@lunora/storage 1.0.0-alpha.11 → 1.0.0-alpha.13

package/dist/index.mjs

@@ -1,4 +1 @@
-export { createBucketStorage } from './packem_shared/createBucketStorage-JYdrS4e5.mjs';
-export { createStorage, scopeKey } from './packem_shared/createStorage-Bu6GJB25.mjs';
-export { buildPresignedUrl } from './packem_shared/buildPresignedUrl-B5f1wvz6.mjs';
-export { buildSignedUrl, verifySignedUrl } from './packem_shared/buildSignedUrl-rt-6azia.mjs';
+import{createBucketStorage as o}from"./packem_shared/createBucketStorage-DAip6cEw.mjs";import{createStorage as i,scopeKey as d}from"./packem_shared/createStorage-CWKguFEG.mjs";import{buildPresignedUrl as g}from"./packem_shared/buildPresignedUrl-TCv-5TAT.mjs";import{buildSignedUrl as p,verifySignedUrl as a}from"./packem_shared/buildSignedUrl-DocLLDGy.mjs";export{g as buildPresignedUrl,p as buildSignedUrl,o as createBucketStorage,i as createStorage,d as scopeKey,a as verifySignedUrl};

package/dist/packem_shared/buildPresignedUrl-TCv-5TAT.mjs

@@ -0,0 +1,4 @@
+import{a as g}from"./internal-DpjlEJPE.mjs";const h="auto",y="s3",S="AWS4-HMAC-SHA256",M=1,X=10080*60,w=900,d=new TextEncoder,j=(e,t)=>e[0]<t[0]?-1:e[0]>t[0]?1:0,s=e=>encodeURIComponent(e).replaceAll(/[!'()*]/gu,t=>`%${t.codePointAt(0)?.toString(16).toUpperCase()??""}`),f=e=>e.split("/").map(t=>s(t)).join("/"),U=async e=>g(await crypto.subtle.digest("SHA-256",d.encode(e))),n=async(e,t)=>{const a=await crypto.subtle.importKey("raw",e,{hash:"SHA-256",name:"HMAC"},!1,["sign"]);return crypto.subtle.sign("HMAC",a,d.encode(t))},E=async(e,t)=>{const a=await n(d.encode(`AWS4${e}`),t),r=await n(a,h),o=await n(r,y);return n(o,"aws4_request")},K=e=>{const t=e.jurisdiction===void 0?"":`${e.jurisdiction}.`;return`${e.accountId}.${t}r2.cloudflarestorage.com`},P=e=>{const t=`${e.toISOString().replaceAll(/[:-]/gu,"").slice(0,15)}Z`;return{amzDate:t,dateStamp:t.slice(0,8)}},k=async e=>{const{credentials:t,key:a}=e,r=e.method??"GET",o=e.expiresInSeconds??w,z=Number.isFinite(o)?o:w,H=Math.min(Math.max(M,Math.floor(z)),X),m=K(t),D=new Date(e.now?.()??Date.now()),{amzDate:l,dateStamp:u}=P(D),A=`${u}/${h}/${y}/aws4_request`,p=`/${s(t.bucket)}/${f(a)}`,$=[["X-Amz-Algorithm",S],["X-Amz-Credential",`${t.accessKeyId}/${A}`],["X-Amz-Date",l],["X-Amz-Expires",H.toString()],["X-Amz-SignedHeaders","host"]].map(([i,c])=>[s(i),s(c)]).toSorted(j).map(([i,c])=>`${i}=${c}`).join("&"),b=[r,p,$,`host:${m}
+`,"host","UNSIGNED-PAYLOAD"].join(`
+`),x=[S,l,A,await U(b)].join(`
+`),C=await E(t.secretAccessKey,u),I=g(await n(C,x));return`https://${m}${p}?${$}&X-Amz-Signature=${I}`};export{k as buildPresignedUrl};

package/dist/packem_shared/buildSignedUrl-DocLLDGy.mjs

@@ -0,0 +1,5 @@
+import{LunoraError as p}from"@lunora/errors";import{t as A}from"./internal-DpjlEJPE.mjs";const $=(e,r)=>{if(e.size<r)return;const t=e.keys().next().value;t!==void 0&&e.delete(t)},u=new TextEncoder,f=10080*60,b=/^[a-z][a-z0-9+\-.]*:\/\//i,U=e=>{const r=String.fromCodePoint(...e);return btoa(r).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},x=e=>{const r=e.replaceAll("-","+").replaceAll("_","/")+"===".slice((e.length+3)%4),t=atob(r),n=new Uint8Array(t.length);for(let a=0;a<t.length;a+=1)n[a]=t.codePointAt(a)??0;return n},R=64,m=new Map,g=async e=>{const r=m.get(e);if(r)return r;$(m,R);const t=crypto.subtle.importKey("raw",u.encode(e),{hash:"SHA-256",name:"HMAC"},!1,["sign","verify"]);return m.set(e,t),t},y=e=>{try{return new URL(e).host}catch{return e.replace(b,"").split("/")[0]??""}},S=async(e,r)=>{const t=await g(e),n=await crypto.subtle.sign("HMAC",t,u.encode(r));return U(new Uint8Array(n))},I=async(e,r,t)=>{const n=await g(e);return crypto.subtle.verify("HMAC",n,t,u.encode(r))},T=/^\//,h=(e,r,t,n,a)=>{const o=`${e}
+${r.toLowerCase()}
+${t}
+${String(n)}`;return a===void 0?o:`${o}
+${a}`},P=async e=>{const r=e.method??"GET",t=e.expiresInSeconds??3600;if(!Number.isFinite(t)||t<=0)throw new p("VALIDATION_ERROR","@lunora/storage: expiresInSeconds must be a positive finite number");if(t>f)throw new p("VALIDATION_ERROR",`@lunora/storage: expiresInSeconds must not exceed ${String(f)} (7 days)`);const n=r==="PUT"?e.contentType:void 0,a=Math.floor(Date.now()/1e3)+t,o=y(e.baseUrl),c=await S(e.secret,h(r,o,e.key,a,n)),s=A(e.baseUrl),l=e.key.split("/").map(d=>encodeURIComponent(d)).join("/"),i=n===void 0?"":`&ct=${encodeURIComponent(n)}`;return`${s}/${l}?exp=${String(a)}&method=${r}&sig=${c}${i}`},E=async(e,r,t)=>{let n;try{n=e instanceof URL?e:new URL(e)}catch{return{reason:"malformed",valid:!1}}const a=n.searchParams.get("exp"),o=a===null?Number.NaN:Number(a),c=n.searchParams.get("sig"),s=n.searchParams.get("method")??"GET",l=n.searchParams.get("ct")??void 0;if(!c||!Number.isInteger(o))return{reason:"malformed",valid:!1};if(o<Math.floor(Date.now()/1e3))return{reason:"expired",valid:!1};if(s!=="GET"&&s!=="PUT")return{reason:"malformed",valid:!1};let i,d;try{i=n.pathname.replace(T,"").split("/").map(v=>decodeURIComponent(v)).join("/"),d=x(c)}catch{return{reason:"malformed",valid:!1}}const w=t?.expectedHost===void 0?n.host:y(t.expectedHost);return await I(r,h(s,w,i,o,l),d)?{contentType:l,key:i,method:s,valid:!0}:{reason:"bad_signature",valid:!1}};export{P as buildSignedUrl,E as verifySignedUrl};

package/dist/packem_shared/createBucketStorage-DAip6cEw.mjs

@@ -0,0 +1 @@
+import{LunoraError as u}from"@lunora/errors";const d=(t,o={})=>{const r=Object.keys(t),[n]=r;if(n===void 0)throw new u("INTERNAL","@lunora/storage: createBucketStorage requires at least one bucket");if(o.default!==void 0&&!t[o.default])throw new u("INTERNAL",`@lunora/storage: default bucket "${o.default}" is not in the bucket map (have: ${r.join(", ")})`);const e=o.default??"default",c=t[e]??t[n];if(c===void 0)throw new u("INTERNAL",`@lunora/storage: default bucket "${e}" is not in the bucket map (have: ${r.join(", ")})`);const f=[...new Set([e,...r])],i=a=>{const s=a===e?c:t[a];if(!s)throw new u("INTERNAL",`@lunora/storage: no bucket registered for "${a}". Known buckets: ${f.join(", ")}`);return{...s,bucket:k=>i(k),bucketName:a}};return i(e)};export{d as createBucketStorage};

package/dist/packem_shared/createR2UploadStorage-BSgOjRvv.mjs

@@ -0,0 +1 @@
+import{Rest as n,Multipart as i,Tus as u}from"@visulima/storage/handler/http/fetch";import{AwsLightStorage as p}from"@visulima/storage/provider/aws-light";const d="1.0.0",a=e=>{const t={"content-type":"application/json"};return e==="tus"&&(t["Tus-Resumable"]=d),Response.json({error:{code:"FORBIDDEN",message:"Upload denied by authorization policy",name:"ForbiddenError"}},{headers:t,status:403})},l=(e,t)=>e==="chunked-rest"?new n(t):e==="multipart"?new i(t):new u(t),g=e=>{const t=e.protocol??"tus",s={storage:e.storage,...e.maxFileSize===void 0?{}:{maxFileSize:e.maxFileSize}},c=l(t,s),{authorize:o}=e;return{fetch:async r=>{if(o!==void 0)try{if(!await o({method:r.method,protocol:t,request:r,url:new URL(r.url)}))return a(t)}catch{return a(t)}return c.fetch(r)},protocol:t}},y=e=>new p({accessKeyId:e.accessKeyId,bucket:e.bucket,endpoint:e.endpoint??`https://${e.accountId}.r2.cloudflarestorage.com`,path:e.path??"/",region:"auto",secretAccessKey:e.secretAccessKey,...e.partSize===void 0?{}:{partSize:e.partSize}});export{y as createR2UploadStorage,g as createUploadHandler};

package/dist/packem_shared/createStorage-CWKguFEG.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{t as T,a as f}from"./internal-DpjlEJPE.mjs";import{buildPresignedUrl as R}from"./buildPresignedUrl-TCv-5TAT.mjs";import{buildSignedUrl as k}from"./buildSignedUrl-DocLLDGy.mjs";const m=1024,I=1e3,A=100,b=e=>{const o=new Uint8Array(e);let i="";for(const p of o)i+=String.fromCodePoint(p);return btoa(i)},U=e=>{const o=e.checksums?.sha256;if(o===void 0)return e;const i=f(o),p=b(o);return new Proxy(e,{get(u,s){if(s==="sha256")return i;if(s==="sha256Base64")return p;const l=Reflect.get(u,s,u);return typeof l=="function"?l.bind(u):l},has(u,s){return s==="sha256"||s==="sha256Base64"||Reflect.has(u,s)}})},w=e=>{const o=e.checksums?.sha256;return{contentType:e.httpMetadata?.contentType,customMetadata:e.customMetadata,key:e.key,sha256:o===void 0?void 0:f(o),size:e.size,uploaded:e.uploaded===void 0?void 0:e.uploaded.getTime()}},S=e=>{const o=e.checksums?.sha256;return{checksums:e.checksums,customMetadata:e.customMetadata,etag:e.etag,httpEtag:e.httpEtag,httpMetadata:e.httpMetadata,key:e.key,sha256:o===void 0?void 0:f(o),sha256Base64:o===void 0?void 0:b(o),size:e.size,uploaded:e.uploaded}},M=(e,o)=>{let i=0;const p=s=>s instanceof ArrayBuffer||ArrayBuffer.isView(s)?s.byteLength:void 0,u=new TransformStream({transform(s,l){const h=p(s);if(h===void 0){l.error(new Error("@lunora/storage: stream chunk is not a byte chunk; cannot enforce maxSize"));return}if(i+=h,i>o){l.error(new Error(`@lunora/storage: stream body exceeds maxSize (> ${String(o)} bytes)`));return}l.enqueue(s)}});return e.pipeThrough(u)},c=e=>{if(typeof e!="string"||e.length===0)throw new a("VALIDATION_ERROR","@lunora/storage: key must be a non-empty string");if(e.length>m)throw new a("VALIDATION_ERROR",`@lunora/storage: key exceeds ${String(m)}-byte limit`);if(e.includes("\0"))throw new a("VALIDATION_ERROR","@lunora/storage: key contains NUL byte");if(e.startsWith("/"))throw new a("VALIDATION_ERROR","@lunora/storage: key must not start with `/`");const o=e.split("/");for(const i of o)if(i==="..")throw new a("VALIDATION_ERROR","@lunora/storage: key contains a `..` path component")},O=(e,o)=>{c(e),c(o);const i=`${e.endsWith("/")?e.slice(0,-1):e}/${o}`;if(i.length>m)throw new a("VALIDATION_ERROR",`@lunora/storage: scoped key exceeds ${String(m)}-byte limit`);return i},v=e=>{if(!e.bucket)throw new a("INTERNAL","@lunora/storage: `bucket` is required");const o=async(r,t,n={})=>{if(c(r),n.allowedContentTypes!==void 0){if(n.contentType===void 0)throw new a("VALIDATION_ERROR","@lunora/storage: contentType is required when allowedContentTypes is set");if(!n.allowedContentTypes.includes(n.contentType))throw new a("VALIDATION_ERROR",`@lunora/storage: contentType "${n.contentType}" not in allowedContentTypes`)}let y=t;if(typeof n.maxSize=="number"){let g;if(t instanceof ArrayBuffer?g=t.byteLength:t instanceof Blob&&(g=t.size),g!==void 0&&g>n.maxSize)throw new a("PAYLOAD_TOO_LARGE",`@lunora/storage: body exceeds maxSize (${String(g)} > ${String(n.maxSize)})`);t instanceof ReadableStream&&(y=M(t,n.maxSize))}const d=await e.bucket.put(r,y,{customMetadata:n.customMetadata,httpMetadata:n.contentType?{contentType:n.contentType}:void 0});return{etag:d.etag,httpEtag:d.httpEtag??`"${d.etag}"`,key:d.key}},i=async(r,t={})=>{c(r);const n=await(t.range?e.bucket.get(r,{range:t.range}):e.bucket.get(r));return n&&U(n)},p=async r=>{c(r),await e.bucket.delete(r)},u=async r=>{if(c(r),e.bucket.head){const n=await e.bucket.head(r);return n&&w(n)}const t=await e.bucket.get(r,{range:{length:0}});return t&&w(t)},s=async(r,t={})=>{if(r?.includes("\0"))throw new a("VALIDATION_ERROR","@lunora/storage: prefix contains NUL byte");const n=t.limit??A,y=Math.min(Math.max(1,Math.floor(n)),I),d=await e.bucket.list({cursor:t.cursor,delimiter:t.delimiter,limit:y,prefix:r});return{cursor:d.cursor,objects:d.objects.map(g=>S(g)),truncated:d.truncated}},l=r=>{if(!e.publicBaseUrl)throw new a("INTERNAL","@lunora/storage: `publicBaseUrl` is required for getUrl()");c(r);const t=r.split("/").map(n=>encodeURIComponent(n)).join("/");return`${T(e.publicBaseUrl)}/${t}`},h=async(r,t={})=>{if(!e.publicBaseUrl)throw new a("INTERNAL","@lunora/storage: `publicBaseUrl` is required for getSignedUrl()");if(!e.signingSecret)throw new a("INTERNAL","@lunora/storage: `signingSecret` is required for getSignedUrl()");return c(r),k({baseUrl:e.publicBaseUrl,contentType:t.contentType,expiresInSeconds:t.expiresInSeconds,key:r,method:t.method,secret:e.signingSecret})};return{createMultipartUpload:async(r,t={})=>{if(c(r),!e.bucket.createMultipartUpload)throw new a("INTERNAL","@lunora/storage: bucket binding does not support multipart uploads (createMultipartUpload)");return e.bucket.createMultipartUpload(r,{customMetadata:t.customMetadata,httpMetadata:t.contentType?{contentType:t.contentType}:void 0})},delete:p,download:i,generateUploadUrl:async(r,t={})=>h(r,{contentType:t.contentType,expiresInSeconds:t.expiresInSeconds,method:"PUT"}),getMetadata:u,getPresignedUrl:async(r,t={})=>{if(!e.s3)throw new a("INTERNAL","@lunora/storage: `s3` credentials are required for getPresignedUrl() — pass { accountId, accessKeyId, secretAccessKey, bucket }");return c(r),R({credentials:e.s3,expiresInSeconds:t.expiresInSeconds,key:r,method:t.method})},getSignedUrl:h,getUrl:l,list:s,resumeMultipartUpload:(r,t)=>{if(c(r),typeof t!="string"||t.length===0)throw new a("VALIDATION_ERROR","@lunora/storage: resumeMultipartUpload requires a non-empty uploadId");if(!e.bucket.resumeMultipartUpload)throw new a("INTERNAL","@lunora/storage: bucket binding does not support multipart uploads (resumeMultipartUpload)");return e.bucket.resumeMultipartUpload(r,t)},store:async(r,t,n={})=>o(r,t,n),upload:o}};export{v as createStorage,O as scopeKey};

package/dist/packem_shared/internal-DpjlEJPE.mjs

@@ -0,0 +1 @@
+const o=e=>{const t=new Uint8Array(e);let n="";for(const r of t)n+=r.toString(16).padStart(2,"0");return n},a=e=>{let t=e.length;for(;t>0&&e[t-1]==="/";)t-=1;return e.slice(0,t)};export{o as a,a as t};

package/dist/upload.mjs

@@ -1 +1 @@
-export { createR2UploadStorage, createUploadHandler } from './packem_shared/createR2UploadStorage-BfLIpWdf.mjs';
+import{createR2UploadStorage as r,createUploadHandler as o}from"./packem_shared/createR2UploadStorage-BSgOjRvv.mjs";export{r as createR2UploadStorage,o as createUploadHandler};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/storage",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.13",
   "description": "R2-backed storage for Lunora: typed buckets and signed URLs",
   "keywords": [
     "cloudflare",
@@ -50,7 +50,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.7",
+    "@lunora/errors": "1.0.0-alpha.9",
     "@visulima/storage": "1.0.5",
     "aws4fetch": "1.0.20"
   },

package/dist/packem_shared/buildPresignedUrl-B5f1wvz6.mjs

@@ -1,64 +0,0 @@
-import { a as toHex } from './internal-Dqk0MrAj.mjs';
-
-const REGION = "auto";
-const SERVICE = "s3";
-const ALGORITHM = "AWS4-HMAC-SHA256";
-const MIN_EXPIRES_SECONDS = 1;
-const MAX_EXPIRES_SECONDS = 7 * 24 * 60 * 60;
-const DEFAULT_EXPIRES_SECONDS = 900;
-const textEncoder = new TextEncoder();
-const compareEntries = (a, b) => {
-  if (a[0] < b[0]) {
-    return -1;
-  }
-  return a[0] > b[0] ? 1 : 0;
-};
-const encodeRfc3986 = (value) => encodeURIComponent(value).replaceAll(/[!'()*]/gu, (char) => `%${char.codePointAt(0)?.toString(16).toUpperCase() ?? ""}`);
-const encodeKey = (key) => key.split("/").map((segment) => encodeRfc3986(segment)).join("/");
-const sha256Hex = async (input) => toHex(await crypto.subtle.digest("SHA-256", textEncoder.encode(input)));
-const hmac = async (key, message) => {
-  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
-  return crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(message));
-};
-const deriveSigningKey = async (secretAccessKey, dateStamp) => {
-  const dateKey = await hmac(textEncoder.encode(`AWS4${secretAccessKey}`), dateStamp);
-  const regionKey = await hmac(dateKey, REGION);
-  const serviceKey = await hmac(regionKey, SERVICE);
-  return hmac(serviceKey, "aws4_request");
-};
-const endpointHost = (credentials) => {
-  const infix = credentials.jurisdiction === void 0 ? "" : `${credentials.jurisdiction}.`;
-  return `${credentials.accountId}.${infix}r2.cloudflarestorage.com`;
-};
-const formatAmzDate = (date) => {
-  const amzDate = `${date.toISOString().replaceAll(/[:-]/gu, "").slice(0, 15)}Z`;
-  return { amzDate, dateStamp: amzDate.slice(0, 8) };
-};
-const buildPresignedUrl = async (parameters) => {
-  const { credentials, key } = parameters;
-  const method = parameters.method ?? "GET";
-  const requested = parameters.expiresInSeconds ?? DEFAULT_EXPIRES_SECONDS;
-  const normalised = Number.isFinite(requested) ? requested : DEFAULT_EXPIRES_SECONDS;
-  const expires = Math.min(Math.max(MIN_EXPIRES_SECONDS, Math.floor(normalised)), MAX_EXPIRES_SECONDS);
-  const host = endpointHost(credentials);
-  const date = new Date(parameters.now?.() ?? Date.now());
-  const { amzDate, dateStamp } = formatAmzDate(date);
-  const credentialScope = `${dateStamp}/${REGION}/${SERVICE}/aws4_request`;
-  const canonicalUri = `/${encodeRfc3986(credentials.bucket)}/${encodeKey(key)}`;
-  const query = [
-    ["X-Amz-Algorithm", ALGORITHM],
-    ["X-Amz-Credential", `${credentials.accessKeyId}/${credentialScope}`],
-    ["X-Amz-Date", amzDate],
-    ["X-Amz-Expires", expires.toString()],
-    ["X-Amz-SignedHeaders", "host"]
-  ];
-  const canonicalQuery = query.map(([name, value]) => [encodeRfc3986(name), encodeRfc3986(value)]).toSorted(compareEntries).map(([name, value]) => `${name}=${value}`).join("&");
-  const canonicalRequest = [method, canonicalUri, canonicalQuery, `host:${host}
-`, "host", "UNSIGNED-PAYLOAD"].join("\n");
-  const stringToSign = [ALGORITHM, amzDate, credentialScope, await sha256Hex(canonicalRequest)].join("\n");
-  const signingKey = await deriveSigningKey(credentials.secretAccessKey, dateStamp);
-  const signature = toHex(await hmac(signingKey, stringToSign));
-  return `https://${host}${canonicalUri}?${canonicalQuery}&X-Amz-Signature=${signature}`;
-};
-
-export { buildPresignedUrl };

package/dist/packem_shared/buildSignedUrl-rt-6azia.mjs

@@ -1,124 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { t as trimTrailingSlashes } from './internal-Dqk0MrAj.mjs';
-
-const evictOldestEntry = (map, capacity) => {
-  if (map.size < capacity) {
-    return;
-  }
-  const oldest = map.keys().next().value;
-  if (oldest !== void 0) {
-    map.delete(oldest);
-  }
-};
-
-const textEncoder = new TextEncoder();
-const MAX_SIGNED_URL_TTL_SECONDS = 7 * 24 * 60 * 60;
-const SCHEME_PREFIX_RE = /^[a-z][a-z0-9+\-.]*:\/\//i;
-const toBase64Url = (bytes) => {
-  const binary = String.fromCodePoint(...bytes);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-};
-const fromBase64Url = (input) => {
-  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.codePointAt(index) ?? 0;
-  }
-  return bytes;
-};
-const KEY_CACHE_MAX = 64;
-const keyCache = /* @__PURE__ */ new Map();
-const importHmacKey = async (secret) => {
-  const cached = keyCache.get(secret);
-  if (cached) {
-    return cached;
-  }
-  evictOldestEntry(keyCache, KEY_CACHE_MAX);
-  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
-  keyCache.set(secret, keyPromise);
-  return keyPromise;
-};
-const extractHost = (input) => {
-  try {
-    return new URL(input).host;
-  } catch {
-    const noScheme = input.replace(SCHEME_PREFIX_RE, "");
-    return noScheme.split("/")[0] ?? "";
-  }
-};
-const signCanonical = async (secret, canonical) => {
-  const cryptoKey = await importHmacKey(secret);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
-  return toBase64Url(new Uint8Array(signature));
-};
-const verifyCanonical = async (secret, canonical, sigBytes) => {
-  const cryptoKey = await importHmacKey(secret);
-  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
-};
-
-const LEADING_SLASH_RE = /^\//;
-const canonicalize = (method, host, key, exp, contentType) => {
-  const base = `${method}
-${host.toLowerCase()}
-${key}
-${String(exp)}`;
-  return contentType === void 0 ? base : `${base}
-${contentType}`;
-};
-const buildSignedUrl = async (args) => {
-  const method = args.method ?? "GET";
-  const expiresInSeconds = args.expiresInSeconds ?? 60 * 60;
-  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: expiresInSeconds must be a positive finite number");
-  }
-  if (expiresInSeconds > MAX_SIGNED_URL_TTL_SECONDS) {
-    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: expiresInSeconds must not exceed ${String(MAX_SIGNED_URL_TTL_SECONDS)} (7 days)`);
-  }
-  const contentType = method === "PUT" ? args.contentType : void 0;
-  const exp = Math.floor(Date.now() / 1e3) + expiresInSeconds;
-  const host = extractHost(args.baseUrl);
-  const sig = await signCanonical(args.secret, canonicalize(method, host, args.key, exp, contentType));
-  const base = trimTrailingSlashes(args.baseUrl);
-  const safeKey = args.key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
-  const ctParameter = contentType === void 0 ? "" : `&ct=${encodeURIComponent(contentType)}`;
-  return `${base}/${safeKey}?exp=${String(exp)}&method=${method}&sig=${sig}${ctParameter}`;
-};
-const verifySignedUrl = async (input, secret, options) => {
-  let url;
-  try {
-    url = input instanceof URL ? input : new URL(input);
-  } catch {
-    return { reason: "malformed", valid: false };
-  }
-  const expRaw = url.searchParams.get("exp");
-  const exp = expRaw === null ? Number.NaN : Number(expRaw);
-  const sig = url.searchParams.get("sig");
-  const method = url.searchParams.get("method") ?? "GET";
-  const contentType = url.searchParams.get("ct") ?? void 0;
-  if (!sig || !Number.isInteger(exp)) {
-    return { reason: "malformed", valid: false };
-  }
-  if (exp < Math.floor(Date.now() / 1e3)) {
-    return { reason: "expired", valid: false };
-  }
-  if (method !== "GET" && method !== "PUT") {
-    return { reason: "malformed", valid: false };
-  }
-  let key;
-  let sigBytes;
-  try {
-    key = url.pathname.replace(LEADING_SLASH_RE, "").split("/").map((segment) => decodeURIComponent(segment)).join("/");
-    sigBytes = fromBase64Url(sig);
-  } catch {
-    return { reason: "malformed", valid: false };
-  }
-  const host = options?.expectedHost === void 0 ? url.host : extractHost(options.expectedHost);
-  const valid = await verifyCanonical(secret, canonicalize(method, host, key, exp, contentType), sigBytes);
-  if (!valid) {
-    return { reason: "bad_signature", valid: false };
-  }
-  return { contentType, key, method, valid: true };
-};
-
-export { buildSignedUrl, verifySignedUrl };

package/dist/packem_shared/createBucketStorage-JYdrS4e5.mjs

@@ -1,28 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-
-const createBucketStorage = (buckets, options = {}) => {
-  const names = Object.keys(buckets);
-  const [firstName] = names;
-  if (firstName === void 0) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: createBucketStorage requires at least one bucket");
-  }
-  if (options.default !== void 0 && !buckets[options.default]) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: default bucket "${options.default}" is not in the bucket map (have: ${names.join(", ")})`);
-  }
-  const defaultTag = options.default ?? "default";
-  const defaultBinding = buckets[defaultTag] ?? buckets[firstName];
-  if (defaultBinding === void 0) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: default bucket "${defaultTag}" is not in the bucket map (have: ${names.join(", ")})`);
-  }
-  const addressable = [.../* @__PURE__ */ new Set([defaultTag, ...names])];
-  const make = (name) => {
-    const target = name === defaultTag ? defaultBinding : buckets[name];
-    if (!target) {
-      throw new LunoraError("INTERNAL", `@lunora/storage: no bucket registered for "${name}". Known buckets: ${addressable.join(", ")}`);
-    }
-    return { ...target, bucket: (next) => make(next), bucketName: name };
-  };
-  return make(defaultTag);
-};
-
-export { createBucketStorage };

package/dist/packem_shared/createR2UploadStorage-BfLIpWdf.mjs

@@ -1,54 +0,0 @@
-import { Rest, Multipart, Tus } from '@visulima/storage/handler/http/fetch';
-import { AwsLightStorage } from '@visulima/storage/provider/aws-light';
-
-const TUS_RESUMABLE = "1.0.0";
-const denyResponse = (protocol) => {
-  const headers = { "content-type": "application/json" };
-  if (protocol === "tus") {
-    headers["Tus-Resumable"] = TUS_RESUMABLE;
-  }
-  return Response.json({ error: { code: "FORBIDDEN", message: "Upload denied by authorization policy", name: "ForbiddenError" } }, { headers, status: 403 });
-};
-const instantiateHandler = (protocol, handlerOptions) => {
-  if (protocol === "chunked-rest") {
-    return new Rest(handlerOptions);
-  }
-  if (protocol === "multipart") {
-    return new Multipart(handlerOptions);
-  }
-  return new Tus(handlerOptions);
-};
-const createUploadHandler = (options) => {
-  const protocol = options.protocol ?? "tus";
-  const handlerOptions = {
-    storage: options.storage,
-    ...options.maxFileSize === void 0 ? {} : { maxFileSize: options.maxFileSize }
-  };
-  const handler = instantiateHandler(protocol, handlerOptions);
-  const { authorize } = options;
-  const fetch = async (request) => {
-    if (authorize !== void 0) {
-      try {
-        const allowed = await authorize({ method: request.method, protocol, request, url: new URL(request.url) });
-        if (!allowed) {
-          return denyResponse(protocol);
-        }
-      } catch {
-        return denyResponse(protocol);
-      }
-    }
-    return handler.fetch(request);
-  };
-  return { fetch, protocol };
-};
-const createR2UploadStorage = (options) => new AwsLightStorage({
-  accessKeyId: options.accessKeyId,
-  bucket: options.bucket,
-  endpoint: options.endpoint ?? `https://${options.accountId}.r2.cloudflarestorage.com`,
-  path: options.path ?? "/",
-  region: "auto",
-  secretAccessKey: options.secretAccessKey,
-  ...options.partSize === void 0 ? {} : { partSize: options.partSize }
-});
-
-export { createR2UploadStorage, createUploadHandler };

package/dist/packem_shared/createStorage-Bu6GJB25.mjs

@@ -1,261 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { t as trimTrailingSlashes, a as toHex } from './internal-Dqk0MrAj.mjs';
-import { buildPresignedUrl } from './buildPresignedUrl-B5f1wvz6.mjs';
-import { buildSignedUrl } from './buildSignedUrl-rt-6azia.mjs';
-
-const MAX_KEY_LENGTH = 1024;
-const MAX_LIST_LIMIT = 1e3;
-const DEFAULT_LIST_LIMIT = 100;
-const toBase64 = (buffer) => {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCodePoint(byte);
-  }
-  return btoa(binary);
-};
-const withSha256 = (object) => {
-  const raw = object.checksums?.sha256;
-  if (raw === void 0) {
-    return object;
-  }
-  const sha256 = toHex(raw);
-  const sha256Base64 = toBase64(raw);
-  return /* @__PURE__ */ new Proxy(object, {
-    get(target, property) {
-      if (property === "sha256") {
-        return sha256;
-      }
-      if (property === "sha256Base64") {
-        return sha256Base64;
-      }
-      const value = Reflect.get(target, property, target);
-      return typeof value === "function" ? value.bind(target) : value;
-    },
-    has(target, property) {
-      return property === "sha256" || property === "sha256Base64" || Reflect.has(target, property);
-    }
-  });
-};
-const toMetadata = (object) => {
-  const raw = object.checksums?.sha256;
-  return {
-    contentType: object.httpMetadata?.contentType,
-    customMetadata: object.customMetadata,
-    key: object.key,
-    sha256: raw === void 0 ? void 0 : toHex(raw),
-    size: object.size,
-    uploaded: object.uploaded === void 0 ? void 0 : object.uploaded.getTime()
-  };
-};
-const toListObject = (object) => {
-  const raw = object.checksums?.sha256;
-  return {
-    checksums: object.checksums,
-    customMetadata: object.customMetadata,
-    etag: object.etag,
-    httpEtag: object.httpEtag,
-    httpMetadata: object.httpMetadata,
-    key: object.key,
-    sha256: raw === void 0 ? void 0 : toHex(raw),
-    sha256Base64: raw === void 0 ? void 0 : toBase64(raw),
-    size: object.size,
-    uploaded: object.uploaded
-  };
-};
-const enforceStreamMaxSize = (stream, maxSize) => {
-  let seen = 0;
-  const byteLengthOf = (chunk) => {
-    if (chunk instanceof ArrayBuffer) {
-      return chunk.byteLength;
-    }
-    return ArrayBuffer.isView(chunk) ? chunk.byteLength : void 0;
-  };
-  const counter = new TransformStream({
-    transform(chunk, controller) {
-      const length = byteLengthOf(chunk);
-      if (length === void 0) {
-        controller.error(new Error("@lunora/storage: stream chunk is not a byte chunk; cannot enforce maxSize"));
-        return;
-      }
-      seen += length;
-      if (seen > maxSize) {
-        controller.error(new Error(`@lunora/storage: stream body exceeds maxSize (> ${String(maxSize)} bytes)`));
-        return;
-      }
-      controller.enqueue(chunk);
-    }
-  });
-  return stream.pipeThrough(counter);
-};
-const validateKey = (key) => {
-  if (typeof key !== "string" || key.length === 0) {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key must be a non-empty string");
-  }
-  if (key.length > MAX_KEY_LENGTH) {
-    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
-  }
-  if (key.includes("\0")) {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key contains NUL byte");
-  }
-  if (key.startsWith("/")) {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key must not start with `/`");
-  }
-  const segments = key.split("/");
-  for (const segment of segments) {
-    if (segment === "..") {
-      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key contains a `..` path component");
-    }
-  }
-};
-const scopeKey = (prefix, key) => {
-  validateKey(prefix);
-  validateKey(key);
-  const trimmedPrefix = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
-  const composed = `${trimmedPrefix}/${key}`;
-  if (composed.length > MAX_KEY_LENGTH) {
-    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: scoped key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
-  }
-  return composed;
-};
-const createStorage = (options) => {
-  if (!options.bucket) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: `bucket` is required");
-  }
-  const upload = async (key, body, uploadOptions = {}) => {
-    validateKey(key);
-    if (uploadOptions.allowedContentTypes !== void 0) {
-      if (uploadOptions.contentType === void 0) {
-        throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: contentType is required when allowedContentTypes is set");
-      }
-      if (!uploadOptions.allowedContentTypes.includes(uploadOptions.contentType)) {
-        throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: contentType "${uploadOptions.contentType}" not in allowedContentTypes`);
-      }
-    }
-    let putBody = body;
-    if (typeof uploadOptions.maxSize === "number") {
-      let size;
-      if (body instanceof ArrayBuffer) {
-        size = body.byteLength;
-      } else if (body instanceof Blob) {
-        size = body.size;
-      }
-      if (size !== void 0 && size > uploadOptions.maxSize) {
-        throw new LunoraError("PAYLOAD_TOO_LARGE", `@lunora/storage: body exceeds maxSize (${String(size)} > ${String(uploadOptions.maxSize)})`);
-      }
-      if (body instanceof ReadableStream) {
-        putBody = enforceStreamMaxSize(body, uploadOptions.maxSize);
-      }
-    }
-    const object = await options.bucket.put(key, putBody, {
-      customMetadata: uploadOptions.customMetadata,
-      httpMetadata: uploadOptions.contentType ? { contentType: uploadOptions.contentType } : void 0
-    });
-    return { etag: object.etag, httpEtag: object.httpEtag ?? `"${object.etag}"`, key: object.key };
-  };
-  const download = async (key, downloadOptions = {}) => {
-    validateKey(key);
-    const object = await (downloadOptions.range ? options.bucket.get(key, { range: downloadOptions.range }) : options.bucket.get(key));
-    return object && withSha256(object);
-  };
-  const deleteObject = async (key) => {
-    validateKey(key);
-    await options.bucket.delete(key);
-  };
-  const getMetadata = async (key) => {
-    validateKey(key);
-    if (options.bucket.head) {
-      const head = await options.bucket.head(key);
-      return head && toMetadata(head);
-    }
-    const object = await options.bucket.get(key, { range: { length: 0 } });
-    return object && toMetadata(object);
-  };
-  const list = async (prefix, listOptions = {}) => {
-    if (prefix?.includes("\0")) {
-      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: prefix contains NUL byte");
-    }
-    const requested = listOptions.limit ?? DEFAULT_LIST_LIMIT;
-    const limit = Math.min(Math.max(1, Math.floor(requested)), MAX_LIST_LIMIT);
-    const result = await options.bucket.list({ cursor: listOptions.cursor, delimiter: listOptions.delimiter, limit, prefix });
-    return { cursor: result.cursor, objects: result.objects.map((object) => toListObject(object)), truncated: result.truncated };
-  };
-  const getUrl = (key) => {
-    if (!options.publicBaseUrl) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: `publicBaseUrl` is required for getUrl()");
-    }
-    validateKey(key);
-    const safeKey = key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
-    return `${trimTrailingSlashes(options.publicBaseUrl)}/${safeKey}`;
-  };
-  const getSignedUrl = async (key, signedOptions = {}) => {
-    if (!options.publicBaseUrl) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: `publicBaseUrl` is required for getSignedUrl()");
-    }
-    if (!options.signingSecret) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: `signingSecret` is required for getSignedUrl()");
-    }
-    validateKey(key);
-    return buildSignedUrl({
-      baseUrl: options.publicBaseUrl,
-      contentType: signedOptions.contentType,
-      expiresInSeconds: signedOptions.expiresInSeconds,
-      key,
-      method: signedOptions.method,
-      secret: options.signingSecret
-    });
-  };
-  const createMultipartUpload = async (key, multipartOptions = {}) => {
-    validateKey(key);
-    if (!options.bucket.createMultipartUpload) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: bucket binding does not support multipart uploads (createMultipartUpload)");
-    }
-    return options.bucket.createMultipartUpload(key, {
-      customMetadata: multipartOptions.customMetadata,
-      httpMetadata: multipartOptions.contentType ? { contentType: multipartOptions.contentType } : void 0
-    });
-  };
-  const resumeMultipartUpload = (key, uploadId) => {
-    validateKey(key);
-    if (typeof uploadId !== "string" || uploadId.length === 0) {
-      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: resumeMultipartUpload requires a non-empty uploadId");
-    }
-    if (!options.bucket.resumeMultipartUpload) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: bucket binding does not support multipart uploads (resumeMultipartUpload)");
-    }
-    return options.bucket.resumeMultipartUpload(key, uploadId);
-  };
-  const getPresignedUrl = async (key, presignedOptions = {}) => {
-    if (!options.s3) {
-      throw new LunoraError(
-        "INTERNAL",
-        "@lunora/storage: `s3` credentials are required for getPresignedUrl() — pass { accountId, accessKeyId, secretAccessKey, bucket }"
-      );
-    }
-    validateKey(key);
-    return buildPresignedUrl({
-      credentials: options.s3,
-      expiresInSeconds: presignedOptions.expiresInSeconds,
-      key,
-      method: presignedOptions.method
-    });
-  };
-  const generateUploadUrl = async (key, uploadUrlOptions = {}) => getSignedUrl(key, { contentType: uploadUrlOptions.contentType, expiresInSeconds: uploadUrlOptions.expiresInSeconds, method: "PUT" });
-  const store = async (key, body, storeOptions = {}) => upload(key, body, storeOptions);
-  return {
-    createMultipartUpload,
-    delete: deleteObject,
-    download,
-    generateUploadUrl,
-    getMetadata,
-    getPresignedUrl,
-    getSignedUrl,
-    getUrl,
-    list,
-    resumeMultipartUpload,
-    store,
-    upload
-  };
-};
-
-export { createStorage, scopeKey };

package/dist/packem_shared/internal-Dqk0MrAj.mjs

@@ -1,17 +0,0 @@
-const toHex = (buffer) => {
-  const bytes = new Uint8Array(buffer);
-  let out = "";
-  for (const byte of bytes) {
-    out += byte.toString(16).padStart(2, "0");
-  }
-  return out;
-};
-const trimTrailingSlashes = (value) => {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") {
-    end -= 1;
-  }
-  return value.slice(0, end);
-};
-
-export { toHex as a, trimTrailingSlashes as t };