@lunora/storage 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/index.d.ts

@@ -1,140 +1,11 @@
+import { R2MultipartUploadLike, R2RangeLike, R2ObjectBodyLike, R2ObjectLike, R2BucketLike } from '@lunora/platform';
+export type { R2BucketLike, R2MultipartUploadLike, R2ObjectBodyLike, R2ObjectLike, R2RangeLike, R2UploadedPartLike } from '@lunora/platform';
 /**
-* A single-range read against R2: an `{ offset, length }` window (at least one
-* bound required, mirroring R2's own `R2Range`) or a `{ suffix }` tail. The
-* subset of `R2Range` that {@link Storage.download} forwards so a caller can
-* stream just the bytes it needs instead of the whole object.
-*/
-type R2RangeLike = {
-  length: number;
-  offset?: number;
-} | {
-  length?: number;
-  offset: number;
-} | {
-  suffix: number;
-};
-/**
-* Minimal projection of `R2Bucket`. Declared structurally so unit tests can
-* pass a plain object double; the real binding satisfies the same shape.
-*/
-interface R2BucketLike {
-  /**
-  * Begin a multipart upload (R2 `createMultipartUpload`). Optional so existing
-  * test doubles still satisfy the type; {@link Storage.createMultipartUpload}
-  * throws a clear error when the binding lacks it.
-  */
-  createMultipartUpload?: (key: string, options?: {
-    customMetadata?: Record<string, string>;
-    httpMetadata?: {
-      contentType?: string;
-    };
-  }) => Promise<R2MultipartUploadLike>;
-  delete: (key: string) => Promise<void>;
-  get: (key: string, options?: {
-    range?: R2RangeLike;
-  }) => Promise<R2ObjectBodyLike | null>;
-  /**
-  * Fetch an object's metadata without its body (R2 HEAD). Returns `null` when
-  * the object is absent. Declared optional so existing test doubles that only
-  * implement `get`/`put`/`list`/`delete` still satisfy the type; callers that
-  * need metadata fall back to a 0-length ranged `get()` when `head` is absent.
-  */
-  head?: (key: string) => Promise<R2ObjectLike | null>;
-  list: (options?: {
-    cursor?: string;
-    delimiter?: string;
-    limit?: number;
-    prefix?: string;
-  }) => Promise<{
-    cursor?: string;
-    objects: R2ObjectLike[];
-    truncated?: boolean;
-  }>;
-  put: (key: string, body: ReadableStream | ArrayBuffer | Blob | string | null, options?: {
-    customMetadata?: Record<string, string>;
-    httpMetadata?: {
-      contentType?: string;
-    };
-  }) => Promise<R2ObjectLike>;
-  /** Resume an in-progress multipart upload by id (R2 `resumeMultipartUpload`). Optional; see {@link Storage.resumeMultipartUpload}. */
-  resumeMultipartUpload?: (key: string, uploadId: string) => R2MultipartUploadLike;
-}
-/** One uploaded multipart part — returned by `uploadPart`, required to `complete`. Mirrors R2's `R2UploadedPart`. */
-interface R2UploadedPartLike {
-  etag: string;
-  partNumber: number;
-}
-/**
-* An in-progress multipart upload, mirroring R2's `R2MultipartUpload`. Each part
-* (except the last) must be uniform in size. The object does not guarantee the
-* underlying upload still exists — a parallel `complete`/`abort` can invalidate
-* it — so wrap each call in error handling.
-*/
-interface R2MultipartUploadLike {
-  /** Abort the upload, discarding any uploaded parts. */
-  abort: () => Promise<void>;
-  /** Finish the upload from the collected parts; resolves to the stored object. */
-  complete: (uploadedParts: R2UploadedPartLike[]) => Promise<R2ObjectLike>;
-  /** The object key being assembled. */
-  readonly key: string;
-  /** The R2 upload id (persist it to resume across requests). */
-  readonly uploadId: string;
-  /** Upload one part (1-indexed); returns the `{ partNumber, etag }` to pass to `complete`. */
-  uploadPart: (partNumber: number, value: ArrayBuffer | ArrayBufferView | Blob | ReadableStream | string) => Promise<R2UploadedPartLike>;
-}
-interface R2ObjectLike {
-  /**
-  * R2-computed checksums. The real binding exposes `sha256` as an
-  * `ArrayBuffer` (present only when R2 stored a SHA-256 for the object);
-  * declared optional so fakes and non-checksummed objects type-check.
-  */
-  checksums?: {
-    sha256?: ArrayBuffer;
-  };
-  customMetadata?: Record<string, string>;
-  etag: string;
-  /**
-  * The quoted form of {@link R2ObjectLike.etag} (e.g. `"abc123"`), suitable
-  * for emitting directly as an HTTP `ETag` header. The real binding always
-  * provides it; declared optional so existing doubles that only set `etag`
-  * still type-check (callers fall back to quoting `etag`).
-  */
-  httpEtag?: string;
-  httpMetadata?: {
-    contentType?: string;
-  };
-  key: string;
-  /**
-  * Hex-encoded SHA-256 of the object body, surfaced by `download()`/`list()`
-  * when R2 carries a checksum (derived from {@link R2ObjectLike.checksums}).
-  */
-  sha256?: string;
-  /**
-  * Base64-encoded SHA-256 of the object body, surfaced alongside
-  * {@link R2ObjectLike.sha256} from the same checksum. Base64 is the encoding
-  * RFC 9530 digest headers (`Repr-Digest`/`Content-Digest`) require, so HTTP
-  * layers can emit a spec-compliant digest without re-deriving it.
-  */
-  sha256Base64?: string;
-  size: number;
-  /**
-  * When the object was written. The real binding exposes this as a `Date`;
-  * declared optional so fakes that omit it still type-check.
-  * {@link Storage.getMetadata} normalises it to epoch ms.
-  */
-  uploaded?: Date;
-}
-interface R2ObjectBodyLike extends R2ObjectLike {
-  arrayBuffer: () => Promise<ArrayBuffer>;
-  body: ReadableStream | null;
-  text: () => Promise<string>;
-}
-/**
-* R2 S3-API credentials for {@link Storage.getPresignedUrl}. These are an R2 API
-* token's Access Key ID / Secret Access Key (NOT a Cloudflare API token), plus
-* the account id and bucket name. Required only if you call `getPresignedUrl`;
-* the worker-signed URL path (`getSignedUrl`) needs none of this.
-*/
+ * R2 S3-API credentials for {@link Storage.getPresignedUrl}. These are an R2 API
+ * token's Access Key ID / Secret Access Key (NOT a Cloudflare API token), plus
+ * the account id and bucket name. Required only if you call `getPresignedUrl`;
+ * the worker-signed URL path (`getSignedUrl`) needs none of this.
+ */
 interface R2S3Credentials {
   /** R2 S3 Access Key ID. */
   accessKeyId: string;
@@ -159,10 +30,10 @@ interface LunoraStorageOptions {
   /** Public base URL used by `getSignedUrl()`. Required for signed URLs. */
   publicBaseUrl?: string;
   /**
-  * R2 S3-API credentials enabling {@link Storage.getPresignedUrl} (native S3
-  * presigned URLs that hit R2 directly, bypassing the Worker). Omit to use
-  * only the worker-signed URL path.
-  */
+   * R2 S3-API credentials enabling {@link Storage.getPresignedUrl} (native S3
+   * presigned URLs that hit R2 directly, bypassing the Worker). Omit to use
+   * only the worker-signed URL path.
+   */
   s3?: R2S3Credentials;
   /** HMAC secret used by the worker-signed URL helper. Required for signed URLs. */
   signingSecret?: string;
@@ -173,13 +44,13 @@ interface UploadOptions {
   contentType?: string;
   customMetadata?: Record<string, string>;
   /**
-  * Maximum body size in bytes. For `ArrayBuffer`/`Blob` sources the length is
-  * known up front and rejected before the upload starts. For a
-  * `ReadableStream` the length isn't known synchronously, so the stream is
-  * piped through a byte counter that aborts the upload once the limit is
-  * exceeded — this also guards against R2 silently accepting/truncating an
-  * unbounded stream.
-  */
+   * Maximum body size in bytes. For `ArrayBuffer`/`Blob` sources the length is
+   * known up front and rejected before the upload starts. For a
+   * `ReadableStream` the length isn't known synchronously, so the stream is
+   * piped through a byte counter that aborts the upload once the limit is
+   * exceeded — this also guards against R2 silently accepting/truncating an
+   * unbounded stream.
+   */
   maxSize?: number;
 }
 interface ListOptions {
@@ -191,20 +62,20 @@ interface ListOptions {
 }
 interface SignedUrlOptions {
   /**
-  * Pin the `Content-Type` an uploader must send on a `method: "PUT"` URL.
-  * Baked into the HMAC canonical so the signature only authorizes a PUT with
-  * exactly this content-type; mirrored on the URL as `&amp;ct=...`. Ignored for
-  * `GET` URLs (a download has no request body content-type to pin).
-  */
+   * Pin the `Content-Type` an uploader must send on a `method: "PUT"` URL.
+   * Baked into the HMAC canonical so the signature only authorizes a PUT with
+   * exactly this content-type; mirrored on the URL as `&ct=...`. Ignored for
+   * `GET` URLs (a download has no request body content-type to pin).
+   */
   contentType?: string;
   expiresInSeconds?: number;
   method?: "GET" | "PUT";
 }
 /**
-* Per-object metadata returned by {@link Storage.getMetadata} — a flat,
-* body-free projection of {@link R2ObjectLike}. Mirrors the shape Convex
-* surfaces for `ctx.storage.getMetadata` / the `_storage` system table.
-*/
+ * Per-object metadata returned by {@link Storage.getMetadata} — a flat,
+ * body-free projection of {@link R2ObjectLike}. Mirrors the shape Convex
+ * surfaces for `ctx.storage.getMetadata` / the `_storage` system table.
+ */
 interface ObjectMetadata {
   /** The object's `Content-Type` (R2 `httpMetadata.contentType`), if recorded. */
   contentType?: string;
@@ -221,49 +92,49 @@ interface ObjectMetadata {
 }
 interface Storage {
   /**
-  * Begin a native R2 **multipart upload** for very large objects — upload
-  * parts (each uniform in size except the last), then `complete` with the
-  * returned parts (or `abort`). Wraps R2's `createMultipartUpload`; throws if
-  * the bound bucket doesn't support it. For ordinary uploads use
-  * {@link Storage.upload} / {@link Storage.store}.
-  */
+   * Begin a native R2 **multipart upload** for very large objects — upload
+   * parts (each uniform in size except the last), then `complete` with the
+   * returned parts (or `abort`). Wraps R2's `createMultipartUpload`; throws if
+   * the bound bucket doesn't support it. For ordinary uploads use
+   * {@link Storage.upload} / {@link Storage.store}.
+   */
   createMultipartUpload: (key: string, options?: {
     contentType?: string;
     customMetadata?: Record<string, string>;
   }) => Promise<R2MultipartUploadLike>;
   delete: (key: string) => Promise<void>;
   /**
-  * Fetch a stored object's metadata + body. Pass `options.range` to stream
-  * only a byte window (R2 resolves the range server-side, so the unwanted
-  * bytes never reach the Worker) — `download(key)` reads the whole object.
-  */
+   * Fetch a stored object's metadata + body. Pass `options.range` to stream
+   * only a byte window (R2 resolves the range server-side, so the unwanted
+   * bytes never reach the Worker) — `download(key)` reads the whole object.
+   */
   download: (key: string, options?: {
     range?: R2RangeLike;
   }) => Promise<R2ObjectBodyLike | null>;
   /**
-  * Mint a short-lived signed `PUT` URL a client can upload directly to,
-  * optionally pinning the request `Content-Type`. Convex-compatible alias
-  * built on {@link Storage.getSignedUrl} with `method: "PUT"`.
-  */
+   * Mint a short-lived signed `PUT` URL a client can upload directly to,
+   * optionally pinning the request `Content-Type`. Convex-compatible alias
+   * built on {@link Storage.getSignedUrl} with `method: "PUT"`.
+   */
   generateUploadUrl: (key: string, options?: {
     contentType?: string;
     expiresInSeconds?: number;
   }) => Promise<string>;
   /**
-  * Read a stored object's metadata (size, content-type, sha256, upload time,
-  * custom metadata) without fetching its body. Returns `null` when the object
-  * is absent. Backed by an R2 HEAD (`bucket.head`) when available, falling
-  * back to a 0-length ranged `get()` otherwise. Mirrors Convex's
-  * `ctx.storage.getMetadata`.
-  */
+   * Read a stored object's metadata (size, content-type, sha256, upload time,
+   * custom metadata) without fetching its body. Returns `null` when the object
+   * is absent. Backed by an R2 HEAD (`bucket.head`) when available, falling
+   * back to a 0-length ranged `get()` otherwise. Mirrors Convex's
+   * `ctx.storage.getMetadata`.
+   */
   getMetadata: (key: string) => Promise<ObjectMetadata | null>;
   /**
-  * Mint a native S3 **presigned URL** (SigV4) that hits R2 directly, bypassing
-  * the Worker. Use for large downloads/uploads where you don't need per-request
-  * app gating and want the bytes off the Worker's CPU/bandwidth budget. Requires
-  * {@link LunoraStorageOptions.s3} credentials; throws if they're absent. For
-  * app-gated access (auth/policy/rate-limit) prefer {@link Storage.getSignedUrl}.
-  */
+   * Mint a native S3 **presigned URL** (SigV4) that hits R2 directly, bypassing
+   * the Worker. Use for large downloads/uploads where you don't need per-request
+   * app gating and want the bytes off the Worker's CPU/bandwidth budget. Requires
+   * {@link LunoraStorageOptions.s3} credentials; throws if they're absent. For
+   * app-gated access (auth/policy/rate-limit) prefer {@link Storage.getSignedUrl}.
+   */
   getPresignedUrl: (key: string, options?: PresignedUrlOptions) => Promise<string>;
   getSignedUrl: (key: string, options?: SignedUrlOptions) => Promise<string>;
   getUrl: (key: string) => string;
@@ -273,16 +144,16 @@ interface Storage {
     truncated?: boolean;
   }>;
   /**
-  * Resume an in-progress multipart upload by its `uploadId` (e.g. across
-  * requests). Wraps R2's `resumeMultipartUpload`; the id is not validated by
-  * R2, so a stale id surfaces as an error on the first `uploadPart`/`complete`.
-  */
+   * Resume an in-progress multipart upload by its `uploadId` (e.g. across
+   * requests). Wraps R2's `resumeMultipartUpload`; the id is not validated by
+   * R2, so a stale id surfaces as an error on the first `uploadPart`/`complete`.
+   */
   resumeMultipartUpload: (key: string, uploadId: string) => R2MultipartUploadLike;
   /**
-  * Upload `body` to `key`, returning the stored key + etag. Convex-compatible
-  * alias for {@link Storage.upload} — it accepts the same {@link UploadOptions}
-  * so the `maxSize` / `allowedContentTypes` guards aren't lost behind the alias.
-  */
+   * Upload `body` to `key`, returning the stored key + etag. Convex-compatible
+   * alias for {@link Storage.upload} — it accepts the same {@link UploadOptions}
+   * so the `maxSize` / `allowedContentTypes` guards aren't lost behind the alias.
+   */
   store: (key: string, body: ReadableStream | ArrayBuffer | Blob, options?: UploadOptions) => Promise<{
     etag: string;
     httpEtag: string;
@@ -295,11 +166,11 @@ interface Storage {
   }>;
 }
 /**
-* A bucket-aware {@link Storage}: the methods target a default bucket, and
-* `bucket(name)` selects a different named bucket (declared via
-* `v.storage("name")`). `bucketName` is the bucket the current accessor targets
-* — the storage-rules middleware reads it to scope `(bucket, operation)` rules.
-*/
+ * A bucket-aware {@link Storage}: the methods target a default bucket, and
+ * `bucket(name)` selects a different named bucket (declared via
+ * `v.storage("name")`). `bucketName` is the bucket the current accessor targets
+ * — the storage-rules middleware reads it to scope `(bucket, operation)` rules.
+ */
 interface BucketStorage extends Storage {
   /** Select a named bucket. Unknown names throw with the list of registered buckets. */
   bucket: (name: string) => BucketStorage;
@@ -307,36 +178,36 @@ interface BucketStorage extends Storage {
   readonly bucketName: string;
 }
 /**
-* Compose several per-bucket {@link Storage} instances into one bucket-aware
-* accessor. The bare methods (`download` / `store` / …) target the default
-* bucket; `bucket(name)` switches to another. Each accessor is tagged with its
-* `bucketName` so `storageRules(...)` can enforce per-bucket.
-*
-* ```ts
-* storage: (env) => createBucketStorage({
-*     default: createStorage({ bucket: env.FILES }),
-*     avatars: createStorage({ bucket: env.AVATARS }),
-* }),
-* // → ctx.storage.download(key)             // default bucket
-* // → ctx.storage.bucket("avatars").store() // the avatars bucket
-* ```
-*
-* The bare accessor is tagged `"default"` — the canonical name a
-* `defineStorageRule({ bucket: "default" })` rule and the generated
-* `StorageBucketName` union both use — unless `options.default` names another
-* bucket (then the bare accessor takes that name). The binding it delegates to is
-* `options.default`, else the `"default"` key when present, else the first
-* registered bucket. Named buckets are reached with `bucket(name)`.
-*/
+ * Compose several per-bucket {@link Storage} instances into one bucket-aware
+ * accessor. The bare methods (`download` / `store` / …) target the default
+ * bucket; `bucket(name)` switches to another. Each accessor is tagged with its
+ * `bucketName` so `storageRules(...)` can enforce per-bucket.
+ *
+ * ```ts
+ * storage: (env) => createBucketStorage({
+ *     default: createStorage({ bucket: env.FILES }),
+ *     avatars: createStorage({ bucket: env.AVATARS }),
+ * }),
+ * // → ctx.storage.download(key)             // default bucket
+ * // → ctx.storage.bucket("avatars").store() // the avatars bucket
+ * ```
+ *
+ * The bare accessor is tagged `"default"` — the canonical name a
+ * `defineStorageRule({ bucket: "default" })` rule and the generated
+ * `StorageBucketName` union both use — unless `options.default` names another
+ * bucket (then the bare accessor takes that name). The binding it delegates to is
+ * `options.default`, else the `"default"` key when present, else the first
+ * registered bucket. Named buckets are reached with `bucket(name)`.
+ */
 declare const createBucketStorage: (buckets: Record<string, Storage>, options?: {
   default?: string;
 }) => BucketStorage;
 /**
-* Compose a per-tenant key from a scope prefix and a caller-supplied key.
-* Both halves are validated — the prefix may not contain `..` or NUL either,
-* and the resulting key must stay under R2's length ceiling. Recommended for
-* any multi-tenant deployment so client-supplied keys can't address peer data.
-*/
+ * Compose a per-tenant key from a scope prefix and a caller-supplied key.
+ * Both halves are validated — the prefix may not contain `..` or NUL either,
+ * and the resulting key must stay under R2's length ceiling. Recommended for
+ * any multi-tenant deployment so client-supplied keys can't address peer data.
+ */
 declare const scopeKey: (prefix: string, key: string) => string;
 declare const createStorage: (options: LunoraStorageOptions) => Storage;
 /** Parameters accepted by {@link buildPresignedUrl}. */
@@ -353,25 +224,28 @@ interface PresignedUrlParams {
   now?: () => number;
 }
 /**
-* Build a native S3 presigned URL for an R2 object using SigV4 query-string
-* auth. The returned URL points at R2's S3 endpoint and carries the full
-* signature, so it authorizes a single `GET`/`PUT` on `key` until it expires —
-* no Worker round-trip.
-*/
+ * Build a native S3 presigned URL for an R2 object using SigV4 query-string
+ * auth. The returned URL points at R2's S3 endpoint and carries the full
+ * signature, so it authorizes a single `GET`/`PUT` on `key` until it expires —
+ * no Worker round-trip.
+ */
 declare const buildPresignedUrl: (parameters: PresignedUrlParams) => Promise<string>;
 /**
-* Worker-signed URL: the `publicBaseUrl` joined to the object `key`, plus a query
-* string carrying `exp` (unix seconds), `method` (`GET` or `PUT`) and `sig`
-* (a base64url HMAC).
-*
-* The HMAC canonical includes the URL host so a signature minted for one bucket
-* cannot be replayed against another host on the same signing secret. Even so,
-* the signing secret MUST NOT be shared across buckets/tenants — host binding
-* narrows replay surface but is not a substitute for per-tenant key isolation.
-*
-* The Worker handling `GET /storage/:key` should call {@link verifySignedUrl}
-* to validate the signature + expiry before streaming the R2 body.
-*/
+ * Worker-signed URL: the `publicBaseUrl` joined to the object `key`, plus a query
+ * string carrying `exp` (unix seconds), `method` (`GET` or `PUT`) and `sig`
+ * (a base64url HMAC).
+ *
+ * The HMAC canonical includes the URL host so a signature minted for one bucket
+ * cannot be replayed against another host on the same signing secret. Even so,
+ * the signing secret MUST NOT be shared across buckets/tenants — host binding
+ * narrows replay surface but is not a substitute for per-tenant key isolation.
+ *
+ * The Worker route handling the signed download/upload (mounted at
+ * `publicBaseUrl`'s origin, e.g. `GET /:key`) should call
+ * {@link verifySignedUrl} to validate the signature + expiry before streaming
+ * the R2 body. `baseUrl` must be a bare origin (no path) — see the module
+ * docstring.
+ */
 declare const buildSignedUrl: (args: SignedUrlOptions & {
   baseUrl: string;
   key: string;
@@ -383,24 +257,24 @@ interface VerifyResult {
   key?: string;
   method?: "GET" | "PUT";
   /**
-  * Internal-only failure reason for server logs/diagnostics. **Do not echo
-  * to clients** — a precise reason ("expired" vs "bad_signature") is a
-  * signing oracle. Public responses should expose only `valid`.
-  */
+   * Internal-only failure reason for server logs/diagnostics. **Do not echo
+   * to clients** — a precise reason ("expired" vs "bad_signature") is a
+   * signing oracle. Public responses should expose only `valid`.
+   */
   reason?: "bad_signature" | "expired" | "malformed";
   valid: boolean;
 }
 /**
-* Verify a {@link buildSignedUrl} output. By default the signature is
-* canonicalized against the inbound `url.host`, which matches the build-side
-* host whenever the URL being verified is the URL that was minted. In a
-* topology where the host the Worker sees differs from the configured
-* `publicBaseUrl` host (e.g. a CDN host vs a Worker route that rewrites
-* `Host`), pass `expectedHost` (the `publicBaseUrl` host) so verification
-* canonicalizes against the same host the signature was minted for instead of
-* failing every request as `bad_signature`.
-*/
+ * Verify a {@link buildSignedUrl} output. By default the signature is
+ * canonicalized against the inbound `url.host`, which matches the build-side
+ * host whenever the URL being verified is the URL that was minted. In a
+ * topology where the host the Worker sees differs from the configured
+ * `publicBaseUrl` host (e.g. a CDN host vs a Worker route that rewrites
+ * `Host`), pass `expectedHost` (the `publicBaseUrl` host) so verification
+ * canonicalizes against the same host the signature was minted for instead of
+ * failing every request as `bad_signature`.
+ */
 declare const verifySignedUrl: (input: string | URL, secret: string, options?: {
   expectedHost?: string;
 }) => Promise<VerifyResult>;
-export { type BucketStorage, type ListOptions, type LunoraStorageOptions, type ObjectMetadata, type PresignedUrlOptions, type PresignedUrlParams, type R2BucketLike, type R2MultipartUploadLike, type R2ObjectBodyLike, type R2ObjectLike, type R2RangeLike, type R2S3Credentials, type R2UploadedPartLike, type SignedUrlOptions, type Storage, type UploadOptions, type VerifyResult, buildPresignedUrl, buildSignedUrl, createBucketStorage, createStorage, scopeKey, verifySignedUrl };
+export { type BucketStorage, type ListOptions, type LunoraStorageOptions, type ObjectMetadata, type PresignedUrlOptions, type PresignedUrlParams, type R2S3Credentials, type SignedUrlOptions, type Storage, type UploadOptions, type VerifyResult, buildPresignedUrl, buildSignedUrl, createBucketStorage, createStorage, scopeKey, verifySignedUrl };

package/dist/index.mjs

@@ -1,4 +1 @@
-export { createBucketStorage } from './packem_shared/createBucketStorage-4Xk7-5CN.mjs';
-export { createStorage, scopeKey } from './packem_shared/scopeKey-Bs_iJ1Mx.mjs';
-export { buildPresignedUrl } from './packem_shared/buildPresignedUrl-DzPwi1bY.mjs';
-export { buildSignedUrl, verifySignedUrl } from './packem_shared/buildSignedUrl-ZzB16yPl.mjs';
+import{createBucketStorage as o}from"./packem_shared/createBucketStorage-DAip6cEw.mjs";import{createStorage as a,scopeKey as i}from"./packem_shared/createStorage-BK_1WMQA.mjs";import{buildPresignedUrl as f}from"./packem_shared/buildPresignedUrl-TCv-5TAT.mjs";import{b as l,v as p}from"./packem_shared/signed-url-Dm2EFS18.mjs";export{f as buildPresignedUrl,l as buildSignedUrl,o as createBucketStorage,a as createStorage,i as scopeKey,p as verifySignedUrl};

package/dist/packem_shared/DEFAULT_MAX_UPLOAD_BYTES-CeVvqDXZ.mjs

@@ -0,0 +1 @@
+import{Rest as d,Multipart as l,Tus as p}from"@visulima/storage/handler/http/fetch";import{AwsLightStorage as h}from"@visulima/storage/provider/aws-light";const m=100*1024*1024,g="1.0.0",c=(e,t,r)=>{const o={"content-type":"application/json"};return e==="tus"&&(o["Tus-Resumable"]=g),Response.json({error:r},{headers:o,status:t})},i=e=>c(e,403,{code:"FORBIDDEN",message:"Upload denied by authorization policy",name:"ForbiddenError"}),f=e=>c(e,413,{code:"REQUEST_ENTITY_TOO_LARGE",message:"Upload exceeds the configured maxFileSize",name:"RequestEntityTooLargeError"}),b=(e,t)=>{if(t==="multipart")return;const r=e.headers.get("Upload-Length")??e.headers.get("Content-Length");if(r===null)return;const o=Number(r);return Number.isFinite(o)?o:void 0},S=(e,t)=>e==="chunked-rest"?new d(t):e==="multipart"?new l(t):new p(t),z=e=>{const t=e.protocol??"tus",r=e.maxFileSize??m,o={maxFileSize:r,storage:e.storage},u=S(t,o),{authorize:n}=e;return n===void 0&&!e.silent&&!e.public&&console.warn("@lunora/storage: createUploadHandler() has no `authorize` — this mounts an unauthenticated, unbounded-write endpoint. Pass an RLS `authorize` gate, or set `public: true` (or `silent: true`) to confirm this bucket is intentionally open."),{fetch:async a=>{const s=b(a,t);if(s!==void 0&&s>r)return f(t);if(n!==void 0)try{if(!await n({method:a.method,protocol:t,request:a,url:new URL(a.url)}))return i(t)}catch{return i(t)}return u.fetch(a)},protocol:t}},E=e=>new h({accessKeyId:e.accessKeyId,bucket:e.bucket,endpoint:e.endpoint??`https://${e.accountId}.r2.cloudflarestorage.com`,path:e.path??"/",region:"auto",secretAccessKey:e.secretAccessKey,...e.partSize===void 0?{}:{partSize:e.partSize}});export{m as DEFAULT_MAX_UPLOAD_BYTES,E as createR2UploadStorage,z as createUploadHandler};

package/dist/packem_shared/buildPresignedUrl-TCv-5TAT.mjs

@@ -0,0 +1,4 @@
+import{a as g}from"./internal-DpjlEJPE.mjs";const h="auto",y="s3",S="AWS4-HMAC-SHA256",M=1,X=10080*60,w=900,d=new TextEncoder,j=(e,t)=>e[0]<t[0]?-1:e[0]>t[0]?1:0,s=e=>encodeURIComponent(e).replaceAll(/[!'()*]/gu,t=>`%${t.codePointAt(0)?.toString(16).toUpperCase()??""}`),f=e=>e.split("/").map(t=>s(t)).join("/"),U=async e=>g(await crypto.subtle.digest("SHA-256",d.encode(e))),n=async(e,t)=>{const a=await crypto.subtle.importKey("raw",e,{hash:"SHA-256",name:"HMAC"},!1,["sign"]);return crypto.subtle.sign("HMAC",a,d.encode(t))},E=async(e,t)=>{const a=await n(d.encode(`AWS4${e}`),t),r=await n(a,h),o=await n(r,y);return n(o,"aws4_request")},K=e=>{const t=e.jurisdiction===void 0?"":`${e.jurisdiction}.`;return`${e.accountId}.${t}r2.cloudflarestorage.com`},P=e=>{const t=`${e.toISOString().replaceAll(/[:-]/gu,"").slice(0,15)}Z`;return{amzDate:t,dateStamp:t.slice(0,8)}},k=async e=>{const{credentials:t,key:a}=e,r=e.method??"GET",o=e.expiresInSeconds??w,z=Number.isFinite(o)?o:w,H=Math.min(Math.max(M,Math.floor(z)),X),m=K(t),D=new Date(e.now?.()??Date.now()),{amzDate:l,dateStamp:u}=P(D),A=`${u}/${h}/${y}/aws4_request`,p=`/${s(t.bucket)}/${f(a)}`,$=[["X-Amz-Algorithm",S],["X-Amz-Credential",`${t.accessKeyId}/${A}`],["X-Amz-Date",l],["X-Amz-Expires",H.toString()],["X-Amz-SignedHeaders","host"]].map(([i,c])=>[s(i),s(c)]).toSorted(j).map(([i,c])=>`${i}=${c}`).join("&"),b=[r,p,$,`host:${m}
+`,"host","UNSIGNED-PAYLOAD"].join(`
+`),x=[S,l,A,await U(b)].join(`
+`),C=await E(t.secretAccessKey,u),I=g(await n(C,x));return`https://${m}${p}?${$}&X-Amz-Signature=${I}`};export{k as buildPresignedUrl};

package/dist/packem_shared/buildSignedUrl-DNIwBOK4.mjs

@@ -0,0 +1 @@
+import"@lunora/errors";import{b as d,v as l}from"./signed-url-Dm2EFS18.mjs";import"./internal-DpjlEJPE.mjs";export{d as buildSignedUrl,l as verifySignedUrl};

package/dist/packem_shared/createBucketStorage-DAip6cEw.mjs

@@ -0,0 +1 @@
+import{LunoraError as u}from"@lunora/errors";const d=(t,o={})=>{const r=Object.keys(t),[n]=r;if(n===void 0)throw new u("INTERNAL","@lunora/storage: createBucketStorage requires at least one bucket");if(o.default!==void 0&&!t[o.default])throw new u("INTERNAL",`@lunora/storage: default bucket "${o.default}" is not in the bucket map (have: ${r.join(", ")})`);const e=o.default??"default",c=t[e]??t[n];if(c===void 0)throw new u("INTERNAL",`@lunora/storage: default bucket "${e}" is not in the bucket map (have: ${r.join(", ")})`);const f=[...new Set([e,...r])],i=a=>{const s=a===e?c:t[a];if(!s)throw new u("INTERNAL",`@lunora/storage: no bucket registered for "${a}". Known buckets: ${f.join(", ")}`);return{...s,bucket:k=>i(k),bucketName:a}};return i(e)};export{d as createBucketStorage};

package/dist/packem_shared/createStorage-BK_1WMQA.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{b as R,d as T}from"./signed-url-Dm2EFS18.mjs";import{t as k,a as f}from"./internal-DpjlEJPE.mjs";import{buildPresignedUrl as I}from"./buildPresignedUrl-TCv-5TAT.mjs";const m=1024,A=1e3,U=100,b=e=>{const n=new Uint8Array(e);let i="";for(const p of n)i+=String.fromCodePoint(p);return btoa(i)},S=e=>{const n=e.checksums?.sha256;if(n===void 0)return e;const i=f(n),p=b(n);return new Proxy(e,{get(u,s){if(s==="sha256")return i;if(s==="sha256Base64")return p;const l=Reflect.get(u,s,u);return typeof l=="function"?l.bind(u):l},has(u,s){return s==="sha256"||s==="sha256Base64"||Reflect.has(u,s)}})},w=e=>{const n=e.checksums?.sha256;return{contentType:e.httpMetadata?.contentType,customMetadata:e.customMetadata,key:e.key,sha256:n===void 0?void 0:f(n),size:e.size,uploaded:e.uploaded===void 0?void 0:e.uploaded.getTime()}},M=e=>{const n=e.checksums?.sha256;return{checksums:e.checksums,customMetadata:e.customMetadata,etag:e.etag,httpEtag:e.httpEtag,httpMetadata:e.httpMetadata,key:e.key,sha256:n===void 0?void 0:f(n),sha256Base64:n===void 0?void 0:b(n),size:e.size,uploaded:e.uploaded}},N=(e,n)=>{let i=0;const p=s=>s instanceof ArrayBuffer||ArrayBuffer.isView(s)?s.byteLength:void 0,u=new TransformStream({transform(s,l){const h=p(s);if(h===void 0){l.error(new Error("@lunora/storage: stream chunk is not a byte chunk; cannot enforce maxSize"));return}if(i+=h,i>n){l.error(new Error(`@lunora/storage: stream body exceeds maxSize (> ${String(n)} bytes)`));return}l.enqueue(s)}});return e.pipeThrough(u)},c=e=>{if(typeof e!="string"||e.length===0)throw new a("VALIDATION_ERROR","@lunora/storage: key must be a non-empty string");if(e.length>m)throw new a("VALIDATION_ERROR",`@lunora/storage: key exceeds ${String(m)}-byte limit`);if(e.includes("\0"))throw new a("VALIDATION_ERROR","@lunora/storage: key contains NUL byte");if(T(e))throw new a("VALIDATION_ERROR","@lunora/storage: key contains a control character (including CR/LF)");if(e.startsWith("/"))throw new a("VALIDATION_ERROR","@lunora/storage: key must not start with `/`");if(e.split("/").includes(".."))throw new a("VALIDATION_ERROR","@lunora/storage: key contains a `..` path component")},v=(e,n)=>{c(e),c(n);const i=`${e.endsWith("/")?e.slice(0,-1):e}/${n}`;if(i.length>m)throw new a("VALIDATION_ERROR",`@lunora/storage: scoped key exceeds ${String(m)}-byte limit`);return i},B=e=>{if(!e.bucket)throw new a("INTERNAL","@lunora/storage: `bucket` is required");const n=async(r,t,o={})=>{if(c(r),o.allowedContentTypes!==void 0){if(o.contentType===void 0)throw new a("VALIDATION_ERROR","@lunora/storage: contentType is required when allowedContentTypes is set");if(!o.allowedContentTypes.includes(o.contentType))throw new a("VALIDATION_ERROR",`@lunora/storage: contentType "${o.contentType}" not in allowedContentTypes`)}let y=t;if(typeof o.maxSize=="number"){let g;if(t instanceof ArrayBuffer?g=t.byteLength:t instanceof Blob&&(g=t.size),g!==void 0&&g>o.maxSize)throw new a("PAYLOAD_TOO_LARGE",`@lunora/storage: body exceeds maxSize (${String(g)} > ${String(o.maxSize)})`);t instanceof ReadableStream&&(y=N(t,o.maxSize))}const d=await e.bucket.put(r,y,{customMetadata:o.customMetadata,httpMetadata:o.contentType?{contentType:o.contentType}:void 0});return{etag:d.etag,httpEtag:d.httpEtag??`"${d.etag}"`,key:d.key}},i=async(r,t={})=>{c(r);const o=await(t.range?e.bucket.get(r,{range:t.range}):e.bucket.get(r));return o&&S(o)},p=async r=>{c(r),await e.bucket.delete(r)},u=async r=>{if(c(r),e.bucket.head){const o=await e.bucket.head(r);return o&&w(o)}const t=await e.bucket.get(r,{range:{length:0}});return t&&w(t)},s=async(r,t={})=>{if(r?.includes("\0"))throw new a("VALIDATION_ERROR","@lunora/storage: prefix contains NUL byte");const o=t.limit??U,y=Math.min(Math.max(1,Math.floor(o)),A),d=await e.bucket.list({cursor:t.cursor,delimiter:t.delimiter,limit:y,prefix:r});return{cursor:d.cursor,objects:d.objects.map(g=>M(g)),truncated:d.truncated}},l=r=>{if(!e.publicBaseUrl)throw new a("INTERNAL","@lunora/storage: `publicBaseUrl` is required for getUrl()");c(r);const t=r.split("/").map(o=>encodeURIComponent(o)).join("/");return`${k(e.publicBaseUrl)}/${t}`},h=async(r,t={})=>{if(!e.publicBaseUrl)throw new a("INTERNAL","@lunora/storage: `publicBaseUrl` is required for getSignedUrl()");if(!e.signingSecret)throw new a("INTERNAL","@lunora/storage: `signingSecret` is required for getSignedUrl()");return c(r),R({baseUrl:e.publicBaseUrl,contentType:t.contentType,expiresInSeconds:t.expiresInSeconds,key:r,method:t.method,secret:e.signingSecret})};return{createMultipartUpload:async(r,t={})=>{if(c(r),!e.bucket.createMultipartUpload)throw new a("INTERNAL","@lunora/storage: bucket binding does not support multipart uploads (createMultipartUpload)");return e.bucket.createMultipartUpload(r,{customMetadata:t.customMetadata,httpMetadata:t.contentType?{contentType:t.contentType}:void 0})},delete:p,download:i,generateUploadUrl:async(r,t={})=>h(r,{contentType:t.contentType,expiresInSeconds:t.expiresInSeconds,method:"PUT"}),getMetadata:u,getPresignedUrl:async(r,t={})=>{if(!e.s3)throw new a("INTERNAL","@lunora/storage: `s3` credentials are required for getPresignedUrl() — pass { accountId, accessKeyId, secretAccessKey, bucket }");return c(r),I({credentials:e.s3,expiresInSeconds:t.expiresInSeconds,key:r,method:t.method})},getSignedUrl:h,getUrl:l,list:s,resumeMultipartUpload:(r,t)=>{if(c(r),typeof t!="string"||t.length===0)throw new a("VALIDATION_ERROR","@lunora/storage: resumeMultipartUpload requires a non-empty uploadId");if(!e.bucket.resumeMultipartUpload)throw new a("INTERNAL","@lunora/storage: bucket binding does not support multipart uploads (resumeMultipartUpload)");return e.bucket.resumeMultipartUpload(r,t)},store:n,upload:n}};export{B as createStorage,v as scopeKey};

package/dist/packem_shared/internal-DpjlEJPE.mjs

@@ -0,0 +1 @@
+const o=e=>{const t=new Uint8Array(e);let n="";for(const r of t)n+=r.toString(16).padStart(2,"0");return n},a=e=>{let t=e.length;for(;t>0&&e[t-1]==="/";)t-=1;return e.slice(0,t)};export{o as a,a as t};

package/dist/packem_shared/signed-url-Dm2EFS18.mjs

@@ -0,0 +1,5 @@
+import{LunoraError as u}from"@lunora/errors";import{t as R}from"./internal-DpjlEJPE.mjs";const U=(e,r)=>{if(e.size<r)return;const t=e.keys().next().value;t!==void 0&&e.delete(t)},f=new TextEncoder,h=10080*60,$=/^[a-z][a-z0-9+\-.]*:\/\//i,x=Array.from({length:32},(e,r)=>r),y=new RegExp(`[${x.map(e=>String.fromCodePoint(e)).join("")}]`,"u"),I=e=>{const r=String.fromCodePoint(...e);return btoa(r).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},L=e=>{const r=e.replaceAll("-","+").replaceAll("_","/")+"===".slice((e.length+3)%4),t=atob(r),n=new Uint8Array(t.length);for(let a=0;a<t.length;a+=1)n[a]=t.codePointAt(a)??0;return n},T=64,p=new Map,g=async e=>{const r=p.get(e);if(r)return r;U(p,T);const t=crypto.subtle.importKey("raw",f.encode(e),{hash:"SHA-256",name:"HMAC"},!1,["sign","verify"]);return p.set(e,t),t},w=e=>{try{return new URL(e).host}catch{return e.replace($,"").split("/")[0]??""}},v=e=>{if(y.test(e))throw new TypeError("hmac-url: value must not contain control characters (including CR/LF)")},H=e=>y.test(e),S=async(e,r)=>{const t=await g(e),n=await crypto.subtle.sign("HMAC",t,f.encode(r));return I(new Uint8Array(n))},C=async(e,r,t)=>{const n=await g(e);return crypto.subtle.verify("HMAC",n,t,f.encode(r))},E=/^\//,N=/^\/+$/u,b=(e,r,t,n,a)=>{const o=`${e}
+${r.toLowerCase()}
+${t}
+${String(n)}`;return a===void 0?o:`${o}
+${a}`},M=async e=>{const r=e.method??"GET",t=e.expiresInSeconds??3600;if(!Number.isFinite(t)||t<=0)throw new u("VALIDATION_ERROR","@lunora/storage: expiresInSeconds must be a positive finite number");if(t>h)throw new u("VALIDATION_ERROR",`@lunora/storage: expiresInSeconds must not exceed ${String(h)} (7 days)`);const n=r==="PUT"?e.contentType:void 0;let a="";try{a=new URL(e.baseUrl).pathname}catch{}if(a!==""&&!N.test(a))throw new u("VALIDATION_ERROR",`@lunora/storage: baseUrl must not carry a path ("${a}") — the key is verified from the full URL pathname, so a subpath base would make every signed URL fail verification`);v(e.key);const o=Math.floor(Date.now()/1e3)+t,l=w(e.baseUrl),s=await S(e.secret,b(r,l,e.key,o,n)),c=R(e.baseUrl),i=e.key.split("/").map(m=>encodeURIComponent(m)).join("/"),d=n===void 0?"":`&ct=${encodeURIComponent(n)}`;return`${c}/${i}?exp=${String(o)}&method=${r}&sig=${s}${d}`},O=async(e,r,t)=>{let n;try{n=e instanceof URL?e:new URL(e)}catch{return{reason:"malformed",valid:!1}}const a=n.searchParams.get("exp"),o=a===null?Number.NaN:Number(a),l=n.searchParams.get("sig"),s=n.searchParams.get("method")??"GET",c=n.searchParams.get("ct")??void 0;if(!l||!Number.isInteger(o))return{reason:"malformed",valid:!1};if(o<Math.floor(Date.now()/1e3))return{reason:"expired",valid:!1};if(s!=="GET"&&s!=="PUT")return{reason:"malformed",valid:!1};let i,d;try{i=n.pathname.replace(E,"").split("/").map(A=>decodeURIComponent(A)).join("/"),v(i),d=L(l)}catch{return{reason:"malformed",valid:!1}}const m=t?.expectedHost===void 0?n.host:w(t.expectedHost);return await C(r,b(s,m,i,o,c),d)?{contentType:c,key:i,method:s,valid:!0}:{reason:"bad_signature",valid:!1}};export{M as b,H as d,O as v};