@lunora/storage 1.0.0-alpha.7 → 1.0.0-alpha.9

package/dist/index.mjs

@@ -1,4 +1,4 @@
 export { createBucketStorage } from './packem_shared/createBucketStorage-JYdrS4e5.mjs';
-export { createStorage, scopeKey } from './packem_shared/createStorage-fwSr3UdU.mjs';
-export { buildPresignedUrl } from './packem_shared/buildPresignedUrl-DzPwi1bY.mjs';
-export { buildSignedUrl, verifySignedUrl } from './packem_shared/buildSignedUrl-DX535yKv.mjs';
+export { createStorage, scopeKey } from './packem_shared/createStorage-Bu6GJB25.mjs';
+export { buildPresignedUrl } from './packem_shared/buildPresignedUrl-B5f1wvz6.mjs';
+export { buildSignedUrl, verifySignedUrl } from './packem_shared/buildSignedUrl-rt-6azia.mjs';

package/dist/packem_shared/{buildPresignedUrl-DzPwi1bY.mjs → buildPresignedUrl-B5f1wvz6.mjs}

@@ -1,3 +1,5 @@
+import { a as toHex } from './internal-Dqk0MrAj.mjs';
+
 const REGION = "auto";
 const SERVICE = "s3";
 const ALGORITHM = "AWS4-HMAC-SHA256";
@@ -11,14 +13,6 @@ const compareEntries = (a, b) => {
   }
   return a[0] > b[0] ? 1 : 0;
 };
-const toHex = (buffer) => {
-  const bytes = new Uint8Array(buffer);
-  let out = "";
-  for (const byte of bytes) {
-    out += byte.toString(16).padStart(2, "0");
-  }
-  return out;
-};
 const encodeRfc3986 = (value) => encodeURIComponent(value).replaceAll(/[!'()*]/gu, (char) => `%${char.codePointAt(0)?.toString(16).toUpperCase() ?? ""}`);
 const encodeKey = (key) => key.split("/").map((segment) => encodeRfc3986(segment)).join("/");
 const sha256Hex = async (input) => toHex(await crypto.subtle.digest("SHA-256", textEncoder.encode(input)));

package/dist/packem_shared/{buildSignedUrl-DX535yKv.mjs → buildSignedUrl-rt-6azia.mjs}

@@ -1,9 +1,19 @@
 import { LunoraError } from '@lunora/errors';
+import { t as trimTrailingSlashes } from './internal-Dqk0MrAj.mjs';
+
+const evictOldestEntry = (map, capacity) => {
+  if (map.size < capacity) {
+    return;
+  }
+  const oldest = map.keys().next().value;
+  if (oldest !== void 0) {
+    map.delete(oldest);
+  }
+};
 
 const textEncoder = new TextEncoder();
-const MAX_EXPIRES_IN_SECONDS = 7 * 24 * 60 * 60;
+const MAX_SIGNED_URL_TTL_SECONDS = 7 * 24 * 60 * 60;
 const SCHEME_PREFIX_RE = /^[a-z][a-z0-9+\-.]*:\/\//i;
-const LEADING_SLASH_RE = /^\//;
 const toBase64Url = (bytes) => {
   const binary = String.fromCodePoint(...bytes);
   return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
@@ -24,24 +34,11 @@ const importHmacKey = async (secret) => {
   if (cached) {
     return cached;
   }
-  if (keyCache.size >= KEY_CACHE_MAX) {
-    const oldest = keyCache.keys().next().value;
-    if (oldest !== void 0) {
-      keyCache.delete(oldest);
-    }
-  }
+  evictOldestEntry(keyCache, KEY_CACHE_MAX);
   const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
   keyCache.set(secret, keyPromise);
   return keyPromise;
 };
-const canonicalize = (method, host, key, exp, contentType) => {
-  const base = `${method}
-${host.toLowerCase()}
-${key}
-${String(exp)}`;
-  return contentType === void 0 ? base : `${base}
-${contentType}`;
-};
 const extractHost = (input) => {
   try {
     return new URL(input).host;
@@ -50,22 +47,39 @@ const extractHost = (input) => {
     return noScheme.split("/")[0] ?? "";
   }
 };
+const signCanonical = async (secret, canonical) => {
+  const cryptoKey = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
+  return toBase64Url(new Uint8Array(signature));
+};
+const verifyCanonical = async (secret, canonical, sigBytes) => {
+  const cryptoKey = await importHmacKey(secret);
+  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
+};
+
+const LEADING_SLASH_RE = /^\//;
+const canonicalize = (method, host, key, exp, contentType) => {
+  const base = `${method}
+${host.toLowerCase()}
+${key}
+${String(exp)}`;
+  return contentType === void 0 ? base : `${base}
+${contentType}`;
+};
 const buildSignedUrl = async (args) => {
   const method = args.method ?? "GET";
   const expiresInSeconds = args.expiresInSeconds ?? 60 * 60;
   if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: expiresInSeconds must be a positive finite number");
+    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: expiresInSeconds must be a positive finite number");
   }
-  if (expiresInSeconds > MAX_EXPIRES_IN_SECONDS) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: expiresInSeconds must not exceed ${String(MAX_EXPIRES_IN_SECONDS)} (7 days)`);
+  if (expiresInSeconds > MAX_SIGNED_URL_TTL_SECONDS) {
+    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: expiresInSeconds must not exceed ${String(MAX_SIGNED_URL_TTL_SECONDS)} (7 days)`);
   }
   const contentType = method === "PUT" ? args.contentType : void 0;
   const exp = Math.floor(Date.now() / 1e3) + expiresInSeconds;
   const host = extractHost(args.baseUrl);
-  const cryptoKey = await importHmacKey(args.secret);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonicalize(method, host, args.key, exp, contentType)));
-  const sig = toBase64Url(new Uint8Array(signature));
-  const base = args.baseUrl.endsWith("/") ? args.baseUrl.slice(0, -1) : args.baseUrl;
+  const sig = await signCanonical(args.secret, canonicalize(method, host, args.key, exp, contentType));
+  const base = trimTrailingSlashes(args.baseUrl);
   const safeKey = args.key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
   const ctParameter = contentType === void 0 ? "" : `&ct=${encodeURIComponent(contentType)}`;
   return `${base}/${safeKey}?exp=${String(exp)}&method=${method}&sig=${sig}${ctParameter}`;
@@ -100,13 +114,7 @@ const verifySignedUrl = async (input, secret, options) => {
     return { reason: "malformed", valid: false };
   }
   const host = options?.expectedHost === void 0 ? url.host : extractHost(options.expectedHost);
-  const cryptoKey = await importHmacKey(secret);
-  const valid = await crypto.subtle.verify(
-    "HMAC",
-    cryptoKey,
-    sigBytes,
-    textEncoder.encode(canonicalize(method, host, key, exp, contentType))
-  );
+  const valid = await verifyCanonical(secret, canonicalize(method, host, key, exp, contentType), sigBytes);
   if (!valid) {
     return { reason: "bad_signature", valid: false };
   }

package/dist/packem_shared/{createStorage-fwSr3UdU.mjs → createStorage-Bu6GJB25.mjs}

@@ -1,18 +1,11 @@
 import { LunoraError } from '@lunora/errors';
-import { buildPresignedUrl } from './buildPresignedUrl-DzPwi1bY.mjs';
-import { buildSignedUrl } from './buildSignedUrl-DX535yKv.mjs';
+import { t as trimTrailingSlashes, a as toHex } from './internal-Dqk0MrAj.mjs';
+import { buildPresignedUrl } from './buildPresignedUrl-B5f1wvz6.mjs';
+import { buildSignedUrl } from './buildSignedUrl-rt-6azia.mjs';
 
 const MAX_KEY_LENGTH = 1024;
 const MAX_LIST_LIMIT = 1e3;
 const DEFAULT_LIST_LIMIT = 100;
-const toHex = (buffer) => {
-  const bytes = new Uint8Array(buffer);
-  let out = "";
-  for (const byte of bytes) {
-    out += byte.toString(16).padStart(2, "0");
-  }
-  return out;
-};
 const toBase64 = (buffer) => {
   const bytes = new Uint8Array(buffer);
   let binary = "";
@@ -55,17 +48,37 @@ const toMetadata = (object) => {
     uploaded: object.uploaded === void 0 ? void 0 : object.uploaded.getTime()
   };
 };
+const toListObject = (object) => {
+  const raw = object.checksums?.sha256;
+  return {
+    checksums: object.checksums,
+    customMetadata: object.customMetadata,
+    etag: object.etag,
+    httpEtag: object.httpEtag,
+    httpMetadata: object.httpMetadata,
+    key: object.key,
+    sha256: raw === void 0 ? void 0 : toHex(raw),
+    sha256Base64: raw === void 0 ? void 0 : toBase64(raw),
+    size: object.size,
+    uploaded: object.uploaded
+  };
+};
 const enforceStreamMaxSize = (stream, maxSize) => {
   let seen = 0;
   const byteLengthOf = (chunk) => {
     if (chunk instanceof ArrayBuffer) {
       return chunk.byteLength;
     }
-    return ArrayBuffer.isView(chunk) ? chunk.byteLength : 0;
+    return ArrayBuffer.isView(chunk) ? chunk.byteLength : void 0;
   };
   const counter = new TransformStream({
     transform(chunk, controller) {
-      seen += byteLengthOf(chunk);
+      const length = byteLengthOf(chunk);
+      if (length === void 0) {
+        controller.error(new Error("@lunora/storage: stream chunk is not a byte chunk; cannot enforce maxSize"));
+        return;
+      }
+      seen += length;
       if (seen > maxSize) {
         controller.error(new Error(`@lunora/storage: stream body exceeds maxSize (> ${String(maxSize)} bytes)`));
         return;
@@ -75,30 +88,23 @@ const enforceStreamMaxSize = (stream, maxSize) => {
   });
   return stream.pipeThrough(counter);
 };
-const trimTrailingSlashes = (value) => {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") {
-    end -= 1;
-  }
-  return value.slice(0, end);
-};
 const validateKey = (key) => {
   if (typeof key !== "string" || key.length === 0) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: key must be a non-empty string");
+    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key must be a non-empty string");
   }
   if (key.length > MAX_KEY_LENGTH) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
+    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
   }
   if (key.includes("\0")) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: key contains NUL byte");
+    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key contains NUL byte");
   }
   if (key.startsWith("/")) {
-    throw new LunoraError("INTERNAL", "@lunora/storage: key must not start with `/`");
+    throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key must not start with `/`");
   }
   const segments = key.split("/");
   for (const segment of segments) {
     if (segment === "..") {
-      throw new LunoraError("INTERNAL", "@lunora/storage: key contains a `..` path component");
+      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: key contains a `..` path component");
     }
   }
 };
@@ -108,7 +114,7 @@ const scopeKey = (prefix, key) => {
   const trimmedPrefix = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
   const composed = `${trimmedPrefix}/${key}`;
   if (composed.length > MAX_KEY_LENGTH) {
-    throw new LunoraError("INTERNAL", `@lunora/storage: scoped key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
+    throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: scoped key exceeds ${String(MAX_KEY_LENGTH)}-byte limit`);
   }
   return composed;
 };
@@ -120,10 +126,10 @@ const createStorage = (options) => {
     validateKey(key);
     if (uploadOptions.allowedContentTypes !== void 0) {
       if (uploadOptions.contentType === void 0) {
-        throw new LunoraError("INTERNAL", "@lunora/storage: contentType is required when allowedContentTypes is set");
+        throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: contentType is required when allowedContentTypes is set");
       }
       if (!uploadOptions.allowedContentTypes.includes(uploadOptions.contentType)) {
-        throw new LunoraError("INTERNAL", `@lunora/storage: contentType "${uploadOptions.contentType}" not in allowedContentTypes`);
+        throw new LunoraError("VALIDATION_ERROR", `@lunora/storage: contentType "${uploadOptions.contentType}" not in allowedContentTypes`);
       }
     }
     let putBody = body;
@@ -135,7 +141,7 @@ const createStorage = (options) => {
         size = body.size;
       }
       if (size !== void 0 && size > uploadOptions.maxSize) {
-        throw new LunoraError("INTERNAL", `@lunora/storage: body exceeds maxSize (${String(size)} > ${String(uploadOptions.maxSize)})`);
+        throw new LunoraError("PAYLOAD_TOO_LARGE", `@lunora/storage: body exceeds maxSize (${String(size)} > ${String(uploadOptions.maxSize)})`);
       }
       if (body instanceof ReadableStream) {
         putBody = enforceStreamMaxSize(body, uploadOptions.maxSize);
@@ -167,12 +173,12 @@ const createStorage = (options) => {
   };
   const list = async (prefix, listOptions = {}) => {
     if (prefix?.includes("\0")) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: prefix contains NUL byte");
+      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: prefix contains NUL byte");
     }
     const requested = listOptions.limit ?? DEFAULT_LIST_LIMIT;
     const limit = Math.min(Math.max(1, Math.floor(requested)), MAX_LIST_LIMIT);
     const result = await options.bucket.list({ cursor: listOptions.cursor, delimiter: listOptions.delimiter, limit, prefix });
-    return { cursor: result.cursor, objects: result.objects.map((object) => withSha256(object)), truncated: result.truncated };
+    return { cursor: result.cursor, objects: result.objects.map((object) => toListObject(object)), truncated: result.truncated };
   };
   const getUrl = (key) => {
     if (!options.publicBaseUrl) {
@@ -212,7 +218,7 @@ const createStorage = (options) => {
   const resumeMultipartUpload = (key, uploadId) => {
     validateKey(key);
     if (typeof uploadId !== "string" || uploadId.length === 0) {
-      throw new LunoraError("INTERNAL", "@lunora/storage: resumeMultipartUpload requires a non-empty uploadId");
+      throw new LunoraError("VALIDATION_ERROR", "@lunora/storage: resumeMultipartUpload requires a non-empty uploadId");
     }
     if (!options.bucket.resumeMultipartUpload) {
       throw new LunoraError("INTERNAL", "@lunora/storage: bucket binding does not support multipart uploads (resumeMultipartUpload)");

package/dist/packem_shared/internal-Dqk0MrAj.mjs

@@ -0,0 +1,17 @@
+const toHex = (buffer) => {
+  const bytes = new Uint8Array(buffer);
+  let out = "";
+  for (const byte of bytes) {
+    out += byte.toString(16).padStart(2, "0");
+  }
+  return out;
+};
+const trimTrailingSlashes = (value) => {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+};
+
+export { toHex as a, trimTrailingSlashes as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/storage",
-  "version": "1.0.0-alpha.7",
+  "version": "1.0.0-alpha.9",
   "description": "R2-backed storage for Lunora: typed buckets and signed URLs",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3"
+    "@lunora/errors": "1.0.0-alpha.5"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"