@nestm/storage 0.1.0-alpha.1 → 0.1.0-alpha.11

package/dist/files-sdk/s3/construction-metadata.js

@@ -0,0 +1,24 @@
+const constructionMetadata = new WeakMap();
+const conditionalRequestPermission = new WeakMap();
+export function recordS3ConditionalRequestPermission(raw, enabled) {
+    const existing = conditionalRequestPermission.get(raw);
+    if (existing !== undefined && existing !== enabled) {
+        throw new TypeError('S3 conditional-request construction permission cannot be changed.');
+    }
+    conditionalRequestPermission.set(raw, enabled);
+}
+export function getS3ConditionalRequestPermission(raw) {
+    return conditionalRequestPermission.get(raw);
+}
+export function recordS3ConstructionMetadata(raw, metadata) {
+    const existing = constructionMetadata.get(raw);
+    if (existing !== undefined &&
+        existing.publicBaseUrlConfigured !== metadata.publicBaseUrlConfigured) {
+        throw new TypeError('S3 adapter construction metadata cannot be changed.');
+    }
+    constructionMetadata.set(raw, Object.freeze({ ...metadata }));
+}
+export function getS3ConstructionMetadata(raw) {
+    return constructionMetadata.get(raw);
+}
+//# sourceMappingURL=construction-metadata.js.map

package/dist/files-sdk/s3/construction-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"construction-metadata.js","sourceRoot":"","sources":["../../../src/files-sdk/s3/construction-metadata.ts"],"names":[],"mappings":"AAKA,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAGrC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,OAAO,EAAmB,CAAC;AAEpE,MAAM,UAAU,oCAAoC,CAClD,GAAW,EACX,OAAgB;IAEhB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CACjB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,4BAA4B,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAW;IAEX,OAAO,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,QAAgC;IAEhC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,CAAC,uBAAuB,KAAK,QAAQ,CAAC,uBAAuB,EACrE,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAAW;IAEX,OAAO,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["export interface S3ConstructionMetadata {\n  /** Whether URL generation bypasses signing through a configured public origin. */\n  readonly publicBaseUrlConfigured: boolean;\n}\n\nconst constructionMetadata = new WeakMap<\n  object,\n  Readonly<S3ConstructionMetadata>\n>();\nconst conditionalRequestPermission = new WeakMap<object, boolean>();\n\nexport function recordS3ConditionalRequestPermission(\n  raw: object,\n  enabled: boolean,\n): void {\n  const existing = conditionalRequestPermission.get(raw);\n  if (existing !== undefined && existing !== enabled) {\n    throw new TypeError(\n      'S3 conditional-request construction permission cannot be changed.',\n    );\n  }\n  conditionalRequestPermission.set(raw, enabled);\n}\n\nexport function getS3ConditionalRequestPermission(\n  raw: object,\n): boolean | undefined {\n  return conditionalRequestPermission.get(raw);\n}\n\nexport function recordS3ConstructionMetadata(\n  raw: object,\n  metadata: S3ConstructionMetadata,\n): void {\n  const existing = constructionMetadata.get(raw);\n  if (\n    existing !== undefined &&\n    existing.publicBaseUrlConfigured !== metadata.publicBaseUrlConfigured\n  ) {\n    throw new TypeError('S3 adapter construction metadata cannot be changed.');\n  }\n  constructionMetadata.set(raw, Object.freeze({ ...metadata }));\n}\n\nexport function getS3ConstructionMetadata(\n  raw: object,\n): Readonly<S3ConstructionMetadata> | undefined {\n  return constructionMetadata.get(raw);\n}\n"]}

package/dist/files-sdk/s3/index.d.ts

@@ -0,0 +1,54 @@
+import { mapS3Error, type S3Adapter, type S3AdapterOptions } from 'files-sdk/s3';
+import type { StorageCapabilities } from '../../storage.types.js';
+import { type FilesSdkConditionalCopyAdapter, type FilesSdkConditionalDeleteAdapter, type FilesSdkConditionalReadAdapter, type FilesSdkConditionalUploadAdapter, type FilesSdkDriverOptions, type FilesSdkPhysicalKeyAdapter, type FilesSdkSignedUploadPolicyAdapter, type FilesSdkSignedDownloadPolicyAdapter, type FilesSdkStorageDriver } from '../files-sdk.driver.js';
+export interface S3StorageDriverOptions extends Omit<FilesSdkDriverOptions<S3Adapter>, 'adapter'> {
+    adapter: S3AdapterOptions;
+    /**
+     * Exact, conformance-verified provider behavior. Native AWS S3 uses the
+     * built-in AWS profile when no endpoint override is present; an explicit
+     * native profile may only narrow that immutable ceiling. Endpoint overrides
+     * without an explicit profile force the whole driver read-only.
+     */
+    providerProfile?: S3ProviderProfile;
+}
+type S3ProfileCapabilities = Pick<StorageCapabilities, 'conditionalCreate' | 'conditionalReplace' | 'conditionalDelete' | 'conditionalRead' | 'conditionalCopySource' | 'conditionalCopyDestination' | 'conditionalMultipartCompletion' | 'physicalKey' | 'signedUploadPolicy'>;
+declare const verifiedS3ProviderProfile: unique symbol;
+export interface S3ProviderProfileInput extends S3ProfileCapabilities {
+    /** Stable profile identity for configuration, diagnostics, and audit. */
+    readonly name: string;
+    /** Every S3-compatible profile must declare its complete-key byte budget. */
+    readonly physicalKey: NonNullable<S3ProfileCapabilities['physicalKey']>;
+    /** Constraints the provider proves; omission defaults both claims to false. */
+    readonly signedUploadPolicy?: NonNullable<S3ProfileCapabilities['signedUploadPolicy']>;
+}
+/** A validated profile created by {@link defineS3ProviderProfile}. */
+export type S3ProviderProfile = Readonly<Omit<S3ProviderProfileInput, 'signedUploadPolicy'> & {
+    readonly signedUploadPolicy: NonNullable<S3ProfileCapabilities['signedUploadPolicy']>;
+}> & {
+    readonly [verifiedS3ProviderProfile]: true;
+};
+/** Validates and deeply freezes an explicitly verified S3-compatible profile. */
+export declare function defineS3ProviderProfile(profile: S3ProviderProfileInput): S3ProviderProfile;
+export declare const AWS_S3_PROVIDER_PROFILE: S3ProviderProfile;
+export declare const CLOUDFLARE_R2_PROVIDER_PROFILE: S3ProviderProfile;
+type S3StorageAdapterBase = S3Adapter & FilesSdkPhysicalKeyAdapter & FilesSdkSignedDownloadPolicyAdapter & FilesSdkSignedUploadPolicyAdapter;
+export type S3StorageAdapter = S3StorageAdapterBase & Partial<FilesSdkConditionalCopyAdapter & FilesSdkConditionalDeleteAdapter & FilesSdkConditionalReadAdapter & FilesSdkConditionalUploadAdapter>;
+/** Constructs the upstream S3 adapter while retaining security-relevant metadata. */
+export declare function s3(options: S3AdapterOptions): S3Adapter;
+/**
+ * Adds only the exact operations declared by one verified provider profile.
+ * Each raw adapter may be decorated once so capability state cannot depend on
+ * profile application order. A native AWS SDK endpoint also bounds every
+ * explicit profile by the built-in AWS capability ceiling.
+ */
+export declare function withS3Capabilities(base: S3Adapter, options?: Pick<S3AdapterOptions, 'endpoint' | 'publicBaseUrl'> & {
+    providerProfile?: S3ProviderProfile;
+}): S3StorageAdapter;
+/**
+ * Creates the files-sdk S3 driver from the storage package's own dependency
+ * context and exposes only the operations in its verified provider profile.
+ */
+export declare function createS3StorageDriver(options: S3StorageDriverOptions): FilesSdkStorageDriver<S3StorageAdapter>;
+export { mapS3Error };
+export type { S3Adapter, S3AdapterOptions, S3Sdk } from 'files-sdk/s3';
+//# sourceMappingURL=index.d.ts.map

package/dist/files-sdk/s3/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/files-sdk/s3/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,UAAU,EAEV,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAEV,mBAAmB,EAQpB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EAKL,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mCAAmC,EACxC,KAAK,qBAAqB,EAG3B,MAAM,wBAAwB,CAAC;AAQhC,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,qBAAqB,CAAC,SAAS,CAAC,EAChC,SAAS,CACV;IACC,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,KAAK,qBAAqB,GAAG,IAAI,CAC/B,mBAAmB,EACjB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,uBAAuB,GACvB,4BAA4B,GAC5B,gCAAgC,GAChC,aAAa,GACb,oBAAoB,CACvB,CAAC;AAEF,QAAA,MAAM,yBAAyB,eAAsC,CAAC;AAGtE,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CACvC,qBAAqB,CAAC,oBAAoB,CAAC,CAC5C,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CACtC,IAAI,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,GAAG;IACnD,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CACtC,qBAAqB,CAAC,oBAAoB,CAAC,CAC5C,CAAC;CACH,CACF,GAAG;IACF,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,iFAAiF;AACjF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CAsLnB;AAiKD,eAAO,MAAM,uBAAuB,mBAelC,CAAC;AAEH,eAAO,MAAM,8BAA8B,mBAQzC,CAAC;AAQH,KAAK,oBAAoB,GAAG,SAAS,GACnC,0BAA0B,GAC1B,mCAAmC,GACnC,iCAAiC,CAAC;AAEpC,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GACjD,OAAO,CACL,8BAA8B,GAC5B,gCAAgC,GAChC,8BAA8B,GAC9B,gCAAgC,CACnC,CAAC;AA2oCJ,qFAAqF;AACrF,wBAAgB,EAAE,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA8BvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,eAAe,CAAC,GAAG;IAC9D,eAAe,CAAC,EAAE,iBAAiB,CAAC;CAChC,GACL,gBAAgB,CAkblB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,qBAAqB,CAAC,gBAAgB,CAAC,CAazC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC"}