@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/state/azure-blob.js

@@ -1,201 +1,8 @@
 /**
- * Azure Blob Storage for an azurerm backend's state, over its REST API with
- * `fetch` and `node:crypto`: a blob's properties and metadata, its text, a
- * write (under a lease when one holds it), a snapshot, a delete, and the
- * blob lease the backend locks a state with.
- *
- * Requests are signed with Shared Key for an account key, carry a SAS as it
- * is, or carry a storage token the job's OIDC identity is traded for at Entra
- * ID (a client assertion, the way the azurerm backend does it).
- *
- * Lifted from terragucci's `report/azure-blob.ts` (c493e0e), without SAS
- * links, version reads and version listing.
+ * The Azure Blob Storage client an azurerm backend's state uses: chant
+ * core's (#4554, `@intentius/chant/object-store`): a blob's properties and
+ * metadata, a snapshot, a block blob put, and the blob lease the backend
+ * locks a state with, signed with Shared Key, a SAS, or an Entra token for
+ * the job's OIDC identity.
  */
-import { createHmac } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { defaultFetch, encodePath, StoreError, xmlText } from "./object-store.js";
-/** The REST version every request names. */
-export const AZURE_VERSION = "2021-08-06";
-/** Entra ID's public cloud. */
-export const AZURE_AUTHORITY = "https://login.microsoftonline.com";
-const STORAGE_SCOPE = "https://storage.azure.com/.default";
-const hmac64 = (key, s) => createHmac("sha256", Buffer.from(key, "base64")).update(s, "utf8").digest("base64");
-/** The headers whose values Shared Key signs by position, in order. */
-const SIGNED = ["content-encoding", "content-language", "content-length", "content-md5", "content-type", "date", "if-modified-since", "if-match", "if-none-match", "if-unmodified-since", "range"];
-/** The Shared Key Authorization header for a request. */
-export function sharedKey(account, accountKey, method, rawUrl, headers) {
-    const url = new URL(rawUrl);
-    const h = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]));
-    const fixed = SIGNED.map((n) => (n === "content-length" && h[n] === "0" ? "" : (h[n] ?? "")));
-    const ms = Object.keys(h).filter((n) => n.startsWith("x-ms-")).sort().map((n) => `${n}:${h[n].trim()}\n`).join("");
-    const params = new Map();
-    for (const [k, v] of url.searchParams)
-        params.set(k.toLowerCase(), [...(params.get(k.toLowerCase()) ?? []), v]);
-    const query = [...params.keys()].sort().map((k) => `\n${k}:${params.get(k).sort().join(",")}`).join("");
-    const toSign = [method, ...fixed].join("\n") + "\n" + ms + `/${account}${url.pathname}` + query;
-    return `SharedKey ${account}:${hmac64(accountKey, toSign)}`;
-}
-/** Entra ID's error, or the start of the body. */
-const why = (text) => {
-    try {
-        const j = JSON.parse(text);
-        if (j.error)
-            return [j.error, j.error_description?.split("\r\n")[0]].filter(Boolean).join(": ");
-    }
-    catch {
-        // Not JSON: Blob Storage answers in XML.
-    }
-    return [xmlText(text, "Code"), xmlText(text, "Message")?.split("\n")[0]].filter(Boolean).join(": ") || text.slice(0, 300);
-};
-export class AzureBlobClient {
-    constructor(target, fetchFn = defaultFetch, readToken = (f) => readFileSync(f, "utf-8")) {
-        this.target = target;
-        this.fetchFn = fetchFn;
-        this.readToken = readToken;
-    }
-    where(key) {
-        return `az://${this.target.account}/${this.target.container}/${key}`;
-    }
-    blobUrl(key, query = "") {
-        const t = this.target;
-        const q = [query, "sas" in t ? t.sas.replace(/^\?/, "") : ""].filter(Boolean).join("&");
-        return `${t.endpoint}/${t.container}/${encodePath(key)}${q ? `?${q}` : ""}`;
-    }
-    /** The storage token for the OIDC identity: once per client, again a minute before it expires. */
-    async bearer(o) {
-        const fetchToken = async () => {
-            let assertion;
-            try {
-                assertion = this.readToken(o.tokenFile).trim();
-            }
-            catch (e) {
-                throw new StoreError(`cannot read the OIDC token in ${o.tokenFile}: ${e.message}`);
-            }
-            if (!assertion)
-                throw new StoreError(`the OIDC token file ${o.tokenFile} is empty`);
-            const body = new URLSearchParams({
-                client_id: o.clientId,
-                scope: STORAGE_SCOPE,
-                grant_type: "client_credentials",
-                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
-                client_assertion: assertion,
-            }).toString();
-            const res = await this.fetchFn(`${o.authority}/${o.tenantId}/oauth2/v2.0/token`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body });
-            const text = await res.text();
-            if (!res.ok)
-                throw new StoreError(`Entra ID refused the OIDC token for client ${o.clientId}: ${res.status} ${why(text)}`);
-            let j = {};
-            try {
-                j = JSON.parse(text);
-            }
-            catch {
-                // Reported below as no token.
-            }
-            if (!j.access_token)
-                throw new StoreError(`Entra ID answered client ${o.clientId} without a token`);
-            return { token: j.access_token, expires: Date.now() + Number(j.expires_in ?? 3600) * 1000 };
-        };
-        const again = () => (this.token = fetchToken().catch((e) => {
-            this.token = undefined;
-            throw e;
-        }));
-        let held = await (this.token ?? again());
-        if (held.expires - Date.now() < 60000)
-            held = await again();
-        return held.token;
-    }
-    /** The headers for one request, signed or with the bearer token. */
-    async headers(method, url, extra) {
-        const h = { "x-ms-date": new Date().toUTCString(), "x-ms-version": AZURE_VERSION, ...extra };
-        const t = this.target;
-        if ("accountKey" in t)
-            return { ...h, authorization: sharedKey(t.account, t.accountKey, method, url, h) };
-        if ("sas" in t)
-            return h;
-        return { ...h, authorization: `Bearer ${await this.bearer(t.oidc)}` };
-    }
-    async get(key) {
-        const url = this.blobUrl(key);
-        const res = await this.fetchFn(url, { method: "GET", headers: await this.headers("GET", url, {}) });
-        if (res.status === 404)
-            return undefined;
-        if (!res.ok)
-            throw new StoreError(`GET ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-        return res.text();
-    }
-    /** A blob's properties and metadata, from a HEAD. */
-    async head(key) {
-        const url = this.blobUrl(key);
-        const res = await this.fetchFn(url, { method: "HEAD", headers: await this.headers("HEAD", url, {}) });
-        if (res.status === 404)
-            return { exists: false, metadata: {} };
-        if (!res.ok)
-            throw new StoreError(`HEAD ${this.where(key)}: ${res.status}`);
-        const get = (n) => res.headers?.get(n) ?? undefined;
-        const metadata = {};
-        const all = res.headers;
-        all?.forEach?.((v, k) => {
-            if (k.toLowerCase().startsWith("x-ms-meta-"))
-                metadata[k.toLowerCase().slice("x-ms-meta-".length)] = v;
-        });
-        const etag = get("etag");
-        const leaseState = get("x-ms-lease-state");
-        return { exists: true, ...(etag ? { etag } : {}), ...(leaseState ? { leaseState } : {}), metadata };
-    }
-    /** Take a snapshot of a blob: its id, the time Azure gives it. */
-    async snapshot(key) {
-        const url = this.blobUrl(key, "comp=snapshot");
-        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, { "content-length": "0" }) });
-        if (!res.ok)
-            throw new StoreError(`snapshot of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-        const id = res.headers?.get("x-ms-snapshot");
-        if (!id)
-            throw new StoreError(`snapshot of ${this.where(key)}: Azure answered without x-ms-snapshot`);
-        return id;
-    }
-    /** Write a block blob with metadata, under a lease when one holds it; with `ifNoneMatch`, only when there is none (false when one was there). */
-    async putBlob(key, body, contentType, options = {}) {
-        const url = this.blobUrl(key);
-        const meta = Object.fromEntries(Object.entries(options.metadata ?? {}).map(([k, v]) => [`x-ms-meta-${k}`, v]));
-        const extra = {
-            "x-ms-blob-type": "BlockBlob",
-            "content-type": contentType,
-            "content-length": String(Buffer.byteLength(body)),
-            ...meta,
-            ...(options.leaseId ? { "x-ms-lease-id": options.leaseId } : {}),
-            ...(options.ifNoneMatch ? { "if-none-match": "*" } : {}),
-        };
-        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra), body });
-        if (options.ifNoneMatch && (res.status === 409 || res.status === 412))
-            return false;
-        if (!res.ok)
-            throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-        return true;
-    }
-    /** Delete a blob. One that is not there is deleted already. */
-    async remove(key) {
-        const url = this.blobUrl(key);
-        const res = await this.fetchFn(url, { method: "DELETE", headers: await this.headers("DELETE", url, {}) });
-        if (!res.ok && res.status !== 404)
-            throw new StoreError(`DELETE ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-    }
-    /** A blob lease: acquire one that never expires with the id given (false when one holds it), or release it. */
-    async lease(key, action, id) {
-        const url = this.blobUrl(key, "comp=lease");
-        const extra = { "x-ms-lease-action": action, "content-length": "0", ...(action === "acquire" ? { "x-ms-lease-duration": "-1", "x-ms-proposed-lease-id": id } : { "x-ms-lease-id": id }) };
-        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra) });
-        if (action === "acquire" && res.status === 409)
-            return false;
-        if (!res.ok)
-            throw new StoreError(`${action} the lease of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-        return true;
-    }
-    /** Set a blob's metadata, all of it, under its lease when one holds it. */
-    async setMetadata(key, metadata, leaseId) {
-        const url = this.blobUrl(key, "comp=metadata");
-        const extra = { "content-length": "0", ...Object.fromEntries(Object.entries(metadata).map(([k, v]) => [`x-ms-meta-${k}`, v])), ...(leaseId ? { "x-ms-lease-id": leaseId } : {}) };
-        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra) });
-        if (!res.ok)
-            throw new StoreError(`set the metadata of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-    }
-}
+export { AZURE_AUTHORITY, AZURE_VERSION, AzureBlobClient, sharedKey } from "@intentius/chant/object-store";

package/dist/state/gcs.d.ts

@@ -1,62 +1,8 @@
-import { type StoreFetch } from "./object-store.js";
-export declare const GCS_ENDPOINT = "https://storage.googleapis.com";
-/** IAM Credentials, where a token for an impersonated service account comes from. */
-export declare const IAM_CREDENTIALS = "https://iamcredentials.googleapis.com";
-export interface GcsTarget {
-    bucket: string;
-    /** The JSON API's address, no trailing slash. Default https://storage.googleapis.com. */
-    endpoint: string;
-    /** The credentials file, read at the first request. */
-    credentialsFile?: string;
-    /** The credentials as JSON: a gcs backend's `credentials` given inline. */
-    credentialsJson?: string;
-    /** A bearer token used as it is. */
-    accessToken?: string;
-    /** The service account every request acts as, through IAM's generateAccessToken. */
-    impersonate?: string;
-    /** IAM Credentials' address, no trailing slash. */
-    iamEndpoint?: string;
-}
-interface ServiceAccountKey {
-    type: "service_account";
-    client_email: string;
-    private_key: string;
-    private_key_id?: string;
-}
-/** A JWT the key signs for itself, which Google's APIs take as an access token for the scope it names. */
-export declare function selfSignedJwt(key: ServiceAccountKey, now: Date): string;
-export declare class GcsClient {
-    readonly target: GcsTarget;
-    private readonly fetchFn;
-    private readonly readFile;
-    private creds?;
-    private token?;
-    constructor(target: GcsTarget, fetchFn?: StoreFetch, readFile?: (file: string) => string);
-    private where;
-    private credentials;
-    private post;
-    /** The job's OIDC token, from the file or URL the credentials name. */
-    private subjectToken;
-    private impersonateWith;
-    /** STS's federated token, then the impersonated service account's, when the credentials name one. */
-    private exchange;
-    /** The identity's own token: the one the target gives, a key's self-signed JWT, or STS's for the OIDC token. */
-    private own;
-    /** An access token: once per client, again a minute before it expires. */
-    private bearer;
-    private objectUrl;
-    /** Write an object; with `ifGenerationMatch`, only when the object still has that generation (`0`: there is none), else StoreConflict. */
-    put(key: string, body: string, contentType: string, ifGenerationMatch?: string): Promise<void>;
-    get(key: string): Promise<string | undefined>;
-    /** An object's metadata and never its body: whether it is there, and its generation. */
-    head(key: string): Promise<{
-        exists: boolean;
-        generation?: string;
-    }>;
-    /** Write an object only when there is none (ifGenerationMatch=0): true when this write made it, false when one was there. */
-    putIfAbsent(key: string, body: string, contentType: string): Promise<boolean>;
-    /** Delete an object's live generation. One that is not there is deleted already. */
-    remove(key: string): Promise<void>;
-}
-export {};
+/**
+ * The Google Cloud Storage client a gcs backend's state uses: chant core's
+ * (#4554, `@intentius/chant/object-store`), over the JSON API with `fetch`
+ * and `node:crypto`. Writes are conditional on a generation
+ * (`ifGenerationMatch`); a lost write is a 412, a StoreConflict.
+ */
+export { GCS_ENDPOINT, GcsClient, IAM_CREDENTIALS, selfSignedJwt, type GcsTarget } from "@intentius/chant/object-store";
 //# sourceMappingURL=gcs.d.ts.map

package/dist/state/gcs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcs.d.ts","sourceRoot":"","sources":["../../src/state/gcs.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAyD,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAExG,eAAO,MAAM,YAAY,mCAAmC,CAAC;AAC7D,qFAAqF;AACrF,eAAO,MAAM,eAAe,0CAA0C,CAAC;AAIvE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAWD,UAAU,iBAAiB;IACzB,IAAI,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAKvE;AAgBD,qBAAa,SAAS;IAIR,QAAQ,CAAC,MAAM,EAAE,SAAS;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA6B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHtH,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,KAAK,CAAC,CAAiB;IAE/B,YAAqB,MAAM,EAAE,SAAS,EAAmB,OAAO,GAAE,UAAyB,EAAmB,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAwC,EAAI;IAEtL,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;YAcL,IAAI;IAWlB,uEAAuE;YACzD,YAAY;YA2BZ,eAAe;IAO7B,qGAAqG;YACvF,QAAQ;IAoBtB,gHAAgH;YAClG,GAAG;IAMjB,0EAA0E;YAC5D,MAAM;IAiBpB,OAAO,CAAC,SAAS;IAIjB,0IAA0I;IACpI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnG;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKlD;IAED,wFAAwF;IAClF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAYzE;IAED,6HAA6H;IACvH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;IAED,oFAAoF;IAC9E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvC;CACF"}
+{"version":3,"file":"gcs.d.ts","sourceRoot":"","sources":["../../src/state/gcs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/state/gcs.js

@@ -1,224 +1,7 @@
 /**
- * Google Cloud Storage for a gcs backend's state, over its JSON API with
- * `fetch` and `node:crypto`: an object's text and generation, a write, a
- * write only when there is no object (the lock), and a delete.
- *
- * The identity, first match wins: a bearer token (`access_token`, or
- * GOOGLE_OAUTH_ACCESS_TOKEN), else a credentials file or its JSON:
- *
- *   external_account  the job's OIDC token, traded at Google's STS, then the
- *                     service account it impersonates.
- *   service_account   a key: requests carry a self-signed JWT.
- *
- * With `impersonate_service_account`, every request carries that service
- * account's token, which the identity asks IAM for.
- *
- * Lifted from terragucci's `report/gcs.ts` (c493e0e), without signed URLs,
- * version listing and the re-plan's traded tokens.
+ * The Google Cloud Storage client a gcs backend's state uses: chant core's
+ * (#4554, `@intentius/chant/object-store`), over the JSON API with `fetch`
+ * and `node:crypto`. Writes are conditional on a generation
+ * (`ifGenerationMatch`); a lost write is a 412, a StoreConflict.
  */
-import { createSign } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { defaultFetch, encodeStrict, StoreConflict, StoreError } from "./object-store.js";
-export const GCS_ENDPOINT = "https://storage.googleapis.com";
-/** IAM Credentials, where a token for an impersonated service account comes from. */
-export const IAM_CREDENTIALS = "https://iamcredentials.googleapis.com";
-const CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";
-const READ_WRITE = "https://www.googleapis.com/auth/devstorage.read_write";
-const b64url = (b) => Buffer.from(b).toString("base64url");
-/** A JWT the key signs for itself, which Google's APIs take as an access token for the scope it names. */
-export function selfSignedJwt(key, now) {
-    const iat = Math.floor(now.getTime() / 1000);
-    const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT", ...(key.private_key_id ? { kid: key.private_key_id } : {}) }));
-    const body = b64url(JSON.stringify({ iss: key.client_email, sub: key.client_email, scope: READ_WRITE, iat, exp: iat + 3600 }));
-    return `${head}.${body}.${createSign("RSA-SHA256").update(`${head}.${body}`).sign(key.private_key).toString("base64url")}`;
-}
-/** Google's error message, or the start of the body. */
-const why = (text) => {
-    try {
-        const j = JSON.parse(text);
-        if (typeof j.error === "object" && j.error?.message)
-            return j.error.message;
-        if (typeof j.error === "string")
-            return [j.error, j.error_description].filter(Boolean).join(": ");
-    }
-    catch {
-        // Not JSON.
-    }
-    return text.slice(0, 300);
-};
-export class GcsClient {
-    constructor(target, fetchFn = defaultFetch, readFile = (f) => readFileSync(f, "utf-8")) {
-        this.target = target;
-        this.fetchFn = fetchFn;
-        this.readFile = readFile;
-    }
-    where(key) {
-        return `gs://${this.target.bucket}/${key}`;
-    }
-    credentials() {
-        if (this.creds)
-            return this.creds;
-        const source = this.target.credentialsFile ?? "the backend's credentials";
-        let c;
-        try {
-            c = JSON.parse(this.target.credentialsJson ?? this.readFile(this.target.credentialsFile ?? ""));
-        }
-        catch (e) {
-            throw new StoreError(`cannot read the credentials in ${source}: ${e.message}`);
-        }
-        if (c.type === "external_account" && c.token_url && c.audience && c.credential_source && (c.credential_source.file || c.credential_source.url))
-            return (this.creds = c);
-        if (c.type === "service_account" && c.client_email && c.private_key)
-            return (this.creds = c);
-        throw new StoreError(`${source} is not an external_account file with a credential_source file or url, nor a service_account key`);
-    }
-    async post(url, headers, body, what) {
-        const res = await this.fetchFn(url, { method: "POST", headers, body });
-        const text = await res.text();
-        if (!res.ok)
-            throw new StoreError(`${what}: ${res.status} ${why(text)}`);
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            throw new StoreError(`${what}: the answer is not JSON`);
-        }
-    }
-    /** The job's OIDC token, from the file or URL the credentials name. */
-    async subjectToken(c) {
-        const src = c.credential_source;
-        let text;
-        if (src.file) {
-            try {
-                text = this.readFile(src.file);
-            }
-            catch (e) {
-                throw new StoreError(`cannot read the OIDC token in ${src.file}: ${e.message}`);
-            }
-        }
-        else {
-            const res = await this.fetchFn(src.url, { method: "GET", headers: src.headers ?? {} });
-            text = await res.text();
-            if (!res.ok)
-                throw new StoreError(`the OIDC token at ${src.url.split("?")[0]}: ${res.status} ${why(text)}`);
-        }
-        const field = src.format?.type === "json" ? src.format.subject_token_field_name : undefined;
-        let token = text.trim();
-        if (field) {
-            try {
-                token = String(JSON.parse(text)[field] ?? "");
-            }
-            catch {
-                throw new StoreError(`the job's OIDC token is not JSON with ${field}`);
-            }
-        }
-        if (!token)
-            throw new StoreError("the job's OIDC token is empty");
-        return token;
-    }
-    async impersonateWith(url, bearer, sa) {
-        const r = await this.post(url, { "content-type": "application/json", authorization: `Bearer ${bearer}` }, JSON.stringify({ scope: [CLOUD_PLATFORM], lifetime: "3600s" }), `impersonating ${sa}`);
-        if (typeof r.accessToken !== "string")
-            throw new StoreError(`IAM answered the impersonation of ${sa} without a token`);
-        const at = typeof r.expireTime === "string" ? Date.parse(r.expireTime) : NaN;
-        return { token: r.accessToken, expires: Number.isNaN(at) ? Date.now() + 3600000 : at };
-    }
-    /** STS's federated token, then the impersonated service account's, when the credentials name one. */
-    async exchange(c) {
-        const sts = await this.post(c.token_url, { "content-type": "application/x-www-form-urlencoded" }, new URLSearchParams({
-            grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
-            audience: c.audience,
-            scope: CLOUD_PLATFORM,
-            requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
-            subject_token: await this.subjectToken(c),
-            subject_token_type: c.subject_token_type,
-        }).toString(), `Google STS refused the OIDC token for ${c.audience}`);
-        if (typeof sts.access_token !== "string")
-            throw new StoreError("Google STS answered without a token");
-        const fed = { token: sts.access_token, expires: Date.now() + Number(sts.expires_in ?? 3600) * 1000 };
-        if (!c.service_account_impersonation_url)
-            return fed;
-        return this.impersonateWith(c.service_account_impersonation_url, fed.token, "the service account");
-    }
-    /** The identity's own token: the one the target gives, a key's self-signed JWT, or STS's for the OIDC token. */
-    async own() {
-        if (this.target.accessToken)
-            return { token: this.target.accessToken, expires: Date.now() + 3600000 };
-        const c = this.credentials();
-        return c.type === "service_account" ? { token: selfSignedJwt(c, new Date()), expires: Date.now() + 3600000 } : this.exchange(c);
-    }
-    /** An access token: once per client, again a minute before it expires. */
-    async bearer() {
-        const sa = this.target.impersonate;
-        const fresh = async () => {
-            if (!sa)
-                return this.own();
-            const base = await this.own();
-            return this.impersonateWith(`${(this.target.iamEndpoint ?? IAM_CREDENTIALS).replace(/\/+$/, "")}/v1/projects/-/serviceAccounts/${encodeURIComponent(sa)}:generateAccessToken`, base.token, sa);
-        };
-        const again = () => (this.token = fresh().catch((e) => {
-            this.token = undefined;
-            throw e;
-        }));
-        let held = await (this.token ?? again());
-        if (held.expires - Date.now() < 60000)
-            held = await again();
-        return held.token;
-    }
-    objectUrl(key) {
-        return `${this.target.endpoint}/storage/v1/b/${encodeURIComponent(this.target.bucket)}/o/${encodeStrict(key)}`;
-    }
-    /** Write an object; with `ifGenerationMatch`, only when the object still has that generation (`0`: there is none), else StoreConflict. */
-    async put(key, body, contentType, ifGenerationMatch) {
-        const t = this.target;
-        const url = `${t.endpoint}/upload/storage/v1/b/${encodeURIComponent(t.bucket)}/o?uploadType=media&name=${encodeStrict(key)}${ifGenerationMatch !== undefined ? `&ifGenerationMatch=${encodeStrict(ifGenerationMatch)}` : ""}`;
-        const res = await this.fetchFn(url, { method: "POST", headers: { "content-type": contentType, authorization: `Bearer ${await this.bearer()}` }, body });
-        if (res.status === 412)
-            throw new StoreConflict(`PUT ${this.where(key)}: 412, it changed since it was read`);
-        if (!res.ok)
-            throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-    }
-    async get(key) {
-        const res = await this.fetchFn(`${this.objectUrl(key)}?alt=media`, { method: "GET", headers: { authorization: `Bearer ${await this.bearer()}` } });
-        if (res.status === 404)
-            return undefined;
-        if (!res.ok)
-            throw new StoreError(`GET ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-        return res.text();
-    }
-    /** An object's metadata and never its body: whether it is there, and its generation. */
-    async head(key) {
-        const res = await this.fetchFn(this.objectUrl(key), { method: "GET", headers: { authorization: `Bearer ${await this.bearer()}` } });
-        const text = await res.text();
-        if (res.status === 404)
-            return { exists: false };
-        if (!res.ok)
-            throw new StoreError(`GET ${this.where(key)} metadata: ${res.status} ${why(text)}`);
-        let g;
-        try {
-            g = JSON.parse(text).generation;
-        }
-        catch {
-            // Metadata that is not JSON: no generation.
-        }
-        return { exists: true, ...(g !== undefined && g !== null && g !== "" ? { generation: String(g) } : {}) };
-    }
-    /** Write an object only when there is none (ifGenerationMatch=0): true when this write made it, false when one was there. */
-    async putIfAbsent(key, body, contentType) {
-        try {
-            await this.put(key, body, contentType, "0");
-            return true;
-        }
-        catch (e) {
-            if (e instanceof StoreConflict)
-                return false;
-            throw e;
-        }
-    }
-    /** Delete an object's live generation. One that is not there is deleted already. */
-    async remove(key) {
-        const res = await this.fetchFn(this.objectUrl(key), { method: "DELETE", headers: { authorization: `Bearer ${await this.bearer()}` } });
-        if (!res.ok && res.status !== 404)
-            throw new StoreError(`DELETE ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-    }
-}
+export { GCS_ENDPOINT, GcsClient, IAM_CREDENTIALS, selfSignedJwt } from "@intentius/chant/object-store";

package/dist/state/object-store.d.ts

@@ -1,37 +1,8 @@
 /**
  * What the state stores share: the fetch they call, their errors, and how a
- * key goes into a URL. Lifted from terragucci's `report/object-store.ts`
- * (c493e0e), cut to what a state's lock and write need.
+ * key goes into a URL. Since #4554 these are chant core's object-store
+ * definitions (`@intentius/chant/object-store`), so a store error thrown by
+ * a core client is the one a state caller catches.
  */
-export type StoreFetch = (url: string, init: {
-    method: string;
-    headers: Record<string, string>;
-    body?: string | Uint8Array;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    text(): Promise<string>;
-    /** A store that sends no headers (or a test's fake) gets no conditional writes. */
-    headers?: {
-        get(name: string): string | null;
-    };
-}>;
-export declare class StoreError extends Error {
-}
-/** A conditional write that lost: the object changed (412) or another write to it was in flight (409). */
-export declare class StoreConflict extends StoreError {
-}
-/** A condition on a write: the version the object must still have, or `*` for "there is no object yet". */
-export type StoreCondition = {
-    ifMatch: string;
-} | {
-    ifNoneMatch: "*";
-};
-/** A key as a URL path: each segment percent-encoded the strict way (RFC 3986), the slashes kept. */
-export declare const encodePath: (key: string) => string;
-export declare const encodeStrict: (v: string) => string;
-/** The first value of an XML element, unescaped. Enough for the small answers these stores send. */
-export declare const xmlText: (xml: string, tag: string) => string | undefined;
-/** The global fetch, as a StoreFetch. */
-export declare const defaultFetch: StoreFetch;
+export { defaultFetch, encodePath, encodeStrict, StoreConflict, StoreError, xmlText, type StoreCondition, type StoreFetch } from "@intentius/chant/object-store";
 //# sourceMappingURL=object-store.d.ts.map

package/dist/state/object-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-store.d.ts","sourceRoot":"","sources":["../../src/state/object-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,KAAK,OAAO,CAAC;IACvI,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,mFAAmF;IACnF,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAChD,CAAC,CAAC;AAEH,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,0GAA0G;AAC1G,qBAAa,aAAc,SAAQ,UAAU;CAAG;AAEhD,2GAA2G;AAC3G,MAAM,MAAM,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,GAAG,CAAA;CAAE,CAAC;AAExE,qGAAqG;AACrG,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,MAAoD,CAAC;AAE9F,eAAO,MAAM,YAAY,MAAO,MAAM,KAAG,MAA4G,CAAC;AAEtJ,oGAAoG;AACpG,eAAO,MAAM,OAAO,QAAS,MAAM,OAAO,MAAM,KAAG,MAAM,GAAG,SAG3D,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,YAAY,EAAE,UAA2D,CAAC"}
+{"version":3,"file":"object-store.d.ts","sourceRoot":"","sources":["../../src/state/object-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/state/object-store.js

@@ -1,20 +1,7 @@
 /**
  * What the state stores share: the fetch they call, their errors, and how a
- * key goes into a URL. Lifted from terragucci's `report/object-store.ts`
- * (c493e0e), cut to what a state's lock and write need.
+ * key goes into a URL. Since #4554 these are chant core's object-store
+ * definitions (`@intentius/chant/object-store`), so a store error thrown by
+ * a core client is the one a state caller catches.
  */
-export class StoreError extends Error {
-}
-/** A conditional write that lost: the object changed (412) or another write to it was in flight (409). */
-export class StoreConflict extends StoreError {
-}
-/** A key as a URL path: each segment percent-encoded the strict way (RFC 3986), the slashes kept. */
-export const encodePath = (key) => key.split("/").map(encodeStrict).join("/");
-export const encodeStrict = (v) => encodeURIComponent(v).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
-/** The first value of an XML element, unescaped. Enough for the small answers these stores send. */
-export const xmlText = (xml, tag) => {
-    const m = new RegExp(`<${tag}>([^<]*)</${tag}>`).exec(xml);
-    return m?.[1].replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&").trim();
-};
-/** The global fetch, as a StoreFetch. */
-export const defaultFetch = (url, init) => fetch(url, init);
+export { defaultFetch, encodePath, encodeStrict, StoreConflict, StoreError, xmlText } from "@intentius/chant/object-store";