@lunora/storage 1.0.0-alpha.11 → 1.0.0-alpha.110

package/dist/upload.d.mts

@@ -1,7 +1,22 @@
+import { BaseStorageOptions } from '@visulima/storage';
+import { R2BucketLike } from '@lunora/platform';
 import { Tus } from '@visulima/storage/handler/http/fetch';
 import { AwsLightStorage } from '@visulima/storage/provider/aws-light';
+/**
+ * An R2 binding with the multipart API: a Worker's `env.BUCKET` (and
+ * miniflare's). The provider also relies on `put`'s `onlyIf` preconditions,
+ * which every R2 binding honors.
+ */
+type R2UploadBucket = R2BucketLike & Required<Pick<R2BucketLike, "createMultipartUpload" | "resumeMultipartUpload">>;
 /** Resumable upload wire protocols the handler can speak. */
 type UploadProtocol = "chunked-rest" | "multipart" | "tus";
+/**
+ * Default ceiling applied to `maxFileSize` when the caller doesn't supply one
+ * (100 MiB). Without SOME cap, an unauthenticated or loosely-authorized
+ * handler accepts an unbounded request body — pass an explicit `maxFileSize`
+ * to raise or lower this for your app.
+ */
+declare const DEFAULT_MAX_UPLOAD_BYTES: number;
 type UploadHandlerOptions = ConstructorParameters<typeof Tus>[0];
 /** A `@visulima/storage` storage provider (e.g. {@link createR2UploadStorage} or a memory provider in tests). */
 type UploadStorage = UploadHandlerOptions["storage"];
@@ -20,6 +35,29 @@ interface UploadAuthzContext {
   /** The parsed request URL (query params, upload-id path segment). */
   url: URL;
 }
+/**
+ * The context handed to {@link CreateUploadHandlerOptions.maxFileSizeFor}: the
+ * authorization context plus what the create request declares about the file.
+ * Everything here comes from the client, so it caps an upload by what the
+ * client SAYS it is; `allowMIME` on the provider is what checks the type.
+ */
+interface UploadSizeContext extends UploadAuthzContext {
+  /**
+   * The declared MIME type, resolved the way the stored file's type is: on
+   * chunked REST the request's `Content-Type`; on TUS the `Upload-Metadata`
+   * `mimeType`, else `type`, else `filetype`; else
+   * `application/octet-stream`.
+   */
+  contentType: string;
+  /**
+   * The largest size the request declares (`Upload-Length`, `X-Total-Size`,
+   * `Content-Length`). A declared size that is not a non-negative integer
+   * reads as `Infinity`.
+   */
+  declaredSize: number | undefined;
+  /** The decoded TUS `Upload-Metadata`, or the chunked-REST `X-File-Metadata` JSON, as strings. */
+  metadata: Record<string, string>;
+}
 /** Options for {@link createUploadHandler}. */
 interface CreateUploadHandlerOptions {
   /**
@@ -27,12 +65,51 @@ interface CreateUploadHandlerOptions {
    * returning `false` **or throwing** yields a `403`. Omit only for a fully
    * public bucket — the whole point of this handler over the admin path is
    * that uploads are gated by *your* per-user policy, not an admin token.
+   *
+   * Omitting it mounts an unauthenticated, unbounded-write endpoint, so
+   * doing so logs a one-time warning (per handler) unless `silent`/`public`
+   * says the omission is intentional.
    */
   authorize?: (context: UploadAuthzContext) => boolean | Promise<boolean>;
-  /** Maximum accepted file size in bytes (forwarded to the multipart parser). */
+  /**
+   * Maximum accepted file size in bytes. Forwarded to the multipart parser
+   * (protocol `"multipart"`) and, for `"tus"`/`"chunked-rest"`, enforced by
+   * this handler itself against the largest size the request declares across
+   * `Upload-Length` (TUS), `X-Total-Size` (chunked REST) and `Content-Length`
+   * — see {@link declaredUploadSize}. Defaults to
+   * {@link DEFAULT_MAX_UPLOAD_BYTES} (100 MiB) — pass this to raise or lower
+   * the ceiling; there is no unbounded option. Must be a finite, non-negative
+   * number: anything else (notably a `NaN` from an unset env var) throws at
+   * construction rather than disabling the cap.
+   */
   maxFileSize?: number;
+  /**
+   * A per-upload size cap, below `maxFileSize`: return the most bytes this
+   * upload may hold (say 10 MiB for `image/*`, 2 GiB for `video/*`), or
+   * `undefined` to leave `maxFileSize` as the only cap. It can only lower the
+   * cap, never raise it past `maxFileSize`.
+   *
+   * Runs after `authorize`, on the requests that create an upload (`POST`,
+   * and the chunked-REST `PUT`) of the `"tus"` and `"chunked-rest"`
+   * protocols; later chunks are bounded by the size declared at creation.
+   * Not applied to `"multipart"`, whose size is only known once the form is
+   * parsed. A create that declares no size is refused (`413`) when this
+   * returns a cap, since there is nothing to check it against. Throwing, or
+   * returning something that is not a finite, non-negative number, denies the
+   * request (`403`), fail-closed like `authorize`.
+   */
+  maxFileSizeFor?: (context: UploadSizeContext) => number | undefined | Promise<number | undefined>;
   /** Which protocol to speak. Default `"tus"` (the resumable, pause/resume-capable one). */
   protocol?: UploadProtocol;
+  /**
+   * Set when omitting `authorize` is intentional (a fully public upload
+   * bucket) — suppresses the one-time "no authorize gate" warning that would
+   * otherwise print when the handler is constructed. Has no effect when
+   * `authorize` is provided.
+   */
+  public?: boolean;
+  /** Suppress the one-time default-open-authorize warning. Alias of `public`. */
+  silent?: boolean;
   /** The storage provider the bytes land in (R2 in prod, memory in tests). */
   storage: UploadStorage;
 }
@@ -57,8 +134,8 @@ interface R2UploadStorageOptions {
   bucket: string;
   /**
    * Explicit R2 S3 endpoint. Defaults to
-   * `https://&lt;accountId>.r2.cloudflarestorage.com`. Pass this to pin a
-   * jurisdiction (e.g. `&lt;accountId>.eu.r2.cloudflarestorage.com`).
+   * `https://<accountId>.r2.cloudflarestorage.com`. Pass this to pin a
+   * jurisdiction (e.g. `<accountId>.eu.r2.cloudflarestorage.com`).
    */
   endpoint?: string;
   /** Client-side multipart part size (bytes or a size string like `"16MB"`). */
@@ -88,4 +165,52 @@ declare const createUploadHandler: (options: CreateUploadHandlerOptions) => Uplo
 declare const createR2UploadStorage: (options: R2UploadStorageOptions & {
   secretAccessKey: string;
 }) => AwsLightStorage;
-export { type CreateUploadHandlerOptions, type R2UploadStorageOptions, type UploadAuthzContext, type UploadHandler, type UploadProtocol, type UploadStorage, createR2UploadStorage, createUploadHandler };
+/** Every part of an R2 multipart upload but the last is exactly this size: R2's 5 MiB minimum. */
+declare const R2_PART_SIZE: number;
+/** Options for {@link createR2BindingUploadStorage}. */
+interface R2BindingUploadStorageOptions extends Omit<BaseStorageOptions, "metaStorage"> {
+  /**
+   * Key prefix the upload state objects and buffered segments are stored
+   * under, in the same bucket. Default `"_lunora/uploads/"`. No uploaded
+   * object may be named under it.
+   *
+   * The state of a finished upload stays (a few hundred bytes, so a `HEAD`
+   * can still answer that the upload is complete), and so does the state of
+   * one that was abandoned. Both accumulate: add an R2 object lifecycle rule
+   * that deletes objects under this prefix after a few days, longer than
+   * any upload you expect to take.
+   */
+  statePrefix?: string;
+}
+/**
+ * Build a resumable-upload provider for `createUploadHandler` over a Worker's
+ * R2 binding: no S3 credentials, and the same behaviour under `wrangler dev` /
+ * miniflare as in production.
+ *
+ * Speaks TUS (without the `checksum`, `concatenation` and
+ * `creation-defer-length` extensions), chunked REST with chunks sent in order
+ * (a chunk at any other offset is a `409`), and multipart forms.
+ *
+ * Chunked REST is broken upstream, see visulima/visulima#884 and the
+ * `@lunora/storage` docs ("Chunked REST is broken upstream").
+ */
+declare const createR2BindingUploadStorage: (bucket: R2UploadBucket, options?: R2BindingUploadStorageOptions) => UploadStorage;
+export { type CreateUploadHandlerOptions, DEFAULT_MAX_UPLOAD_BYTES,
+/**
+ * `@lunora/storage/upload` — the RLS-gated, non-admin resumable upload handler.
+ *
+ * A separate subpath so the base `@lunora/storage` entry stays lean: the
+ * `@visulima/storage` handler dependency only loads for apps that mount an
+ * end-user upload endpoint. Pair with `@visulima/storage-client` (or the
+ * `@lunora/react` / `@lunora/vue` / … `useUpload` re-exports) on the client.
+ */
+type R2BindingUploadStorageOptions,
+/**
+ * `@lunora/storage/upload` — the RLS-gated, non-admin resumable upload handler.
+ *
+ * A separate subpath so the base `@lunora/storage` entry stays lean: the
+ * `@visulima/storage` handler dependency only loads for apps that mount an
+ * end-user upload endpoint. Pair with `@visulima/storage-client` (or the
+ * `@lunora/react` / `@lunora/vue` / … `useUpload` re-exports) on the client.
+ */
+type R2UploadBucket, type R2UploadStorageOptions, R2_PART_SIZE, type UploadAuthzContext, type UploadHandler, type UploadProtocol, type UploadSizeContext, type UploadStorage, createR2BindingUploadStorage, createR2UploadStorage, createUploadHandler };

package/dist/upload.d.ts

@@ -1,7 +1,22 @@
+import { BaseStorageOptions } from '@visulima/storage';
+import { R2BucketLike } from '@lunora/platform';
 import { Tus } from '@visulima/storage/handler/http/fetch';
 import { AwsLightStorage } from '@visulima/storage/provider/aws-light';
+/**
+ * An R2 binding with the multipart API: a Worker's `env.BUCKET` (and
+ * miniflare's). The provider also relies on `put`'s `onlyIf` preconditions,
+ * which every R2 binding honors.
+ */
+type R2UploadBucket = R2BucketLike & Required<Pick<R2BucketLike, "createMultipartUpload" | "resumeMultipartUpload">>;
 /** Resumable upload wire protocols the handler can speak. */
 type UploadProtocol = "chunked-rest" | "multipart" | "tus";
+/**
+ * Default ceiling applied to `maxFileSize` when the caller doesn't supply one
+ * (100 MiB). Without SOME cap, an unauthenticated or loosely-authorized
+ * handler accepts an unbounded request body — pass an explicit `maxFileSize`
+ * to raise or lower this for your app.
+ */
+declare const DEFAULT_MAX_UPLOAD_BYTES: number;
 type UploadHandlerOptions = ConstructorParameters<typeof Tus>[0];
 /** A `@visulima/storage` storage provider (e.g. {@link createR2UploadStorage} or a memory provider in tests). */
 type UploadStorage = UploadHandlerOptions["storage"];
@@ -20,6 +35,29 @@ interface UploadAuthzContext {
   /** The parsed request URL (query params, upload-id path segment). */
   url: URL;
 }
+/**
+ * The context handed to {@link CreateUploadHandlerOptions.maxFileSizeFor}: the
+ * authorization context plus what the create request declares about the file.
+ * Everything here comes from the client, so it caps an upload by what the
+ * client SAYS it is; `allowMIME` on the provider is what checks the type.
+ */
+interface UploadSizeContext extends UploadAuthzContext {
+  /**
+   * The declared MIME type, resolved the way the stored file's type is: on
+   * chunked REST the request's `Content-Type`; on TUS the `Upload-Metadata`
+   * `mimeType`, else `type`, else `filetype`; else
+   * `application/octet-stream`.
+   */
+  contentType: string;
+  /**
+   * The largest size the request declares (`Upload-Length`, `X-Total-Size`,
+   * `Content-Length`). A declared size that is not a non-negative integer
+   * reads as `Infinity`.
+   */
+  declaredSize: number | undefined;
+  /** The decoded TUS `Upload-Metadata`, or the chunked-REST `X-File-Metadata` JSON, as strings. */
+  metadata: Record<string, string>;
+}
 /** Options for {@link createUploadHandler}. */
 interface CreateUploadHandlerOptions {
   /**
@@ -27,12 +65,51 @@ interface CreateUploadHandlerOptions {
    * returning `false` **or throwing** yields a `403`. Omit only for a fully
    * public bucket — the whole point of this handler over the admin path is
    * that uploads are gated by *your* per-user policy, not an admin token.
+   *
+   * Omitting it mounts an unauthenticated, unbounded-write endpoint, so
+   * doing so logs a one-time warning (per handler) unless `silent`/`public`
+   * says the omission is intentional.
    */
   authorize?: (context: UploadAuthzContext) => boolean | Promise<boolean>;
-  /** Maximum accepted file size in bytes (forwarded to the multipart parser). */
+  /**
+   * Maximum accepted file size in bytes. Forwarded to the multipart parser
+   * (protocol `"multipart"`) and, for `"tus"`/`"chunked-rest"`, enforced by
+   * this handler itself against the largest size the request declares across
+   * `Upload-Length` (TUS), `X-Total-Size` (chunked REST) and `Content-Length`
+   * — see {@link declaredUploadSize}. Defaults to
+   * {@link DEFAULT_MAX_UPLOAD_BYTES} (100 MiB) — pass this to raise or lower
+   * the ceiling; there is no unbounded option. Must be a finite, non-negative
+   * number: anything else (notably a `NaN` from an unset env var) throws at
+   * construction rather than disabling the cap.
+   */
   maxFileSize?: number;
+  /**
+   * A per-upload size cap, below `maxFileSize`: return the most bytes this
+   * upload may hold (say 10 MiB for `image/*`, 2 GiB for `video/*`), or
+   * `undefined` to leave `maxFileSize` as the only cap. It can only lower the
+   * cap, never raise it past `maxFileSize`.
+   *
+   * Runs after `authorize`, on the requests that create an upload (`POST`,
+   * and the chunked-REST `PUT`) of the `"tus"` and `"chunked-rest"`
+   * protocols; later chunks are bounded by the size declared at creation.
+   * Not applied to `"multipart"`, whose size is only known once the form is
+   * parsed. A create that declares no size is refused (`413`) when this
+   * returns a cap, since there is nothing to check it against. Throwing, or
+   * returning something that is not a finite, non-negative number, denies the
+   * request (`403`), fail-closed like `authorize`.
+   */
+  maxFileSizeFor?: (context: UploadSizeContext) => number | undefined | Promise<number | undefined>;
   /** Which protocol to speak. Default `"tus"` (the resumable, pause/resume-capable one). */
   protocol?: UploadProtocol;
+  /**
+   * Set when omitting `authorize` is intentional (a fully public upload
+   * bucket) — suppresses the one-time "no authorize gate" warning that would
+   * otherwise print when the handler is constructed. Has no effect when
+   * `authorize` is provided.
+   */
+  public?: boolean;
+  /** Suppress the one-time default-open-authorize warning. Alias of `public`. */
+  silent?: boolean;
   /** The storage provider the bytes land in (R2 in prod, memory in tests). */
   storage: UploadStorage;
 }
@@ -57,8 +134,8 @@ interface R2UploadStorageOptions {
   bucket: string;
   /**
    * Explicit R2 S3 endpoint. Defaults to
-   * `https://&lt;accountId>.r2.cloudflarestorage.com`. Pass this to pin a
-   * jurisdiction (e.g. `&lt;accountId>.eu.r2.cloudflarestorage.com`).
+   * `https://<accountId>.r2.cloudflarestorage.com`. Pass this to pin a
+   * jurisdiction (e.g. `<accountId>.eu.r2.cloudflarestorage.com`).
    */
   endpoint?: string;
   /** Client-side multipart part size (bytes or a size string like `"16MB"`). */
@@ -88,4 +165,52 @@ declare const createUploadHandler: (options: CreateUploadHandlerOptions) => Uplo
 declare const createR2UploadStorage: (options: R2UploadStorageOptions & {
   secretAccessKey: string;
 }) => AwsLightStorage;
-export { type CreateUploadHandlerOptions, type R2UploadStorageOptions, type UploadAuthzContext, type UploadHandler, type UploadProtocol, type UploadStorage, createR2UploadStorage, createUploadHandler };
+/** Every part of an R2 multipart upload but the last is exactly this size: R2's 5 MiB minimum. */
+declare const R2_PART_SIZE: number;
+/** Options for {@link createR2BindingUploadStorage}. */
+interface R2BindingUploadStorageOptions extends Omit<BaseStorageOptions, "metaStorage"> {
+  /**
+   * Key prefix the upload state objects and buffered segments are stored
+   * under, in the same bucket. Default `"_lunora/uploads/"`. No uploaded
+   * object may be named under it.
+   *
+   * The state of a finished upload stays (a few hundred bytes, so a `HEAD`
+   * can still answer that the upload is complete), and so does the state of
+   * one that was abandoned. Both accumulate: add an R2 object lifecycle rule
+   * that deletes objects under this prefix after a few days, longer than
+   * any upload you expect to take.
+   */
+  statePrefix?: string;
+}
+/**
+ * Build a resumable-upload provider for `createUploadHandler` over a Worker's
+ * R2 binding: no S3 credentials, and the same behaviour under `wrangler dev` /
+ * miniflare as in production.
+ *
+ * Speaks TUS (without the `checksum`, `concatenation` and
+ * `creation-defer-length` extensions), chunked REST with chunks sent in order
+ * (a chunk at any other offset is a `409`), and multipart forms.
+ *
+ * Chunked REST is broken upstream, see visulima/visulima#884 and the
+ * `@lunora/storage` docs ("Chunked REST is broken upstream").
+ */
+declare const createR2BindingUploadStorage: (bucket: R2UploadBucket, options?: R2BindingUploadStorageOptions) => UploadStorage;
+export { type CreateUploadHandlerOptions, DEFAULT_MAX_UPLOAD_BYTES,
+/**
+ * `@lunora/storage/upload` — the RLS-gated, non-admin resumable upload handler.
+ *
+ * A separate subpath so the base `@lunora/storage` entry stays lean: the
+ * `@visulima/storage` handler dependency only loads for apps that mount an
+ * end-user upload endpoint. Pair with `@visulima/storage-client` (or the
+ * `@lunora/react` / `@lunora/vue` / … `useUpload` re-exports) on the client.
+ */
+type R2BindingUploadStorageOptions,
+/**
+ * `@lunora/storage/upload` — the RLS-gated, non-admin resumable upload handler.
+ *
+ * A separate subpath so the base `@lunora/storage` entry stays lean: the
+ * `@visulima/storage` handler dependency only loads for apps that mount an
+ * end-user upload endpoint. Pair with `@visulima/storage-client` (or the
+ * `@lunora/react` / `@lunora/vue` / … `useUpload` re-exports) on the client.
+ */
+type R2UploadBucket, type R2UploadStorageOptions, R2_PART_SIZE, type UploadAuthzContext, type UploadHandler, type UploadProtocol, type UploadSizeContext, type UploadStorage, createR2BindingUploadStorage, createR2UploadStorage, createUploadHandler };

package/dist/upload.mjs

@@ -1 +1 @@
-export { createR2UploadStorage, createUploadHandler } from './packem_shared/createR2UploadStorage-BfLIpWdf.mjs';
+import{createR2BindingUploadStorage as o}from"./packem_shared/createR2BindingUploadStorage-BQE2iEz6.mjs";import{DEFAULT_MAX_UPLOAD_BYTES as t,createR2UploadStorage as p,createUploadHandler as d}from"./packem_shared/DEFAULT_MAX_UPLOAD_BYTES-BlLcQ6Uc.mjs";import{R as U}from"./packem_shared/r2-upload-part-writer-BE4HJRLY.mjs";export{t as DEFAULT_MAX_UPLOAD_BYTES,U as R2_PART_SIZE,o as createR2BindingUploadStorage,p as createR2UploadStorage,d as createUploadHandler};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/storage",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.110",
   "description": "R2-backed storage for Lunora: typed buckets and signed URLs",
   "keywords": [
     "cloudflare",
@@ -50,8 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.7",
-    "@visulima/storage": "1.0.5",
+    "@lunora/errors": "1.0.0-alpha.50",
+    "@lunora/platform": "1.0.0-alpha.55",
+    "@visulima/storage": "2.0.22",
     "aws4fetch": "1.0.20"
   },
   "engines": {

package/dist/packem_shared/buildPresignedUrl-B5f1wvz6.mjs

@@ -1,64 +0,0 @@
-import { a as toHex } from './internal-Dqk0MrAj.mjs';
-
-const REGION = "auto";
-const SERVICE = "s3";
-const ALGORITHM = "AWS4-HMAC-SHA256";
-const MIN_EXPIRES_SECONDS = 1;
-const MAX_EXPIRES_SECONDS = 7 * 24 * 60 * 60;
-const DEFAULT_EXPIRES_SECONDS = 900;
-const textEncoder = new TextEncoder();
-const compareEntries = (a, b) => {
-  if (a[0] < b[0]) {
-    return -1;
-  }
-  return a[0] > b[0] ? 1 : 0;
-};
-const encodeRfc3986 = (value) => encodeURIComponent(value).replaceAll(/[!'()*]/gu, (char) => `%${char.codePointAt(0)?.toString(16).toUpperCase() ?? ""}`);
-const encodeKey = (key) => key.split("/").map((segment) => encodeRfc3986(segment)).join("/");
-const sha256Hex = async (input) => toHex(await crypto.subtle.digest("SHA-256", textEncoder.encode(input)));
-const hmac = async (key, message) => {
-  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
-  return crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(message));
-};
-const deriveSigningKey = async (secretAccessKey, dateStamp) => {
-  const dateKey = await hmac(textEncoder.encode(`AWS4${secretAccessKey}`), dateStamp);
-  const regionKey = await hmac(dateKey, REGION);
-  const serviceKey = await hmac(regionKey, SERVICE);
-  return hmac(serviceKey, "aws4_request");
-};
-const endpointHost = (credentials) => {
-  const infix = credentials.jurisdiction === void 0 ? "" : `${credentials.jurisdiction}.`;
-  return `${credentials.accountId}.${infix}r2.cloudflarestorage.com`;
-};
-const formatAmzDate = (date) => {
-  const amzDate = `${date.toISOString().replaceAll(/[:-]/gu, "").slice(0, 15)}Z`;
-  return { amzDate, dateStamp: amzDate.slice(0, 8) };
-};
-const buildPresignedUrl = async (parameters) => {
-  const { credentials, key } = parameters;
-  const method = parameters.method ?? "GET";
-  const requested = parameters.expiresInSeconds ?? DEFAULT_EXPIRES_SECONDS;
-  const normalised = Number.isFinite(requested) ? requested : DEFAULT_EXPIRES_SECONDS;
-  const expires = Math.min(Math.max(MIN_EXPIRES_SECONDS, Math.floor(normalised)), MAX_EXPIRES_SECONDS);
-  const host = endpointHost(credentials);
-  const date = new Date(parameters.now?.() ?? Date.now());
-  const { amzDate, dateStamp } = formatAmzDate(date);
-  const credentialScope = `${dateStamp}/${REGION}/${SERVICE}/aws4_request`;
-  const canonicalUri = `/${encodeRfc3986(credentials.bucket)}/${encodeKey(key)}`;
-  const query = [
-    ["X-Amz-Algorithm", ALGORITHM],
-    ["X-Amz-Credential", `${credentials.accessKeyId}/${credentialScope}`],
-    ["X-Amz-Date", amzDate],
-    ["X-Amz-Expires", expires.toString()],
-    ["X-Amz-SignedHeaders", "host"]
-  ];
-  const canonicalQuery = query.map(([name, value]) => [encodeRfc3986(name), encodeRfc3986(value)]).toSorted(compareEntries).map(([name, value]) => `${name}=${value}`).join("&");
-  const canonicalRequest = [method, canonicalUri, canonicalQuery, `host:${host}
-`, "host", "UNSIGNED-PAYLOAD"].join("\n");
-  const stringToSign = [ALGORITHM, amzDate, credentialScope, await sha256Hex(canonicalRequest)].join("\n");
-  const signingKey = await deriveSigningKey(credentials.secretAccessKey, dateStamp);
-  const signature = toHex(await hmac(signingKey, stringToSign));
-  return `https://${host}${canonicalUri}?${canonicalQuery}&X-Amz-Signature=${signature}`;
-};
-
-export { buildPresignedUrl };

package/dist/packem_shared/buildSignedUrl-rt-6azia.mjs

@@ -1,124 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { t as trimTrailingSlashes } from './internal-Dqk0MrAj.mjs';
-
-const evictOldestEntry = (map, capacity) => {
-  if (map.size < capacity) {
-    return;
-  }
-  const oldest = map.keys().next().value;
-  if (oldest !== void 0) {
-    map.delete(oldest);
-  }
-};
-
-const textEncoder = new TextEncoder();
-const MAX_SIGNED_URL_TTL_SECONDS = 7 * 24 * 60 * 60;
-const SCHEME_PREFIX_RE = /^[a-z][a-z0-9+\-.]*:\/\//i;
-const toBase64Url = (bytes) => {
-  const binary = String.fromCodePoint(...bytes);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-};
-const fromBase64Url = (input) => {
-  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.codePointAt(index) ?? 0;
-  }
-  return bytes;
-};
-const KEY_CACHE_MAX = 64;
-const keyCache = /* @__PURE__ */ new Map();
-const importHmacKey = async (secret) => {
-  const cached = keyCache.get(secret);
-  if (cached) {
-    return cached;
-  }
-  evictOldestEntry(keyCache, KEY_CACHE_MAX);
-  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
-  keyCache.set(secret, keyPromise);
-  return keyPromise;
-};
-const extractHost = (input) => {
-  try {
-    return new URL(input).host;
-  } catch {
-    const noScheme = input.replace(SCHEME_PREFIX_RE, "");
-    return noScheme.split("/")[0] ?? "";
-  }
-};
-const signCanonical = async (secret, canonical) => {
-  const cryptoKey = await importHmacKey(secret);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
-  return toBase64Url(new Uint8Array(signature));
-};
-const verifyCanonical = async (secret, canonical, sigBytes) => {
-  const cryptoKey = await importHmacKey(secret);
-  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
-};
-
-const LEADING_SLASH_RE = /^\//;
-const canonicalize = (method, host, key, exp, contentType) => {
-  const base = `${method}
-${host.toLowerCase()}
-${key}
-${String(exp)}`;
-  return contentType === void 0 ? base : `${base}
-${contentType}`;
-};
-const buildSignedUrl = async (args) => {
-  const method = args.method ?? "GET";
-  const expiresInSeconds = args.expiresInSeconds ?? 60 * 60;
-  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: expiresInSeconds must be a positive finite number");
-  }
-  if (expiresInSeconds > MAX_SIGNED_URL_TTL_SECONDS) {
-    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: expiresInSeconds must not exceed ${String(MAX_SIGNED_URL_TTL_SECONDS)} (7 days)`);
-  }
-  const contentType = method === "PUT" ? args.contentType : void 0;
-  const exp = Math.floor(Date.now() / 1e3) + expiresInSeconds;
-  const host = extractHost(args.baseUrl);
-  const sig = await signCanonical(args.secret, canonicalize(method, host, args.key, exp, contentType));
-  const base = trimTrailingSlashes(args.baseUrl);
-  const safeKey = args.key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
-  const ctParameter = contentType === void 0 ? "" : `&ct=${encodeURIComponent(contentType)}`;
-  return `${base}/${safeKey}?exp=${String(exp)}&method=${method}&sig=${sig}${ctParameter}`;
-};
-const verifySignedUrl = async (input, secret, options) => {
-  let url;
-  try {
-    url = input instanceof URL ? input : new URL(input);
-  } catch {
-    return { reason: "malformed", valid: false };
-  }
-  const expRaw = url.searchParams.get("exp");
-  const exp = expRaw === null ? Number.NaN : Number(expRaw);
-  const sig = url.searchParams.get("sig");
-  const method = url.searchParams.get("method") ?? "GET";
-  const contentType = url.searchParams.get("ct") ?? void 0;
-  if (!sig || !Number.isInteger(exp)) {
-    return { reason: "malformed", valid: false };
-  }
-  if (exp < Math.floor(Date.now() / 1e3)) {
-    return { reason: "expired", valid: false };
-  }
-  if (method !== "GET" && method !== "PUT") {
-    return { reason: "malformed", valid: false };
-  }
-  let key;
-  let sigBytes;
-  try {
-    key = url.pathname.replace(LEADING_SLASH_RE, "").split("/").map((segment) => decodeURIComponent(segment)).join("/");
-    sigBytes = fromBase64Url(sig);
-  } catch {
-    return { reason: "malformed", valid: false };
-  }
-  const host = options?.expectedHost === void 0 ? url.host : extractHost(options.expectedHost);
-  const valid = await verifyCanonical(secret, canonicalize(method, host, key, exp, contentType), sigBytes);
-  if (!valid) {
-    return { reason: "bad_signature", valid: false };
-  }
-  return { contentType, key, method, valid: true };
-};
-
-export { buildSignedUrl, verifySignedUrl };

package/dist/packem_shared/createBucketStorage-JYdrS4e5.mjs

@@ -1,28 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-
-const createBucketStorage = (buckets, options = {}) => {
-  const names = Object.keys(buckets);
-  const [firstName] = names;
-  if (firstName === void 0) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: createBucketStorage requires at least one bucket");
-  }
-  if (options.default !== void 0 && !buckets[options.default]) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: default bucket "${options.default}" is not in the bucket map (have: ${names.join(", ")})`);
-  }
-  const defaultTag = options.default ?? "default";
-  const defaultBinding = buckets[defaultTag] ?? buckets[firstName];
-  if (defaultBinding === void 0) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: default bucket "${defaultTag}" is not in the bucket map (have: ${names.join(", ")})`);
-  }
-  const addressable = [.../* @__PURE__ */ new Set([defaultTag, ...names])];
-  const make = (name) => {
-    const target = name === defaultTag ? defaultBinding : buckets[name];
-    if (!target) {
-      throw new LunoraError("INTERNAL", `@lunora/storage: no bucket registered for "${name}". Known buckets: ${addressable.join(", ")}`);
-    }
-    return { ...target, bucket: (next) => make(next), bucketName: name };
-  };
-  return make(defaultTag);
-};
-
-export { createBucketStorage };

package/dist/packem_shared/createR2UploadStorage-BfLIpWdf.mjs

@@ -1,54 +0,0 @@
-import { Rest, Multipart, Tus } from '@visulima/storage/handler/http/fetch';
-import { AwsLightStorage } from '@visulima/storage/provider/aws-light';
-
-const TUS_RESUMABLE = "1.0.0";
-const denyResponse = (protocol) => {
-  const headers = { "content-type": "application/json" };
-  if (protocol === "tus") {
-    headers["Tus-Resumable"] = TUS_RESUMABLE;
-  }
-  return Response.json({ error: { code: "FORBIDDEN", message: "Upload denied by authorization policy", name: "ForbiddenError" } }, { headers, status: 403 });
-};
-const instantiateHandler = (protocol, handlerOptions) => {
-  if (protocol === "chunked-rest") {
-    return new Rest(handlerOptions);
-  }
-  if (protocol === "multipart") {
-    return new Multipart(handlerOptions);
-  }
-  return new Tus(handlerOptions);
-};
-const createUploadHandler = (options) => {
-  const protocol = options.protocol ?? "tus";
-  const handlerOptions = {
-    storage: options.storage,
-    ...options.maxFileSize === void 0 ? {} : { maxFileSize: options.maxFileSize }
-  };
-  const handler = instantiateHandler(protocol, handlerOptions);
-  const { authorize } = options;
-  const fetch = async (request) => {
-    if (authorize !== void 0) {
-      try {
-        const allowed = await authorize({ method: request.method, protocol, request, url: new URL(request.url) });
-        if (!allowed) {
-          return denyResponse(protocol);
-        }
-      } catch {
-        return denyResponse(protocol);
-      }
-    }
-    return handler.fetch(request);
-  };
-  return { fetch, protocol };
-};
-const createR2UploadStorage = (options) => new AwsLightStorage({
-  accessKeyId: options.accessKeyId,
-  bucket: options.bucket,
-  endpoint: options.endpoint ?? `https://${options.accountId}.r2.cloudflarestorage.com`,
-  path: options.path ?? "/",
-  region: "auto",
-  secretAccessKey: options.secretAccessKey,
-  ...options.partSize === void 0 ? {} : { partSize: options.partSize }
-});
-
-export { createR2UploadStorage, createUploadHandler };