJ,MAAM,IAAIC,eAAAA,6BAA6B,IAAI,SAAS,GAAG,aAAa;EAErE,IAAI,CAAC,iBACJ,MAAM,IAAIA,eAAAA,6BAA6B,IAAI,SAAS,GAAG,iBAAiB;EAEzE,IAAI,WAAW,mBAAmB,WAAW;EAC7C,IAAI,WAAW,mBAAmB,eAAe;CAClD;CACA,IAAI,QAAQ,IAAI,aAAa,IAAI,UAAU,MAAM;CACjD,IAAI,UAAU,IAAI,aAAa,IAAI,YAAY,QAAQ;CACvD,IAAI,gBAAgB,IAAI,aAAa,IAAI,kBAAkB,MAAM;CACjE,OAAO,IAAI,SAAS;AACrB;;;;;AAMA,SAAgB,MAAM,KAAwB;CAC7C,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAIC,eAAAA,oBAAoB,GAAG;CAClC;CAEA,IAAI,OAAO,aAAa,QACvB,MAAM,IAAIC,eAAAA,wBAAwB,KAAK,QAAQ,OAAO,QAAQ;CAG/D,MAAM,SAAS,OAAO;CACtB,IAAI,CAAC,QAAQ,MAAM,IAAIH,eAAAA,qBAAqB,GAAG;CAE/C,MAAM,SAAS,OAAO,aAAa,IAAI,QAAQ,KAAK,KAAA;CACpD,MAAM,WAAW,OAAO,aAAa,IAAI,UAAU,KAAK,KAAA;CACxD,MAAM,iBACL,OAAO,aAAa,IAAI,gBAAgB,MAAM,SAAS,OAAO,KAAA;CAC/D,MAAM,cAAc,cAAc,KAAK,MAAM;CAE7C,OAAO;EACN;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;EAC3C,GAAG;CACJ;AACD;;AAGA,SAAS,cACR,KACA,QACqD;CACrD,MAAM,cAAc,OAAO,KAAK,OAAO,QAAQ;CAC/C,MAAM,kBAAkB,OAAO,KAAK,OAAO,QAAQ;CACnD,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,CAAC;CAC9C,IAAI,CAAC,aACJ,MAAM,IAAIC,eAAAA,6BAA6B,KAAK,aAAa;CAE1D,IAAI,CAAC,iBACJ,MAAM,IAAIA,eAAAA,6BAA6B,KAAK,iBAAiB;CAE9D,OAAO;EAAE;EAAa;CAAgB;AACvC;AAEA,SAAS,OAAO,KAAa,OAAuB;CACnD,IAAI;EACH,OAAO,mBAAmB,KAAK;CAChC,QAAQ;EACP,MAAM,IAAIC,eAAAA,oBAAoB,GAAG;CAClC;AACD"}

package/dist/s3Url.d.cts

@@ -1,2 +1,52 @@
-import { S3Address, build, parse } from "./s3Url-BfztIltX.cjs";
-export { S3Address, build, parse };
+declare namespace s3Url_d_exports {
+  export { S3Address, build, parse };
+}
+/**
+ * The `s3://` URL codec — how an S3 bucket is addressed as a single string.
+ *
+ * It lives beside the client rather than in a neutral package because `bucket`,
+ * `region`, and `forcePathStyle` are S3's vocabulary. The neutral layer only
+ * knows that a construct provides *one URL*; what that URL says is between the
+ * component that composes it and the client that parses it. A `gs://` codec
+ * would sit beside its own client and share nothing with this one.
+ *
+ * Both directions live here so they cannot drift: `parse(build(x))` is `x`.
+ */
+/**
+ * What an S3 URL addresses, and optionally who it calls as.
+ *
+ * Credentials are optional and come as a pair. With them, the URL is a key
+ * scoped to this one bucket (`s3://KEY:SECRET@uploads`); without them the AWS
+ * SDK resolves its own chain — an execution role when deployed,
+ * `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` otherwise. The URL's pair wins
+ * over that chain.
+ */
+export interface S3Address {
+  bucket: string;
+  /** Read off the bucket, never inherited: a bucket may live in another region. */
+  region?: string;
+  /** Set for S3-compatible backends such as MinIO. */
+  endpoint?: string;
+  /** MinIO and most S3-compatible servers need path-style addressing. */
+  forcePathStyle?: boolean;
+  /** The URL's own access key; always paired with `secretAccessKey`. */
+  accessKeyId?: string;
+  /** The URL's own secret; always paired with `accessKeyId`. */
+  secretAccessKey?: string;
+}
+/**
+ * Compose an address into a URL.
+ *
+ * Credentials appear only when the address carries them, percent-encoded —
+ * AWS secrets routinely contain `/` and `+`. An address without them builds a
+ * URL with no userinfo, which leaves the caller to the SDK's own chain.
+ */
+export declare function build(address: S3Address): string;
+/**
+ * Parse a URL back into an address. Throws if it is not an `s3://` URL, or if
+ * its userinfo carries only one half of a key pair.
+ */
+export declare function parse(url: string): S3Address;
+//#endregion
+export { s3Url_d_exports as t };
+//# sourceMappingURL=s3Url.d.cts.map

package/dist/s3Url.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3Url.d.cts","names":[],"sources":["../src/s3Url.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;iBA4BiB;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;;wBAYe,MAAM,SAAS;;;;;wBAgCf,MAAM,cAAc"}

package/dist/s3Url.d.mts

@@ -1,2 +1,52 @@
-import { S3Address, build, parse } from "./s3Url-COpMIgF9.mjs";
-export { S3Address, build, parse };
+declare namespace s3Url_d_exports {
+  export { S3Address, build, parse };
+}
+/**
+ * The `s3://` URL codec — how an S3 bucket is addressed as a single string.
+ *
+ * It lives beside the client rather than in a neutral package because `bucket`,
+ * `region`, and `forcePathStyle` are S3's vocabulary. The neutral layer only
+ * knows that a construct provides *one URL*; what that URL says is between the
+ * component that composes it and the client that parses it. A `gs://` codec
+ * would sit beside its own client and share nothing with this one.
+ *
+ * Both directions live here so they cannot drift: `parse(build(x))` is `x`.
+ */
+/**
+ * What an S3 URL addresses, and optionally who it calls as.
+ *
+ * Credentials are optional and come as a pair. With them, the URL is a key
+ * scoped to this one bucket (`s3://KEY:SECRET@uploads`); without them the AWS
+ * SDK resolves its own chain — an execution role when deployed,
+ * `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` otherwise. The URL's pair wins
+ * over that chain.
+ */
+export interface S3Address {
+  bucket: string;
+  /** Read off the bucket, never inherited: a bucket may live in another region. */
+  region?: string;
+  /** Set for S3-compatible backends such as MinIO. */
+  endpoint?: string;
+  /** MinIO and most S3-compatible servers need path-style addressing. */
+  forcePathStyle?: boolean;
+  /** The URL's own access key; always paired with `secretAccessKey`. */
+  accessKeyId?: string;
+  /** The URL's own secret; always paired with `accessKeyId`. */
+  secretAccessKey?: string;
+}
+/**
+ * Compose an address into a URL.
+ *
+ * Credentials appear only when the address carries them, percent-encoded —
+ * AWS secrets routinely contain `/` and `+`. An address without them builds a
+ * URL with no userinfo, which leaves the caller to the SDK's own chain.
+ */
+export declare function build(address: S3Address): string;
+/**
+ * Parse a URL back into an address. Throws if it is not an `s3://` URL, or if
+ * its userinfo carries only one half of a key pair.
+ */
+export declare function parse(url: string): S3Address;
+//#endregion
+export { s3Url_d_exports as t };
+//# sourceMappingURL=s3Url.d.mts.map

package/dist/s3Url.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3Url.d.mts","names":[],"sources":["../src/s3Url.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;iBA4BiB;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;;wBAYe,MAAM,SAAS;;;;;wBAgCf,MAAM,cAAc"}