@kutur-kit/assets 0.0.0-stage → 0.1.0-alpha.1

package/dist/internal/http.d.ts

@@ -0,0 +1,17 @@
+import type * as AssetBucket from "../AssetBucket.ts";
+import { Effect, Option } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+/** The routes' prefix and wildcard path under a base URL, absolute or not. */
+export declare const mount: (baseUrl: string) => {
+    prefix: string;
+    path: `/${string}/*`;
+};
+/** The current request's key under the prefix, and its query; no key for a malformed path. */
+export declare const target: (prefix: string) => Effect.Effect<{
+    request: HttpServerRequest.HttpServerRequest;
+    key: Option.Option<string>;
+    query: import("node:url").URLSearchParams;
+}, never, HttpServerRequest.HttpServerRequest>;
+/** Serves a stored object with its type, length and cache control, or 404. */
+export declare const respond: (bucket: AssetBucket.Bucket, key: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, AssetBucket.AssetBucketError, never>;
+//# sourceMappingURL=http.d.ts.map

package/dist/internal/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sources":["../../src/internal/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE,8EAA8E;AAC9E,eAAO,MAAM,KAAK,YAAa,MAAM;;;CAIpC,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,MAAM,WAAY,MAAM;;;;8CAajC,CAAC;AASL,8EAA8E;AAC9E,eAAO,MAAM,OAAO,WAAY,WAAW,CAAC,MAAM,OAAO,MAAM,8FAiB5D,CAAC"}

package/dist/internal/http.js

@@ -0,0 +1,38 @@
+import { Effect, Option } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+/** The routes' prefix and wildcard path under a base URL, absolute or not. */
+export const mount = (baseUrl) => {
+    const prefix = new URL(baseUrl, "http://localhost").pathname.replace(/\/$/u, "");
+    return { prefix, path: `/${prefix.slice(1)}/*` };
+};
+/** The current request's key under the prefix, and its query; no key for a malformed path. */
+export const target = (prefix) => Effect.map(HttpServerRequest.HttpServerRequest, (request) => {
+    const url = new URL(request.url, "http://localhost");
+    const key = Option.liftThrowable(() => url.pathname
+        .slice(prefix.length + 1)
+        .split("/")
+        .map(decodeURIComponent)
+        .join("/"))();
+    return { request, key, query: url.searchParams };
+});
+// Objects are served from the app's origin in development. Even a file a
+// browser would read as something else must not be sniffed or run.
+const inert = {
+    "x-content-type-options": "nosniff",
+    "content-security-policy": "default-src 'none'; sandbox",
+};
+/** Serves a stored object with its type, length and cache control, or 404. */
+export const respond = (bucket, key) => Effect.map(bucket.get(key), Option.match({
+    onNone: () => HttpServerResponse.empty({ status: 404 }),
+    onSome: ({ info, body }) => {
+        const response = HttpServerResponse.stream(body, {
+            contentType: info.contentType,
+            contentLength: Number(info.size),
+            headers: inert,
+        });
+        return info.cacheControl === undefined
+            ? response
+            : HttpServerResponse.setHeader(response, "cache-control", info.cacheControl);
+    },
+}));
+//# sourceMappingURL=http.js.map

package/dist/internal/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sources":["../../src/internal/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAa,EAAE,CAAC;AAC5D,CAAC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CACvC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAErD,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CACpC,GAAG,CAAC,QAAQ;SACT,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,kBAAkB,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CACb,EAAE,CAAC;IAEJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;AACnD,CAAC,CAAC,CAAC;AAEL,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,KAAK,GAAG;IACZ,wBAAwB,EAAE,SAAS;IACnC,yBAAyB,EAAE,6BAA6B;CACzD,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAE,EAAE,CACjE,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EACf,MAAM,CAAC,KAAK,CAAC;IACX,MAAM,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACvD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACjF,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/internal/sigv4.d.ts

@@ -0,0 +1,15 @@
+import type * as AssetSigning from "../AssetSigning.ts";
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import { Effect } from "effect";
+/** Where signed URLs point: path-style, `${endpoint}/${bucket}/${key}`. */
+export interface Target {
+    readonly endpoint: string;
+    readonly bucket: string;
+}
+/**
+ * Signs with SigV4 for the S3 API. The target and the `Credentials` are
+ * resolved for each request, so stores that deliver them at runtime, such as
+ * alchemy's R2 bindings, can sign too.
+ */
+export declare const make: <R>(bucketId: string, target: Effect.Effect<Target, never, R>) => Effect.Effect<AssetSigning.Signing, never, Credentials.Credentials | R>;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/internal/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sources":["../../src/internal/sigv4.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,WAAW,MAAM,kCAAkC,CAAC;AAGhE,OAAO,EAA6B,MAAM,EAAE,MAAM,QAAQ,CAAC;AAK3D,2EAA2E;AAC3E,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAKD;;;;GAIG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,YACV,MAAM,UACR,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KACtC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,WAAW,GAAG,CAAC,CAwDrE,CAAC"}

package/dist/internal/sigv4.js

@@ -0,0 +1,52 @@
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import * as Presign from "@distilled.cloud/aws/Presign";
+import * as Region from "@distilled.cloud/aws/Region";
+import { Clock, DateTime, Duration, Effect } from "effect";
+import * as AssetBucket from "../AssetBucket.js";
+import { encodeKey } from "./url.js";
+// The longest S3 allows for a presigned URL.
+const maxExpiry = Duration.days(7);
+/**
+ * Signs with SigV4 for the S3 API. The target and the `Credentials` are
+ * resolved for each request, so stores that deliver them at runtime, such as
+ * alchemy's R2 bindings, can sign too.
+ */
+export const make = (bucketId, target) => Effect.map(Effect.context(), (context) => {
+    const sign = (method, key, expiresIn, signed) => Effect.gen(function* () {
+        const { endpoint, bucket } = yield* target;
+        const credentials = yield* yield* Credentials.Credentials;
+        const now = yield* Clock.currentTimeMillis;
+        const seconds = Math.ceil(Duration.toMillis(Duration.min(expiresIn, maxExpiry)) / 1000);
+        const url = yield* Presign.presignUrl({
+            method,
+            url: `${endpoint.replace(/\/+$/u, "")}/${bucket}/${encodeKey(key)}`,
+            service: "s3",
+            region: credentials.region,
+            expiresIn: seconds,
+            headers: signed,
+            // The signing time comes from Effect's clock, as the expiry does.
+            datetime: new Date(now).toISOString().replace(/[-:]|\.\d{3}/gu, ""),
+        }).pipe(Effect.provideService(Region.Region, Effect.succeed(credentials.region)));
+        return {
+            method,
+            url,
+            // Browsers set Content-Length from the body; the rest is sent as given.
+            headers: Object.fromEntries(Object.entries(signed).filter(([name]) => name !== "content-length")),
+            expiresAt: DateTime.makeUnsafe(now + seconds * 1000),
+        };
+    }).pipe(Effect.provideContext(context), Effect.mapError((cause) => new AssetBucket.AssetBucketError({ operation: "sign", bucket: bucketId, key, cause })));
+    return {
+        // Content-Length is signed: without it, the storage accepts any size.
+        // `If-None-Match: *` makes the URL write-once: replayed after its
+        // upload, even with other bytes of the same length, it is refused.
+        signPut: ({ key, contentType, contentLength, cacheControl, expiresIn }) => sign("PUT", key, expiresIn, {
+            "content-type": contentType,
+            "content-length": String(contentLength),
+            "if-none-match": "*",
+            // Signed, or browsers' `no-cache` for conditional requests is stored.
+            "cache-control": cacheControl,
+        }),
+        signGet: ({ key, expiresIn }) => sign("GET", key, expiresIn, {}),
+    };
+});
+//# sourceMappingURL=sigv4.js.map

package/dist/internal/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sources":["../../src/internal/sigv4.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,WAAW,MAAM,kCAAkC,CAAC;AAChE,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE3D,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQrC,6CAA6C;AAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,QAAgB,EAChB,MAAuC,EACkC,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAA+B,EAAE,CAAC,OAAO,EAAE,EAAE;IACpE,MAAM,IAAI,GAAG,CACX,MAAqB,EACrB,GAAW,EACX,SAA4B,EAC5B,MAAwC,EACxC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACpC,MAAM;YACN,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE;YACnE,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;YACf,kEAAkE;YAClE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SACpE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAElF,OAAO;YACL,MAAM;YACN,GAAG;YACH,wEAAwE;YACxE,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CACrE;YACD,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC;SACrD,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CACxF,CACF,CAAC;IAEJ,OAAO;QACL,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CACxE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1B,cAAc,EAAE,WAAW;YAC3B,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;YACvC,eAAe,EAAE,GAAG;YACpB,sEAAsE;YACtE,eAAe,EAAE,YAAY;SAC9B,CAAC;QACJ,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/internal/url.d.ts

@@ -0,0 +1,3 @@
+/** A key in a URL path: segments encoded, slashes kept. */
+export declare const encodeKey: (key: string) => string;
+//# sourceMappingURL=url.d.ts.map

package/dist/internal/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,eAAO,MAAM,SAAS,QAAS,MAAM,WAAqD,CAAC"}

package/dist/internal/url.js

@@ -0,0 +1,3 @@
+/** A key in a URL path: segments encoded, slashes kept. */
+export const encodeKey = (key) => key.split("/").map(encodeURIComponent).join("/");
+//# sourceMappingURL=url.js.map

package/dist/internal/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/dist/memory.d.ts

@@ -0,0 +1,11 @@
+import type * as Asset from "./Asset.ts";
+import type * as AssetBucket from "./AssetBucket.ts";
+import { Layer } from "effect";
+/**
+ * Backs a bucket with memory for the lifetime of the layer. Bodies are copied
+ * in and out, so callers cannot change stored bytes.
+ */
+export declare const layer: <Self, Id extends string>(bucket: AssetBucket.Tag<Self, Id>) => Layer.Layer<Self>;
+/** Backs the buckets of the given assets with memory, one store per bucket. */
+export declare const toLayer: <const Assets extends ReadonlyArray<Asset.Any>>(assets: Assets) => Layer.Layer<Asset.BucketOf<Assets[number]>>;
+//# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAoB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AASjE;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,IAAI,EAAE,EAAE,SAAS,MAAM,UACnC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,KAChC,KAAK,CAAC,KAAK,CAAC,IAAI,CA8Bf,CAAC;AAEL,+EAA+E;AAC/E,eAAO,MAAM,OAAO,GAAI,KAAK,CAAC,MAAM,SAAS,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,UAC3D,MAAM,KACb,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAW5C,CAAC"}

package/dist/memory.js

@@ -0,0 +1,34 @@
+import { ByteSize, Effect, Layer, Option, Stream } from "effect";
+import { concat } from "./internal/bytes.js";
+/**
+ * Backs a bucket with memory for the lifetime of the layer. Bodies are copied
+ * in and out, so callers cannot change stored bytes.
+ */
+export const layer = (bucket) => Layer.sync(bucket, () => {
+    const objects = new Map();
+    return bucket.of({
+        put: ({ key, contentType, cacheControl, body }) => Stream.runCollect(body).pipe(Effect.map((chunks) => {
+            const bytes = concat(chunks);
+            const info = { size: ByteSize.bytes(bytes.length), contentType, cacheControl };
+            objects.set(key, { info, bytes });
+            return info;
+        })),
+        get: (key) => Effect.sync(() => Option.map(Option.fromUndefinedOr(objects.get(key)), ({ info, bytes }) => ({
+            info,
+            body: Stream.succeed(bytes.slice()),
+        }))),
+        head: (key) => Effect.sync(() => Option.map(Option.fromUndefinedOr(objects.get(key)), ({ info }) => info)),
+        delete: (key) => Effect.sync(() => {
+            objects.delete(key);
+        }),
+    });
+});
+/** Backs the buckets of the given assets with memory, one store per bucket. */
+export const toLayer = (assets) => {
+    // SAFETY: asset buckets are tags from AssetBucket.Service.
+    const buckets = new Set(assets.map((asset) => asset.bucket));
+    const merged = [...buckets].reduce((layers, bucket) => Layer.merge(layers, layer(bucket)), Layer.empty);
+    // SAFETY: the merged layers provide exactly the buckets of the listed assets.
+    return merged;
+};
+//# sourceMappingURL=memory.js.map

package/dist/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sources":["../src/memory.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAO7C;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAiC,EACd,EAAE,CACrB,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEzC,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;YAE/E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAElC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH;QACH,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACf,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACzE,IAAI;YACJ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;SACpC,CAAC,CAAC,CACJ;QACH,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7F,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,+EAA+E;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAc,EAC+B,EAAE;IAC/C,2DAA2D;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAkC,CAAC,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAChC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EACtD,KAAK,CAAC,KAAK,CACZ,CAAC;IAEF,8EAA8E;IAC9E,OAAO,MAAqD,CAAC;AAC/D,CAAC,CAAC"}

package/dist/s3.d.ts

@@ -0,0 +1,42 @@
+import type * as AssetSigning from "./AssetSigning.ts";
+import type * as Credentials from "@distilled.cloud/aws/Credentials";
+import type * as HttpClient from "effect/http/HttpClient";
+import { Layer } from "effect";
+import * as AssetBucket from "./AssetBucket.ts";
+export interface Options {
+    /** The bucket's name in the storage. */
+    readonly bucket: string;
+}
+export interface SigningOptions extends Options {
+    /**
+     * Where clients reach the storage, such as
+     * `https://<account>.r2.cloudflarestorage.com` or `http://localhost:9000`.
+     * Signed URLs are path-style under it: `${endpoint}/${bucket}/${key}`.
+     */
+    readonly endpoint: string;
+}
+type Requirements = Credentials.Credentials | HttpClient.HttpClient;
+/**
+ * Backs a bucket with S3 or a store with its API, such as R2 or RustFS,
+ * through `@distilled.cloud/aws`. Provide its `Credentials` and an
+ * `HttpClient`, and an `Endpoint` for stores other than AWS.
+ *
+ * Bodies are collected before they are sent, so a failing body sends nothing.
+ * Uploads through the app are small by `maxSize`; larger files go to storage
+ * directly, through `signing`.
+ */
+export declare const layer: <Self, Id extends string>(bucket: AssetBucket.Tag<Self, Id>, options: Options) => Layer.Layer<Self, never, Requirements>;
+/**
+ * Signs URLs for a bucket with SigV4, for clients to upload to and download
+ * from the storage directly. Uploads are signed with their content type and
+ * length, the cache control to store, and to create an object only, which
+ * the storage enforces.
+ */
+export declare const signing: <Self, Id extends string>(bucket: AssetBucket.Tag<Self, Id>, options: SigningOptions) => Layer.Layer<AssetSigning.SigningOf<Self>, never, Credentials.Credentials>;
+/**
+ * R2's S3 endpoint for an account, for `signing` and an S3 `Endpoint`.
+ * Requests to it are signed for the region `auto`.
+ */
+export declare const r2Endpoint: (accountId: string, jurisdiction?: "eu" | "fedramp") => string;
+export {};
+//# sourceMappingURL=s3.d.ts.map

package/dist/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sources":["../src/s3.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,YAAY,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,KAAK,WAAW,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAoB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAKhD,MAAM,WAAW,OAAO;IACtB,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,OAAO;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,KAAK,YAAY,GAAG,WAAW,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AAOpE;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,GAAI,IAAI,EAAE,EAAE,SAAS,MAAM,UACnC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,WACxB,OAAO,KACf,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAyErC,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAI,IAAI,EAAE,EAAE,SAAS,MAAM,UACrC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,WACxB,cAAc,KACtB,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,WAAW,CACkB,CAAC;AAE9F;;;GAGG;AACH,eAAO,MAAM,UAAU,cAAe,MAAM,iBAAiB,IAAI,GAAG,SAAS,WAC2B,CAAC"}

package/dist/s3.js

@@ -0,0 +1,67 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import { ByteSize, Effect, Layer, Option, Stream } from "effect";
+import * as AssetBucket from "./AssetBucket.js";
+import * as AssetSigningModule from "./AssetSigning.js";
+import { concat } from "./internal/bytes.js";
+import * as SigV4 from "./internal/sigv4.js";
+const failure = (bucket, operation, key) => (cause) => new AssetBucket.AssetBucketError({ operation, bucket, key, cause });
+/**
+ * Backs a bucket with S3 or a store with its API, such as R2 or RustFS,
+ * through `@distilled.cloud/aws`. Provide its `Credentials` and an
+ * `HttpClient`, and an `Endpoint` for stores other than AWS.
+ *
+ * Bodies are collected before they are sent, so a failing body sends nothing.
+ * Uploads through the app are small by `maxSize`; larger files go to storage
+ * directly, through `signing`.
+ */
+export const layer = (bucket, options) => Layer.effect(bucket, Effect.gen(function* () {
+    // S3 reads the optional `Endpoint` and `Region` when called, so the
+    // whole context is kept, not just the required services.
+    const context = yield* Effect.context();
+    const Bucket = options.bucket;
+    const fail = (operation, key) => failure(bucket.id, operation, key);
+    return bucket.of({
+        put: ({ key, contentType, cacheControl, body }) => Effect.gen(function* () {
+            const bytes = concat(yield* Stream.runCollect(body));
+            const request = {
+                Bucket,
+                Key: key,
+                Body: bytes,
+                ContentType: contentType,
+            };
+            if (cacheControl !== undefined)
+                request.CacheControl = cacheControl;
+            yield* S3.putObject(request).pipe(Effect.provideContext(context), Effect.mapError(fail("put", key)));
+            return { size: ByteSize.bytes(bytes.length), contentType, cacheControl };
+        }),
+        get: (key) => S3.getObject({ Bucket, Key: key }).pipe(Effect.map((object) => Option.some({
+            info: {
+                size: ByteSize.bytes(object.ContentLength ?? 0),
+                contentType: object.ContentType ?? "application/octet-stream",
+                cacheControl: object.CacheControl,
+            },
+            body: object.Body === undefined
+                ? Stream.empty
+                : Stream.mapError(object.Body, fail("get", key)),
+        })), Effect.catchTag("NoSuchKey", () => Effect.succeedNone), Effect.provideContext(context), Effect.mapError(fail("get", key))),
+        head: (key) => S3.headObject({ Bucket, Key: key }).pipe(Effect.map((object) => Option.some({
+            size: ByteSize.bytes(object.ContentLength ?? 0),
+            contentType: object.ContentType ?? "application/octet-stream",
+            cacheControl: object.CacheControl,
+        })), Effect.catchTag("NotFound", () => Effect.succeedNone), Effect.provideContext(context), Effect.mapError(fail("head", key))),
+        delete: (key) => S3.deleteObject({ Bucket, Key: key }).pipe(Effect.asVoid, Effect.provideContext(context), Effect.mapError(fail("delete", key))),
+    });
+}));
+/**
+ * Signs URLs for a bucket with SigV4, for clients to upload to and download
+ * from the storage directly. Uploads are signed with their content type and
+ * length, the cache control to store, and to create an object only, which
+ * the storage enforces.
+ */
+export const signing = (bucket, options) => Layer.effect(AssetSigningModule.of(bucket), SigV4.make(bucket.id, Effect.succeed(options)));
+/**
+ * R2's S3 endpoint for an account, for `signing` and an S3 `Endpoint`.
+ * Requests to it are signed for the region `auto`.
+ */
+export const r2Endpoint = (accountId, jurisdiction) => `https://${accountId}.${jurisdiction === undefined ? "" : `${jurisdiction}.`}r2.cloudflarestorage.com`;
+//# sourceMappingURL=s3.js.map

package/dist/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sources":["../src/s3.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,kBAAkB,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAkB7C,MAAM,OAAO,GACX,CAAC,MAAc,EAAE,SAAoD,EAAE,GAAW,EAAE,EAAE,CACtF,CAAC,KAAc,EAAE,EAAE,CACjB,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAiC,EACjC,OAAgB,EACwB,EAAE,CAC1C,KAAK,CAAC,MAAM,CACV,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAgB,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,SAAoD,EAAE,GAAW,EAAE,EAAE,CACjF,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAErC,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAErD,MAAM,OAAO,GAAwB;gBACnC,MAAM;gBACN,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,WAAW;aACzB,CAAC;YAEF,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;YAEpE,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAClC,CAAC;YAEF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QAC3E,CAAC,CAAC;QACJ,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC/C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,0BAA0B;gBAC7D,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC;YACD,IAAI,EACF,MAAM,CAAC,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SACrD,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACtD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAClC;QACH,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC/C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,0BAA0B;YAC7D,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CACnC;QACH,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CACrC;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAiC,EACjC,OAAuB,EACoD,EAAE,CAC7E,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE9F;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,YAA+B,EAAE,EAAE,CAC/E,WAAW,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,0BAA0B,CAAC"}

package/dist/signing/local.d.ts

@@ -0,0 +1,27 @@
+import type * as AssetBucket from "../AssetBucket.ts";
+import { Layer, Redacted } from "effect";
+import { HttpRouter } from "effect/http";
+import * as AssetSigning from "../AssetSigning.ts";
+export interface Options {
+    /**
+     * Where `routes` are mounted, such as `/storage/private` or
+     * `http://localhost:3000/storage/private`. Signed URLs start with it.
+     */
+    readonly baseUrl: string;
+    /** Signs URLs. Changing it invalidates URLs already handed out. */
+    readonly secret: Redacted.Redacted<string>;
+}
+/**
+ * Signs URLs for a bucket with an HMAC, for development, tests or a single
+ * self-hosted server. `routes` verifies them, so storage needs no signing.
+ */
+export declare const layer: <Self, Id extends string>(bucket: AssetBucket.Tag<Self, Id>, options: Options) => Layer.Layer<AssetSigning.SigningOf<Self>>;
+/**
+ * Accepts signed uploads and serves signed downloads of a bucket under
+ * `baseUrl`. Refuses a request that differs from what was signed: another
+ * method, key, content type, length or cache control, or one sent after it
+ * expires. An upload to a key that already holds an object is refused with
+ * 412.
+ */
+export declare const routes: <Self, Id extends string>(bucket: AssetBucket.Tag<Self, Id>, options: Options) => Layer.Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request.From<"Requires", Exclude<Self, HttpRouter.Provided>>>;
+//# sourceMappingURL=local.d.ts.map

package/dist/signing/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sources":["../../src/signing/local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAML,KAAK,EAEL,QAAQ,EAET,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAC;AAInD,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC5C;AAkDD;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,IAAI,EAAE,EAAE,SAAS,MAAM,UACnC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,WACxB,OAAO,KACf,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAsC1C,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,GAAI,IAAI,EAAE,EAAE,SAAS,MAAM,UACpC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,WACxB,OAAO,+HA0EjB,CAAC"}

package/dist/signing/local.js

@@ -0,0 +1,128 @@
+import { ByteSize, Clock, DateTime, Duration, Effect, Layer, Option, Redacted, Stream, } from "effect";
+import { HttpRouter, HttpServerResponse } from "effect/http";
+import * as AssetSigning from "../AssetSigning.js";
+import { mount, respond, target } from "../internal/http.js";
+import { encodeKey } from "../internal/url.js";
+const hex = (bytes) => Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+// The signature covers everything a client must not change.
+const sign = (secret, signed) => Effect.promise(async () => {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(Redacted.value(secret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const message = [
+        signed.method,
+        signed.key,
+        signed.expires,
+        signed.contentType ?? "",
+        signed.contentLength ?? "",
+        signed.ifNoneMatch ?? "",
+        signed.cacheControl ?? "",
+    ].join("\n");
+    return hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message)));
+});
+// Compares in time independent of where the strings differ.
+const equal = (a, b) => {
+    let difference = a.length ^ b.length;
+    for (let index = 0; index < Math.max(a.length, b.length); index++)
+        difference |= (a.charCodeAt(index) || 0) ^ (b.charCodeAt(index) || 0);
+    return difference === 0;
+};
+/**
+ * Signs URLs for a bucket with an HMAC, for development, tests or a single
+ * self-hosted server. `routes` verifies them, so storage needs no signing.
+ */
+export const layer = (bucket, options) => {
+    const request = (signed, expiresIn) => Effect.gen(function* () {
+        const now = yield* Clock.currentTimeMillis;
+        const expires = Math.ceil((now + Duration.toMillis(expiresIn)) / 1000);
+        const signature = yield* sign(options.secret, { ...signed, expires });
+        const query = new URLSearchParams({ expires: String(expires), signature });
+        const headers = {};
+        if (signed.contentType !== undefined)
+            headers["content-type"] = signed.contentType;
+        if (signed.ifNoneMatch !== undefined)
+            headers["if-none-match"] = signed.ifNoneMatch;
+        if (signed.cacheControl !== undefined)
+            headers["cache-control"] = signed.cacheControl;
+        return {
+            method: signed.method,
+            url: `${options.baseUrl}/${encodeKey(signed.key)}?${query.toString()}`,
+            headers,
+            expiresAt: DateTime.makeUnsafe(expires * 1000),
+        };
+    });
+    return Layer.succeed(AssetSigning.of(bucket), {
+        signPut: ({ key, contentType, contentLength, cacheControl, expiresIn }) => request({
+            method: "PUT",
+            key,
+            contentType,
+            contentLength: String(contentLength),
+            ifNoneMatch: "*",
+            cacheControl,
+        }, expiresIn),
+        signGet: ({ key, expiresIn }) => request({ method: "GET", key }, expiresIn),
+    });
+};
+const refused = HttpServerResponse.text("Forbidden", { status: 403 });
+/**
+ * Accepts signed uploads and serves signed downloads of a bucket under
+ * `baseUrl`. Refuses a request that differs from what was signed: another
+ * method, key, content type, length or cache control, or one sent after it
+ * expires. An upload to a key that already holds an object is refused with
+ * 412.
+ */
+export const routes = (bucket, options) => {
+    const { prefix, path } = mount(options.baseUrl);
+    const verify = (query, signed) => Effect.gen(function* () {
+        const expires = Number(query.get("expires"));
+        const signature = query.get("signature") ?? "";
+        const now = yield* Clock.currentTimeMillis;
+        const expected = yield* sign(options.secret, { ...signed, expires });
+        return now <= expires * 1000 && equal(signature, expected);
+    });
+    const upload = Effect.gen(function* () {
+        const { request, key, query } = yield* target(prefix);
+        const contentType = request.headers["content-type"];
+        const contentLength = request.headers["content-length"];
+        const ifNoneMatch = request.headers["if-none-match"];
+        const cacheControl = request.headers["cache-control"];
+        // The signed length is required, so the body's is checked against it.
+        const length = Option.flatMap(Option.fromUndefinedOr(contentLength), (header) => ByteSize.fromInput(Number(header)));
+        const allowed = Option.isSome(key) &&
+            Option.isSome(length) &&
+            (yield* verify(query, {
+                method: "PUT",
+                key: key.value,
+                contentType,
+                contentLength,
+                ifNoneMatch,
+                cacheControl,
+            }));
+        if (!allowed || Option.isNone(key) || Option.isNone(length))
+            return refused;
+        const store = yield* bucket;
+        // A signed upload writes once, as S3 answers `If-None-Match: *`. Checked
+        // before writing, so two uploads racing to one key may both succeed: these
+        // routes serve development and tests.
+        const existing = yield* store.head(key.value);
+        if (Option.isSome(existing))
+            return HttpServerResponse.text("Precondition Failed", { status: 412 });
+        // Node ends the body at its Content-Length; a client that sends less
+        // fails the stream, so the bucket keeps what it had.
+        yield* store.put({
+            key: key.value,
+            contentType: contentType ?? "",
+            cacheControl,
+            body: Stream.orDie(request.stream),
+            contentLength: length.value,
+        });
+        return HttpServerResponse.empty({ status: 200 });
+    }).pipe(Effect.orDie);
+    const download = Effect.gen(function* () {
+        const { key, query } = yield* target(prefix);
+        const allowed = Option.isSome(key) && (yield* verify(query, { method: "GET", key: key.value }));
+        if (!allowed || Option.isNone(key))
+            return refused;
+        return yield* respond(yield* bucket, key.value);
+    }).pipe(Effect.orDie);
+    return Layer.mergeAll(HttpRouter.add("PUT", path, upload), HttpRouter.add("GET", path, download));
+};
+//# sourceMappingURL=local.js.map

package/dist/signing/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sources":["../../src/signing/local.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,EACN,QAAQ,EACR,MAAM,GACP,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAuB/C,MAAM,GAAG,GAAG,CAAC,KAAkB,EAAE,EAAE,CACjC,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3F,4DAA4D;AAC5D,MAAM,IAAI,GAAG,CAAC,MAAiC,EAAE,MAAc,EAAE,EAAE,CACjE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;IACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,OAAO,GAAG;QACd,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,GAAG;QACV,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,WAAW,IAAI,EAAE;QACxB,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1B,MAAM,CAAC,WAAW,IAAI,EAAE;QACxB,MAAM,CAAC,YAAY,IAAI,EAAE;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEL,4DAA4D;AAC5D,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE;IACrC,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAErC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QAC/D,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAiC,EACjC,OAAgB,EAC2B,EAAE;IAC7C,MAAM,OAAO,GAAG,CAAC,MAA+B,EAAE,SAA4B,EAAE,EAAE,CAChF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAEnF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAEpF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QAEtF,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE;YACtE,OAAO;YACP,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;SAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE;QAC5C,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CACxE,OAAO,CACL;YACE,MAAM,EAAE,KAAK;YACb,GAAG;YACH,WAAW;YACX,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;YACpC,WAAW,EAAE,GAAG;YAChB,YAAY;SACb,EACD,SAAS,CACV;QACH,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC;KAC5E,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,MAAiC,EACjC,OAAgB,EAChB,EAAE;IACF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,MAA+B,EAAE,EAAE,CACzE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,OAAO,GAAG,IAAI,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAC9E,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACnC,CAAC;QAEF,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACrB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,GAAG,CAAC,KAAK;gBACd,WAAW;gBACX,aAAa;gBACb,WAAW;gBACX,YAAY;aACb,CAAC,CAAC,CAAC;QAEN,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC;QAE5E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QAE5B,yEAAyE;QACzE,2EAA2E;QAC3E,sCAAsC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACzB,OAAO,kBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzE,qEAAqE;QACrE,qDAAqD;QACrD,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,WAAW,EAAE,WAAW,IAAI,EAAE;YAC9B,YAAY;YACZ,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QAEH,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEhG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QAEnD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtB,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpG,CAAC,CAAC"}

package/dist/testing/AssetBucketContract.d.ts

@@ -0,0 +1,18 @@
+import { Effect } from "effect";
+import * as AssetBucket from "../AssetBucket.ts";
+declare const ContractBucket_base: AssetBucket.Tag<ContractBucket, "assets-contract">;
+/** The bucket the cases use. Back it with the implementation under test. */
+export declare class ContractBucket extends ContractBucket_base {
+}
+/**
+ * Checks an `AssetBucket.Bucket` implementation against the guarantees it
+ * documents. Cases overwrite or delete the keys they use, under `contract/`.
+ * Run each case with any test runner.
+ */
+export interface Case {
+    readonly name: string;
+    readonly run: Effect.Effect<void, never, ContractBucket>;
+}
+export declare const cases: ReadonlyArray<Case>;
+export {};
+//# sourceMappingURL=AssetBucketContract.d.ts.map

package/dist/testing/AssetBucketContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssetBucketContract.d.ts","sources":["../../src/testing/AssetBucketContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAkC,MAAM,QAAQ,CAAC;AAE1E,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;;AAEjD,4EAA4E;AAC5E,qBAAa,cAAe,SAAQ,mBAAwD;CAAG;AAE/F;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;CAC1D;AAwFD,eAAO,MAAM,KAAK,EAAE,aAAa,CAAC,IAAI,CA+GrC,CAAC"}