@nestm/storage 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/artifacts/nest/index.js

@@ -1,129 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Inject, Module, } from '@nestjs/common';
-import { StorageModule } from '../../storage.module.js';
-import { getStorageToken } from '../../storage.tokens.js';
-import { createArtifactStorageWithClient, } from '../artifact-storage.js';
-import { createObjectStoreWithClient, } from '../object-store.js';
-import { ARTIFACT_STORAGE_CLIENT_NAME, OBJECT_STORAGE_CLIENT_NAME, createArtifactStorageDriver, createObjectStorageDriver, } from '../storage-driver.js';
-export const ARTIFACT_STORAGE = Symbol.for('@nestm/storage/artifacts/artifact-storage');
-export const OBJECT_STORE = Symbol.for('@nestm/storage/artifacts/object-store');
-export const ARTIFACT_STORAGE_MODULE_OPTIONS = Symbol.for('@nestm/storage/artifacts/module-options');
-export function InjectArtifactStorage() {
-    return Inject(ARTIFACT_STORAGE);
-}
-export function InjectObjectStore() {
-    return Inject(OBJECT_STORE);
-}
-let ArtifactStorageOptionsHostModule = class ArtifactStorageOptionsHostModule {
-};
-ArtifactStorageOptionsHostModule = __decorate([
-    Module({})
-], ArtifactStorageOptionsHostModule);
-function syncOptionsHost(options) {
-    return {
-        module: ArtifactStorageOptionsHostModule,
-        providers: [
-            { provide: ARTIFACT_STORAGE_MODULE_OPTIONS, useValue: options },
-        ],
-        exports: [ARTIFACT_STORAGE_MODULE_OPTIONS],
-    };
-}
-function asyncOptionsHost(options) {
-    return {
-        module: ArtifactStorageOptionsHostModule,
-        imports: options.imports ?? [],
-        providers: [
-            {
-                provide: ARTIFACT_STORAGE_MODULE_OPTIONS,
-                inject: options.inject ?? [],
-                useFactory: options.useFactory,
-            },
-        ],
-        exports: [ARTIFACT_STORAGE_MODULE_OPTIONS],
-    };
-}
-function domainProviders() {
-    return [
-        {
-            provide: ARTIFACT_STORAGE,
-            inject: [
-                ARTIFACT_STORAGE_MODULE_OPTIONS,
-                getStorageToken(ARTIFACT_STORAGE_CLIENT_NAME),
-            ],
-            useFactory: (options, client) => createArtifactStorageWithClient(options.config, options.crypto, client),
-        },
-        {
-            provide: OBJECT_STORE,
-            inject: [
-                ARTIFACT_STORAGE_MODULE_OPTIONS,
-                getStorageToken(OBJECT_STORAGE_CLIENT_NAME),
-            ],
-            useFactory: (options, client) => createObjectStoreWithClient(options.config, options.crypto, client),
-        },
-        ArtifactStorageCryptoShutdown,
-    ];
-}
-let ArtifactStorageCryptoShutdown = class ArtifactStorageCryptoShutdown {
-    options;
-    constructor(options) {
-        this.options = options;
-    }
-    onApplicationShutdown() {
-        this.options.crypto.keyProvider.clear();
-    }
-};
-ArtifactStorageCryptoShutdown = __decorate([
-    __param(0, Inject(ARTIFACT_STORAGE_MODULE_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
-], ArtifactStorageCryptoShutdown);
-function composeModule(optionsHost, isGlobal) {
-    const rawStorageModule = StorageModule.forRootAsync({
-        imports: [optionsHost],
-        default: ARTIFACT_STORAGE_CLIENT_NAME,
-        isGlobal,
-        stores: [
-            {
-                name: ARTIFACT_STORAGE_CLIENT_NAME,
-                inject: [ARTIFACT_STORAGE_MODULE_OPTIONS],
-                useFactory: (options) => createArtifactStorageDriver(options.config),
-            },
-            {
-                name: OBJECT_STORAGE_CLIENT_NAME,
-                inject: [ARTIFACT_STORAGE_MODULE_OPTIONS],
-                useFactory: (options) => createObjectStorageDriver(options.config),
-            },
-        ],
-    });
-    return {
-        module: ArtifactStorageModule,
-        global: isGlobal,
-        imports: [optionsHost, rawStorageModule],
-        providers: domainProviders(),
-        exports: [ARTIFACT_STORAGE, OBJECT_STORE, StorageModule],
-    };
-}
-let ArtifactStorageModule = class ArtifactStorageModule {
-    static forRoot(options) {
-        const { config, crypto } = options;
-        return composeModule(syncOptionsHost({ config, crypto }), options.isGlobal === true);
-    }
-    static forRootAsync(options) {
-        return composeModule(asyncOptionsHost(options), options.isGlobal === true);
-    }
-};
-ArtifactStorageModule = __decorate([
-    Module({})
-], ArtifactStorageModule);
-export { ArtifactStorageModule };
-//# sourceMappingURL=index.js.map

package/dist/artifacts/nest/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/artifacts/nest/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,MAAM,GAMP,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EACL,+BAA+B,GAEhC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CACxC,2CAA2C,CAC5C,CAAC;AACF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CACvD,yCAAyC,CAC1C,CAAC;AA2BF,MAAM,UAAU,qBAAqB;IAEnC,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;AAC9B,CAAC;AAGD,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;CAAG,CAAA;AAAnC,gCAAgC;IADrC,MAAM,CAAC,EAAE,CAAC;GACL,gCAAgC,CAAG;AAEzC,SAAS,eAAe,CACtB,OAA6C;IAE7C,OAAO;QACL,MAAM,EAAE,gCAAgC;QACxC,SAAS,EAAE;YACT,EAAE,OAAO,EAAE,+BAA+B,EAAE,QAAQ,EAAE,OAAO,EAAE;SAChE;QACD,OAAO,EAAE,CAAC,+BAA+B,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0C;IAE1C,OAAO;QACL,MAAM,EAAE,gCAAgC;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,+BAA+B;gBACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;SACF;QACD,OAAO,EAAE,CAAC,+BAA+B,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL;YACE,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE;gBACN,+BAA+B;gBAC/B,eAAe,CAAC,4BAA4B,CAAC;aAC9C;YACD,UAAU,EAAE,CACV,OAA6C,EAC7C,MAAqB,EACJ,EAAE,CACnB,+BAA+B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;SAC1E;QACD;YACE,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE;gBACN,+BAA+B;gBAC/B,eAAe,CAAC,0BAA0B,CAAC;aAC5C;YACD,UAAU,EAAE,CACV,OAA6C,EAC7C,MAAqB,EACR,EAAE,CACf,2BAA2B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;SACtE;QACD,6BAA6B;KAC9B,CAAC;AACJ,CAAC;AAED,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAGd,OAAO;IAF1B,YAEmB,OAA6C;uBAA7C,OAAO;IACvB,CAAC;IAEJ,qBAAqB;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AATK,6BAA6B;IAE9B,WAAA,MAAM,CAAC,+BAA+B,CAAC,CAAA;;GAFtC,6BAA6B,CASlC;AAED,SAAS,aAAa,CACpB,WAA0B,EAC1B,QAAiB;IAEjB,MAAM,gBAAgB,GAAG,aAAa,CAAC,YAAY,CAAC;QAClD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,OAAO,EAAE,4BAA4B;QACrC,QAAQ;QACR,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,CAAC,+BAA+B,CAAC;gBACzC,UAAU,EAAE,CAAC,OAA6C,EAAE,EAAE,CAC5D,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC;aAC9C;YACD;gBACE,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,CAAC,+BAA+B,CAAC;gBACzC,UAAU,EAAE,CAAC,OAA6C,EAAE,EAAE,CAC5D,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC;aAC5C;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACxC,SAAS,EAAE,eAAe,EAAE;QAC5B,OAAO,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,aAAa,CAAC;KACzD,CAAC;AACJ,CAAC;AAGM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,MAAM,CAAC,OAAO,CAAC,OAAqC;QAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnC,OAAO,aAAa,CAClB,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACnC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,OAA0C;QAE1C,OAAO,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC;CACF,CAAA;AAdY,qBAAqB;IADjC,MAAM,CAAC,EAAE,CAAC;GACE,qBAAqB,CAcjC","sourcesContent":["import {\n  Inject,\n  Module,\n  type DynamicModule,\n  type FactoryProvider,\n  type ModuleMetadata,\n  type OnApplicationShutdown,\n  type Provider,\n} from '@nestjs/common';\nimport type { StorageClient } from '../../storage.client.js';\nimport { StorageModule } from '../../storage.module.js';\nimport { getStorageToken } from '../../storage.tokens.js';\n\nimport {\n  createArtifactStorageWithClient,\n  type ArtifactStorage,\n} from '../artifact-storage.js';\nimport type { StorageCrypto } from '../crypto/index.js';\nimport {\n  createObjectStoreWithClient,\n  type ObjectStore,\n} from '../object-store.js';\nimport {\n  ARTIFACT_STORAGE_CLIENT_NAME,\n  OBJECT_STORAGE_CLIENT_NAME,\n  createArtifactStorageDriver,\n  createObjectStorageDriver,\n  type ArtifactStorageConfig,\n} from '../storage-driver.js';\n\nexport const ARTIFACT_STORAGE = Symbol.for(\n  '@nestm/storage/artifacts/artifact-storage',\n);\nexport const OBJECT_STORE = Symbol.for('@nestm/storage/artifacts/object-store');\nexport const ARTIFACT_STORAGE_MODULE_OPTIONS = Symbol.for(\n  '@nestm/storage/artifacts/module-options',\n);\n\nexport interface ArtifactStorageModuleOptions {\n  config: ArtifactStorageConfig;\n  crypto: StorageCrypto;\n  /** Makes the product adapters and @nestm/storage clients globally injectable. */\n  isGlobal?: boolean;\n}\n\ninterface ResolvedArtifactStorageModuleOptions {\n  config: ArtifactStorageConfig;\n  crypto: StorageCrypto;\n}\n\nexport interface ArtifactStorageModuleAsyncOptions extends Pick<\n  ModuleMetadata,\n  'imports'\n> {\n  inject?: FactoryProvider['inject'];\n  isGlobal?: boolean;\n  useFactory: (\n    ...dependencies: never[]\n  ) =>\n    | ResolvedArtifactStorageModuleOptions\n    | Promise<ResolvedArtifactStorageModuleOptions>;\n}\n\nexport function InjectArtifactStorage(): ParameterDecorator &\n  PropertyDecorator {\n  return Inject(ARTIFACT_STORAGE);\n}\n\nexport function InjectObjectStore(): ParameterDecorator & PropertyDecorator {\n  return Inject(OBJECT_STORE);\n}\n\n@Module({})\nclass ArtifactStorageOptionsHostModule {}\n\nfunction syncOptionsHost(\n  options: ResolvedArtifactStorageModuleOptions,\n): DynamicModule {\n  return {\n    module: ArtifactStorageOptionsHostModule,\n    providers: [\n      { provide: ARTIFACT_STORAGE_MODULE_OPTIONS, useValue: options },\n    ],\n    exports: [ARTIFACT_STORAGE_MODULE_OPTIONS],\n  };\n}\n\nfunction asyncOptionsHost(\n  options: ArtifactStorageModuleAsyncOptions,\n): DynamicModule {\n  return {\n    module: ArtifactStorageOptionsHostModule,\n    imports: options.imports ?? [],\n    providers: [\n      {\n        provide: ARTIFACT_STORAGE_MODULE_OPTIONS,\n        inject: options.inject ?? [],\n        useFactory: options.useFactory,\n      },\n    ],\n    exports: [ARTIFACT_STORAGE_MODULE_OPTIONS],\n  };\n}\n\nfunction domainProviders(): Provider[] {\n  return [\n    {\n      provide: ARTIFACT_STORAGE,\n      inject: [\n        ARTIFACT_STORAGE_MODULE_OPTIONS,\n        getStorageToken(ARTIFACT_STORAGE_CLIENT_NAME),\n      ],\n      useFactory: (\n        options: ResolvedArtifactStorageModuleOptions,\n        client: StorageClient,\n      ): ArtifactStorage =>\n        createArtifactStorageWithClient(options.config, options.crypto, client),\n    },\n    {\n      provide: OBJECT_STORE,\n      inject: [\n        ARTIFACT_STORAGE_MODULE_OPTIONS,\n        getStorageToken(OBJECT_STORAGE_CLIENT_NAME),\n      ],\n      useFactory: (\n        options: ResolvedArtifactStorageModuleOptions,\n        client: StorageClient,\n      ): ObjectStore =>\n        createObjectStoreWithClient(options.config, options.crypto, client),\n    },\n    ArtifactStorageCryptoShutdown,\n  ];\n}\n\nclass ArtifactStorageCryptoShutdown implements OnApplicationShutdown {\n  constructor(\n    @Inject(ARTIFACT_STORAGE_MODULE_OPTIONS)\n    private readonly options: ResolvedArtifactStorageModuleOptions,\n  ) {}\n\n  onApplicationShutdown(): void {\n    this.options.crypto.keyProvider.clear();\n  }\n}\n\nfunction composeModule(\n  optionsHost: DynamicModule,\n  isGlobal: boolean,\n): DynamicModule {\n  const rawStorageModule = StorageModule.forRootAsync({\n    imports: [optionsHost],\n    default: ARTIFACT_STORAGE_CLIENT_NAME,\n    isGlobal,\n    stores: [\n      {\n        name: ARTIFACT_STORAGE_CLIENT_NAME,\n        inject: [ARTIFACT_STORAGE_MODULE_OPTIONS],\n        useFactory: (options: ResolvedArtifactStorageModuleOptions) =>\n          createArtifactStorageDriver(options.config),\n      },\n      {\n        name: OBJECT_STORAGE_CLIENT_NAME,\n        inject: [ARTIFACT_STORAGE_MODULE_OPTIONS],\n        useFactory: (options: ResolvedArtifactStorageModuleOptions) =>\n          createObjectStorageDriver(options.config),\n      },\n    ],\n  });\n\n  return {\n    module: ArtifactStorageModule,\n    global: isGlobal,\n    imports: [optionsHost, rawStorageModule],\n    providers: domainProviders(),\n    exports: [ARTIFACT_STORAGE, OBJECT_STORE, StorageModule],\n  };\n}\n\n@Module({})\nexport class ArtifactStorageModule {\n  static forRoot(options: ArtifactStorageModuleOptions): DynamicModule {\n    const { config, crypto } = options;\n    return composeModule(\n      syncOptionsHost({ config, crypto }),\n      options.isGlobal === true,\n    );\n  }\n\n  static forRootAsync(\n    options: ArtifactStorageModuleAsyncOptions,\n  ): DynamicModule {\n    return composeModule(asyncOptionsHost(options), options.isGlobal === true);\n  }\n}\n"]}

package/dist/artifacts/object-store.d.ts

@@ -1,27 +0,0 @@
-import { type StorageClient } from '../core/index.js';
-import { type ReadRef, type ScopeRef } from './artifact-storage.js';
-import { type StorageCrypto } from './crypto/index.js';
-import { type ArtifactStorageConfig } from './storage-driver.js';
-/**
- * Generic key→bytes object store (not artifact-shaped). Backs org-logo uploads and staged
- * artifact uploads. Objects are CAE1 envelopes like artifact files; the content type lives in
- * the authenticated envelope header on every provider. Filesystem `.ct` sidecars remain read-only
- * compatibility data and are never emitted.
- */
-export interface ObjectStore {
-    putObject(key: string, body: Buffer, contentType: string, ref: ScopeRef): Promise<void>;
-    /** `null` if absent; throws `EnvelopeError` on decrypt failure (never masked as a miss). */
-    getObject(key: string, ref: ReadRef): Promise<{
-        body: Buffer;
-        contentType?: string;
-    } | null>;
-    deleteObject(key: string): Promise<void>;
-    /** Delete every object under `prefix` last modified more than `olderThanMs` ago. Returns the count deleted. */
-    sweepObjects(prefix: string, olderThanMs: number): Promise<number>;
-    /** Keys beginning with `prefix` (store namespace), sorted lexicographically. */
-    listObjects(prefix: string): Promise<string[]>;
-}
-export declare function createObjectStore(cfg: ArtifactStorageConfig, crypto: StorageCrypto): Promise<ObjectStore>;
-/** Framework-neutral domain adapter used by both direct consumers and the Nest composition entry. */
-export declare function createObjectStoreWithClient(cfg: ArtifactStorageConfig, crypto: StorageCrypto, client: StorageClient): ObjectStore;
-//# sourceMappingURL=object-store.d.ts.map

package/dist/artifacts/object-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"object-store.d.ts","sourceRoot":"","sources":["../../src/artifacts/object-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,4FAA4F;IAC5F,SAAS,CACP,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,+GAA+G;IAC/G,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,gFAAgF;IAChF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChD;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,WAAW,CAAC,CAGtB;AAED,qGAAqG;AACrG,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,WAAW,CAOb"}

package/dist/artifacts/object-store.js

@@ -1,198 +0,0 @@
-import { StorageErrorCode, isStorageError, } from '../core/index.js';
-import { warnLegacyRead, } from './artifact-storage.js';
-import { open, seal, } from './crypto/index.js';
-import { createObjectStorageClient, DEFAULT_OBJECT_NAMESPACES, resolveObjectNamespaces, } from './storage-driver.js';
-export async function createObjectStore(cfg, crypto) {
-    const client = await createObjectStorageClient(cfg);
-    return createObjectStoreWithClient(cfg, crypto, client);
-}
-/** Framework-neutral domain adapter used by both direct consumers and the Nest composition entry. */
-export function createObjectStoreWithClient(cfg, crypto, client) {
-    return new ClientObjectStore(client, crypto, cfg.provider === 'fs', cfg.objectNamespaces ?? DEFAULT_OBJECT_NAMESPACES);
-}
-/**
- * Envelope context for a store object. `path` is the store-relative KEY on every provider —
- * the fs `_objects/` nesting is a driver-level prefix and must never reach the AAD, or two
- * providers would bind ciphertext to different addresses for the same logical object.
- */
-function objectCtx(key, ref) {
-    return {
-        scope: ref.scope,
-        artifactId: null,
-        version: ref.version ?? null,
-        path: key,
-    };
-}
-function aliasesLegacyFilesystemSidecar(segment) {
-    let end = segment.length;
-    while (end > 0 &&
-        (segment.charCodeAt(end - 1) === 0x2e ||
-            segment.charCodeAt(end - 1) === 0x20)) {
-        end--;
-    }
-    return segment.slice(0, end).toLowerCase().endsWith('.ct');
-}
-function assertObjectKey(key, namespaces, filesystemLayout, allowEmpty = false) {
-    const firstSegment = key.split(/[/\\]/, 1)[0] ?? '';
-    const segments = key.split(/[/\\]/);
-    if (allowEmpty && segments.at(-1) === '')
-        segments.pop();
-    if ((!allowEmpty && key === '') ||
-        key.startsWith('/') ||
-        key.includes('\0') ||
-        (filesystemLayout && segments.some(aliasesLegacyFilesystemSidecar)) ||
-        segments.some((segment) => segment === '' || segment === '.' || segment === '..') ||
-        (key !== '' && !namespaces.has(firstSegment.toLowerCase()))) {
-        throw new Error(`invalid object key: ${key}`);
-    }
-}
-async function collectRawObject(object) {
-    const chunks = [];
-    const reader = object.body.getReader();
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            chunks.push(Buffer.from(value));
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    return Buffer.concat(chunks);
-}
-function isObjectKeyAllowed(key, namespaces, filesystemLayout) {
-    try {
-        assertObjectKey(key, namespaces, filesystemLayout);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-class ClientObjectStore {
-    client;
-    crypto;
-    filesystemLayout;
-    namespaces;
-    constructor(client, crypto, filesystemLayout, namespaces) {
-        this.client = client;
-        this.crypto = crypto;
-        this.filesystemLayout = filesystemLayout;
-        this.namespaces = resolveObjectNamespaces(namespaces);
-    }
-    async putObject(key, body, contentType, ref) {
-        assertObjectKey(key, this.namespaces, this.filesystemLayout);
-        const sealed = await seal(body, objectCtx(key, ref), this.crypto.keyProvider, contentType);
-        await this.client.upload(key, sealed, {
-            // Real content type rides the authenticated envelope; raw storage remains opaque.
-            contentType: 'application/octet-stream',
-        });
-        if (this.filesystemLayout)
-            await this.client.delete(`${key}.ct`);
-    }
-    async getObject(key, ref) {
-        assertObjectKey(key, this.namespaces, this.filesystemLayout);
-        const stored = await this.downloadRaw(this.client, key);
-        if (stored === null)
-            return null;
-        const out = await open(stored.raw, objectCtx(key, ref), this.crypto.keyProvider, this.crypto.allowLegacyPlaintext === undefined
-            ? {}
-            : { allowLegacyPlaintext: this.crypto.allowLegacyPlaintext });
-        let contentType = out.contentType;
-        if (out.legacy) {
-            warnLegacyRead(this.filesystemLayout ? 'fs-object' : 'object', key);
-            if (this.filesystemLayout) {
-                contentType = await this.readLegacyFilesystemContentType(key);
-            }
-            else {
-                contentType = stored.contentType;
-            }
-        }
-        return {
-            body: out.plain,
-            ...(contentType === undefined ? {} : { contentType }),
-        };
-    }
-    async deleteObject(key) {
-        assertObjectKey(key, this.namespaces, this.filesystemLayout);
-        await this.client.delete(key);
-        if (this.filesystemLayout)
-            await this.client.delete(`${key}.ct`);
-    }
-    async sweepObjects(prefix, olderThanMs) {
-        assertObjectKey(prefix, this.namespaces, this.filesystemLayout, true);
-        if (!Number.isFinite(olderThanMs) || olderThanMs < 0) {
-            throw new RangeError('olderThanMs must be a finite non-negative number');
-        }
-        const cutoff = Date.now() - olderThanMs;
-        let deleted = 0;
-        for await (const object of this.client.listAll({ prefix })) {
-            if (!isObjectKeyAllowed(object.key, this.namespaces, this.filesystemLayout)) {
-                continue;
-            }
-            if (this.filesystemLayout && object.key.toLowerCase().endsWith('.ct'))
-                continue;
-            if (!isExpired(object.lastModified, cutoff))
-                continue;
-            await this.client.delete(object.key);
-            if (this.filesystemLayout)
-                await this.client.delete(`${object.key}.ct`);
-            deleted++;
-        }
-        return deleted;
-    }
-    async listObjects(prefix) {
-        assertObjectKey(prefix, this.namespaces, this.filesystemLayout, true);
-        const keys = new Set();
-        for await (const object of this.client.listAll({ prefix })) {
-            if (!isObjectKeyAllowed(object.key, this.namespaces, this.filesystemLayout)) {
-                continue;
-            }
-            if (this.filesystemLayout && object.key.toLowerCase().endsWith('.ct'))
-                continue;
-            keys.add(object.key);
-        }
-        return [...keys].sort();
-    }
-    async downloadRaw(client, key) {
-        try {
-            const object = await client.downloadStream(key);
-            const raw = await collectRawObject(object);
-            return {
-                raw,
-                ...(object.contentType === undefined
-                    ? {}
-                    : { contentType: object.contentType }),
-            };
-        }
-        catch (error) {
-            if (isStorageError(error) && error.code === StorageErrorCode.NOT_FOUND) {
-                return null;
-            }
-            throw error;
-        }
-    }
-    async readLegacyFilesystemContentType(key) {
-        try {
-            return await this.client.downloadText(`${key}.ct`, {
-                maxBytes: 64 * 1024,
-            });
-        }
-        catch (error) {
-            if (isStorageError(error) && error.code === StorageErrorCode.NOT_FOUND) {
-                return undefined;
-            }
-            throw error;
-        }
-    }
-}
-function isExpired(lastModified, cutoff) {
-    const modifiedAt = lastModified?.getTime();
-    // A provider that cannot supply a trustworthy timestamp cannot prove an object is expired.
-    return (modifiedAt !== undefined &&
-        Number.isFinite(modifiedAt) &&
-        modifiedAt < cutoff);
-}
-//# sourceMappingURL=object-store.js.map

package/dist/artifacts/object-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"object-store.js","sourceRoot":"","sources":["../../src/artifacts/object-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,IAAI,EACJ,IAAI,GAGL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AA2B7B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAA0B,EAC1B,MAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,2BAA2B,CACzC,GAA0B,EAC1B,MAAqB,EACrB,MAAqB;IAErB,OAAO,IAAI,iBAAiB,CAC1B,MAAM,EACN,MAAM,EACN,GAAG,CAAC,QAAQ,KAAK,IAAI,EACrB,GAAG,CAAC,gBAAgB,IAAI,yBAAyB,CAClD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,GAAuB;IACrD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,IAAI,EAAE,GAAG;KACV,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAe;IACrD,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OACE,GAAG,GAAG,CAAC;QACP,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;YACnC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EACvC,CAAC;QACD,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CACtB,GAAW,EACX,UAA+B,EAC/B,gBAAyB,EACzB,UAAU,GAAG,KAAK;IAElB,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,UAAU,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IACzD,IACE,CAAC,CAAC,UAAU,IAAI,GAAG,KAAK,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClB,CAAC,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACnE;QACD,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAqB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAOD,SAAS,kBAAkB,CACzB,GAAW,EACX,UAA+B,EAC/B,gBAAyB;IAEzB,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB;IAIF,MAAM;IACN,MAAM;IACN,gBAAgB;IALlB,UAAU,CAAsB;IAEjD,YACmB,MAAqB,EACrB,MAAqB,EACrB,gBAAyB,EAC1C,UAA6B;sBAHZ,MAAM;sBACN,MAAM;gCACN,gBAAgB;QAGjC,IAAI,CAAC,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,IAAY,EACZ,WAAmB,EACnB,GAAa;QAEb,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,IAAI,EACJ,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EACnB,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,WAAW,CACZ,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE;YACpC,kFAAkF;YAClF,WAAW,EAAE,0BAA0B;SACxC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,GAAY;QAEZ,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,MAAM,CAAC,GAAG,EACV,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EACnB,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAC/D,CAAC;QACF,IAAI,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,WAAW,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,KAAK;YACf,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,WAAmB;QACpD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,kDAAkD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3D,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACvE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnE,SAAS;YACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;gBAAE,SAAS;YACtD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,gBAAgB;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3D,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACvE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnE,SAAS;YACX,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAqB,EACrB,GAAW;QAEX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO;gBACL,GAAG;gBACH,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;oBAClC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;aACzC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,SAAS,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAC3C,GAAW;QAEX,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,KAAK,EAAE;gBACjD,QAAQ,EAAE,EAAE,GAAG,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,SAAS,EAAE,CAAC;gBACvE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,YAA8B,EAAE,MAAc;IAC/D,MAAM,UAAU,GAAG,YAAY,EAAE,OAAO,EAAE,CAAC;IAC3C,2FAA2F;IAC3F,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3B,UAAU,GAAG,MAAM,CACpB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  StorageErrorCode,\n  isStorageError,\n  type StorageClient,\n  type StorageObject,\n} from '../core/index.js';\n\nimport {\n  warnLegacyRead,\n  type ReadRef,\n  type ScopeRef,\n} from './artifact-storage.js';\nimport {\n  open,\n  seal,\n  type EnvelopeContext,\n  type StorageCrypto,\n} from './crypto/index.js';\nimport {\n  createObjectStorageClient,\n  DEFAULT_OBJECT_NAMESPACES,\n  resolveObjectNamespaces,\n  type ArtifactStorageConfig,\n} from './storage-driver.js';\n\n/**\n * Generic key→bytes object store (not artifact-shaped). Backs org-logo uploads and staged\n * artifact uploads. Objects are CAE1 envelopes like artifact files; the content type lives in\n * the authenticated envelope header on every provider. Filesystem `.ct` sidecars remain read-only\n * compatibility data and are never emitted.\n */\nexport interface ObjectStore {\n  putObject(\n    key: string,\n    body: Buffer,\n    contentType: string,\n    ref: ScopeRef,\n  ): Promise<void>;\n  /** `null` if absent; throws `EnvelopeError` on decrypt failure (never masked as a miss). */\n  getObject(\n    key: string,\n    ref: ReadRef,\n  ): Promise<{ body: Buffer; contentType?: string } | null>;\n  deleteObject(key: string): Promise<void>;\n  /** Delete every object under `prefix` last modified more than `olderThanMs` ago. Returns the count deleted. */\n  sweepObjects(prefix: string, olderThanMs: number): Promise<number>;\n  /** Keys beginning with `prefix` (store namespace), sorted lexicographically. */\n  listObjects(prefix: string): Promise<string[]>;\n}\n\nexport async function createObjectStore(\n  cfg: ArtifactStorageConfig,\n  crypto: StorageCrypto,\n): Promise<ObjectStore> {\n  const client = await createObjectStorageClient(cfg);\n  return createObjectStoreWithClient(cfg, crypto, client);\n}\n\n/** Framework-neutral domain adapter used by both direct consumers and the Nest composition entry. */\nexport function createObjectStoreWithClient(\n  cfg: ArtifactStorageConfig,\n  crypto: StorageCrypto,\n  client: StorageClient,\n): ObjectStore {\n  return new ClientObjectStore(\n    client,\n    crypto,\n    cfg.provider === 'fs',\n    cfg.objectNamespaces ?? DEFAULT_OBJECT_NAMESPACES,\n  );\n}\n\n/**\n * Envelope context for a store object. `path` is the store-relative KEY on every provider —\n * the fs `_objects/` nesting is a driver-level prefix and must never reach the AAD, or two\n * providers would bind ciphertext to different addresses for the same logical object.\n */\nfunction objectCtx(key: string, ref: ScopeRef | ReadRef): EnvelopeContext {\n  return {\n    scope: ref.scope as string,\n    artifactId: null,\n    version: ref.version ?? null,\n    path: key,\n  };\n}\n\nfunction aliasesLegacyFilesystemSidecar(segment: string): boolean {\n  let end = segment.length;\n  while (\n    end > 0 &&\n    (segment.charCodeAt(end - 1) === 0x2e ||\n      segment.charCodeAt(end - 1) === 0x20)\n  ) {\n    end--;\n  }\n  return segment.slice(0, end).toLowerCase().endsWith('.ct');\n}\n\nfunction assertObjectKey(\n  key: string,\n  namespaces: ReadonlySet<string>,\n  filesystemLayout: boolean,\n  allowEmpty = false,\n): void {\n  const firstSegment = key.split(/[/\\\\]/, 1)[0] ?? '';\n  const segments = key.split(/[/\\\\]/);\n  if (allowEmpty && segments.at(-1) === '') segments.pop();\n  if (\n    (!allowEmpty && key === '') ||\n    key.startsWith('/') ||\n    key.includes('\\0') ||\n    (filesystemLayout && segments.some(aliasesLegacyFilesystemSidecar)) ||\n    segments.some(\n      (segment) => segment === '' || segment === '.' || segment === '..',\n    ) ||\n    (key !== '' && !namespaces.has(firstSegment.toLowerCase()))\n  ) {\n    throw new Error(`invalid object key: ${key}`);\n  }\n}\n\nasync function collectRawObject(object: StorageObject): Promise<Buffer> {\n  const chunks: Buffer[] = [];\n  const reader = object.body.getReader();\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      chunks.push(Buffer.from(value));\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return Buffer.concat(chunks);\n}\n\ninterface RawObject {\n  raw: Buffer;\n  contentType?: string;\n}\n\nfunction isObjectKeyAllowed(\n  key: string,\n  namespaces: ReadonlySet<string>,\n  filesystemLayout: boolean,\n): boolean {\n  try {\n    assertObjectKey(key, namespaces, filesystemLayout);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nclass ClientObjectStore implements ObjectStore {\n  private readonly namespaces: ReadonlySet<string>;\n\n  constructor(\n    private readonly client: StorageClient,\n    private readonly crypto: StorageCrypto,\n    private readonly filesystemLayout: boolean,\n    namespaces: readonly string[],\n  ) {\n    this.namespaces = resolveObjectNamespaces(namespaces);\n  }\n\n  async putObject(\n    key: string,\n    body: Buffer,\n    contentType: string,\n    ref: ScopeRef,\n  ): Promise<void> {\n    assertObjectKey(key, this.namespaces, this.filesystemLayout);\n    const sealed = await seal(\n      body,\n      objectCtx(key, ref),\n      this.crypto.keyProvider,\n      contentType,\n    );\n    await this.client.upload(key, sealed, {\n      // Real content type rides the authenticated envelope; raw storage remains opaque.\n      contentType: 'application/octet-stream',\n    });\n    if (this.filesystemLayout) await this.client.delete(`${key}.ct`);\n  }\n\n  async getObject(\n    key: string,\n    ref: ReadRef,\n  ): Promise<{ body: Buffer; contentType?: string } | null> {\n    assertObjectKey(key, this.namespaces, this.filesystemLayout);\n    const stored = await this.downloadRaw(this.client, key);\n    if (stored === null) return null;\n    const out = await open(\n      stored.raw,\n      objectCtx(key, ref),\n      this.crypto.keyProvider,\n      this.crypto.allowLegacyPlaintext === undefined\n        ? {}\n        : { allowLegacyPlaintext: this.crypto.allowLegacyPlaintext },\n    );\n    let contentType = out.contentType;\n    if (out.legacy) {\n      warnLegacyRead(this.filesystemLayout ? 'fs-object' : 'object', key);\n      if (this.filesystemLayout) {\n        contentType = await this.readLegacyFilesystemContentType(key);\n      } else {\n        contentType = stored.contentType;\n      }\n    }\n    return {\n      body: out.plain,\n      ...(contentType === undefined ? {} : { contentType }),\n    };\n  }\n\n  async deleteObject(key: string): Promise<void> {\n    assertObjectKey(key, this.namespaces, this.filesystemLayout);\n    await this.client.delete(key);\n    if (this.filesystemLayout) await this.client.delete(`${key}.ct`);\n  }\n\n  async sweepObjects(prefix: string, olderThanMs: number): Promise<number> {\n    assertObjectKey(prefix, this.namespaces, this.filesystemLayout, true);\n    if (!Number.isFinite(olderThanMs) || olderThanMs < 0) {\n      throw new RangeError('olderThanMs must be a finite non-negative number');\n    }\n    const cutoff = Date.now() - olderThanMs;\n    let deleted = 0;\n    for await (const object of this.client.listAll({ prefix })) {\n      if (\n        !isObjectKeyAllowed(object.key, this.namespaces, this.filesystemLayout)\n      ) {\n        continue;\n      }\n      if (this.filesystemLayout && object.key.toLowerCase().endsWith('.ct'))\n        continue;\n      if (!isExpired(object.lastModified, cutoff)) continue;\n      await this.client.delete(object.key);\n      if (this.filesystemLayout) await this.client.delete(`${object.key}.ct`);\n      deleted++;\n    }\n    return deleted;\n  }\n\n  async listObjects(prefix: string): Promise<string[]> {\n    assertObjectKey(prefix, this.namespaces, this.filesystemLayout, true);\n    const keys = new Set<string>();\n    for await (const object of this.client.listAll({ prefix })) {\n      if (\n        !isObjectKeyAllowed(object.key, this.namespaces, this.filesystemLayout)\n      ) {\n        continue;\n      }\n      if (this.filesystemLayout && object.key.toLowerCase().endsWith('.ct'))\n        continue;\n      keys.add(object.key);\n    }\n    return [...keys].sort();\n  }\n\n  private async downloadRaw(\n    client: StorageClient,\n    key: string,\n  ): Promise<RawObject | null> {\n    try {\n      const object = await client.downloadStream(key);\n      const raw = await collectRawObject(object);\n      return {\n        raw,\n        ...(object.contentType === undefined\n          ? {}\n          : { contentType: object.contentType }),\n      };\n    } catch (error) {\n      if (isStorageError(error) && error.code === StorageErrorCode.NOT_FOUND) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  private async readLegacyFilesystemContentType(\n    key: string,\n  ): Promise<string | undefined> {\n    try {\n      return await this.client.downloadText(`${key}.ct`, {\n        maxBytes: 64 * 1024,\n      });\n    } catch (error) {\n      if (isStorageError(error) && error.code === StorageErrorCode.NOT_FOUND) {\n        return undefined;\n      }\n      throw error;\n    }\n  }\n}\n\nfunction isExpired(lastModified: Date | undefined, cutoff: number): boolean {\n  const modifiedAt = lastModified?.getTime();\n  // A provider that cannot supply a trustworthy timestamp cannot prove an object is expired.\n  return (\n    modifiedAt !== undefined &&\n    Number.isFinite(modifiedAt) &&\n    modifiedAt < cutoff\n  );\n}\n"]}

package/dist/artifacts/storage-driver.d.ts

@@ -1,48 +0,0 @@
-import { StorageClient, type StorageDriver } from '../core/index.js';
-import { type StorageProviderConfig, type StorageProviderName } from '../files-sdk/provider/index.js';
-export declare const ARTIFACT_STORAGE_CLIENT_NAME = "artifacts";
-export declare const OBJECT_STORAGE_CLIENT_NAME = "objects";
-export declare const DEFAULT_OBJECT_NAMESPACES: readonly ['_staging', 'org-logos'];
-/**
- * Where the generic object store lives relative to the artifact store on a filesystem. Artifact
- * keys are `<artifactId>/<path>`, so an unprefixed object key like `org-logos/x.png` would read
- * back as an artifact directory named `org-logos` — listing, sweeping, and removal would all
- * cross the two. Filesystems therefore retain the historical `_objects` directory. Object-store
- * providers retain their historical unprefixed keys; the configured top-level namespace
- * allowlist keeps those keys disjoint from artifact ids without a rolling-deploy layout change.
- */
-export declare const OBJECT_STORE_PREFIX = "_objects";
-/**
- * Which store backs artifacts, and how to reach it. `provider` is any slug `@nestm/storage`
- * can build — `fs`, `s3`, `gcs`, `azure`, `r2`, `minio`, `supabase`, and ~40 more — so a
- * deployment picks its store from the environment instead of the platform shipping a driver
- * per backend. Only the selected provider's SDK is ever imported.
- */
-export interface ArtifactStorageConfig {
-    provider: StorageProviderName;
-    /** Key prefix so artifacts can share a bucket (or a directory tree) with other apps. */
-    prefix?: string;
-    /**
-     * Flat provider settings: `bucket`/`region`/`endpoint` for an object store, `root` for the
-     * filesystem, `accountName`/`container` for Azure. Each provider reads what it needs.
-     * Credentials may be omitted wherever the provider's SDK resolves its own chain — on AWS that
-     * is the ECS task role, so S3 needs no long-lived keys in env.
-     */
-    config?: StorageProviderConfig;
-    /**
-     * Allowed top-level ObjectStore namespaces. Artifact ids matching one of these values are
-     * rejected, keeping the two public facades disjoint on providers where they share a key root.
-     */
-    objectNamespaces?: readonly string[];
-}
-/** Default filesystem root, shared by the api and the sandbox so zero-config dev lines up. */
-export declare function defaultFsRoot(): string;
-/** Resolve and validate the case-insensitive top-level ObjectStore namespace allowlist. */
-export declare function resolveObjectNamespaces(namespaces?: readonly string[]): ReadonlySet<string>;
-/** Fail fast on an unknown slug with the full list, rather than at the first upload. */
-export declare function assertStorageProvider(provider: string): StorageProviderName;
-export declare function createArtifactStorageDriver(cfg: ArtifactStorageConfig): Promise<StorageDriver>;
-export declare function createObjectStorageDriver(cfg: ArtifactStorageConfig): Promise<StorageDriver>;
-export declare function createArtifactStorageClient(cfg: ArtifactStorageConfig): Promise<StorageClient>;
-export declare function createObjectStorageClient(cfg: ArtifactStorageConfig): Promise<StorageClient>;
-//# sourceMappingURL=storage-driver.d.ts.map

package/dist/artifacts/storage-driver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-driver.d.ts","sourceRoot":"","sources":["../../src/artifacts/storage-driver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,4BAA4B,cAAc,CAAC;AACxD,eAAO,MAAM,0BAA0B,YAAY,CAAC;AACpD,eAAO,MAAM,yBAAyB,YAAI,UAAU,EAAE,WAAW,CAAU,CAAC;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACrC,UAAU,GAAE,SAAS,MAAM,EAA8B,GACxD,WAAW,CAAC,MAAM,CAAC,CAyBrB;AAUD,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAU3E;AAmBD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,CAAC,CAKxB"}

package/dist/artifacts/storage-driver.js

@@ -1,89 +0,0 @@
-import { StorageClient } from '../core/index.js';
-import { createProviderStorageDriver, isStorageProvider, listStorageProviders, } from '../files-sdk/provider/index.js';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-export const ARTIFACT_STORAGE_CLIENT_NAME = 'artifacts';
-export const OBJECT_STORAGE_CLIENT_NAME = 'objects';
-export const DEFAULT_OBJECT_NAMESPACES = ['_staging', 'org-logos'];
-/**
- * Where the generic object store lives relative to the artifact store on a filesystem. Artifact
- * keys are `<artifactId>/<path>`, so an unprefixed object key like `org-logos/x.png` would read
- * back as an artifact directory named `org-logos` — listing, sweeping, and removal would all
- * cross the two. Filesystems therefore retain the historical `_objects` directory. Object-store
- * providers retain their historical unprefixed keys; the configured top-level namespace
- * allowlist keeps those keys disjoint from artifact ids without a rolling-deploy layout change.
- */
-export const OBJECT_STORE_PREFIX = '_objects';
-/** Default filesystem root, shared by the api and the sandbox so zero-config dev lines up. */
-export function defaultFsRoot() {
-    return join(tmpdir(), 'concepta-artifacts-artifacts');
-}
-function trimSlashes(value) {
-    return value.replace(/^\/+|\/+$/g, '');
-}
-/** Resolve and validate the case-insensitive top-level ObjectStore namespace allowlist. */
-export function resolveObjectNamespaces(namespaces = DEFAULT_OBJECT_NAMESPACES) {
-    const resolved = new Set();
-    for (const namespace of namespaces) {
-        const normalized = namespace.toLowerCase();
-        if (namespace === '' ||
-            namespace === '.' ||
-            namespace === '..' ||
-            namespace.includes('/') ||
-            namespace.includes('\\') ||
-            namespace.includes('\0') ||
-            Buffer.byteLength(namespace, 'utf8') > 255 ||
-            normalized === OBJECT_STORE_PREFIX ||
-            resolved.has(normalized)) {
-            throw new Error(`invalid or duplicate object namespace: ${JSON.stringify(namespace)}`);
-        }
-        resolved.add(normalized);
-    }
-    if (resolved.size === 0) {
-        throw new Error('at least one object namespace is required');
-    }
-    return resolved;
-}
-function joinPrefix(...parts) {
-    const joined = parts
-        .flatMap((part) => (part === undefined ? [] : [trimSlashes(part)]))
-        .filter((part) => part.length > 0)
-        .join('/');
-    return joined.length === 0 ? undefined : joined;
-}
-/** Fail fast on an unknown slug with the full list, rather than at the first upload. */
-export function assertStorageProvider(provider) {
-    if (!isStorageProvider(provider)) {
-        const known = listStorageProviders()
-            .map((candidate) => candidate.slug)
-            .join(', ');
-        throw new Error(`Unknown storage provider ${JSON.stringify(provider)}. Known providers: ${known}`);
-    }
-    return provider;
-}
-function providerConfig(cfg) {
-    if (cfg.provider !== 'fs')
-        return cfg.config ?? {};
-    // The filesystem adapter needs a root; every other provider names its store some other way.
-    return { root: defaultFsRoot(), ...cfg.config };
-}
-function driver(cfg, prefix) {
-    return createProviderStorageDriver({
-        provider: cfg.provider,
-        config: providerConfig(cfg),
-        ...(prefix === undefined ? {} : { prefix }),
-    });
-}
-export function createArtifactStorageDriver(cfg) {
-    return driver(cfg, joinPrefix(cfg.prefix));
-}
-export function createObjectStorageDriver(cfg) {
-    return driver(cfg, joinPrefix(cfg.prefix, cfg.provider === 'fs' ? OBJECT_STORE_PREFIX : ''));
-}
-export async function createArtifactStorageClient(cfg) {
-    return new StorageClient(ARTIFACT_STORAGE_CLIENT_NAME, await createArtifactStorageDriver(cfg));
-}
-export async function createObjectStorageClient(cfg) {
-    return new StorageClient(OBJECT_STORAGE_CLIENT_NAME, await createObjectStorageDriver(cfg));
-}
-//# sourceMappingURL=storage-driver.js.map

package/dist/artifacts/storage-driver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-driver.js","sourceRoot":"","sources":["../../src/artifacts/storage-driver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AA0B9C,8FAA8F;AAC9F,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CACrC,UAAU,GAAsB,yBAAyB;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAC3C,IACE,SAAS,KAAK,EAAE;YAChB,SAAS,KAAK,GAAG;YACjB,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG;YAC1C,UAAU,KAAK,mBAAmB;YAClC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACtE,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,KAAgC;IACrD,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,oBAAoB,EAAE;aACjC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;aAClC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,KAAK,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,GAA0B;IAChD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IACnD,4FAA4F;IAC5F,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CACb,GAA0B,EAC1B,MAA0B;IAE1B,OAAO,2BAA2B,CAAC;QACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAA0B;IAE1B,OAAO,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAA0B;IAE1B,OAAO,MAAM,CACX,GAAG,EACH,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAA0B;IAE1B,OAAO,IAAI,aAAa,CACtB,4BAA4B,EAC5B,MAAM,2BAA2B,CAAC,GAAG,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAA0B;IAE1B,OAAO,IAAI,aAAa,CACtB,0BAA0B,EAC1B,MAAM,yBAAyB,CAAC,GAAG,CAAC,CACrC,CAAC;AACJ,CAAC","sourcesContent":["import { StorageClient, type StorageDriver } from '../core/index.js';\nimport {\n  createProviderStorageDriver,\n  isStorageProvider,\n  listStorageProviders,\n  type StorageProviderConfig,\n  type StorageProviderName,\n} from '../files-sdk/provider/index.js';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nexport const ARTIFACT_STORAGE_CLIENT_NAME = 'artifacts';\nexport const OBJECT_STORAGE_CLIENT_NAME = 'objects';\nexport const DEFAULT_OBJECT_NAMESPACES = ['_staging', 'org-logos'] as const;\n\n/**\n * Where the generic object store lives relative to the artifact store on a filesystem. Artifact\n * keys are `<artifactId>/<path>`, so an unprefixed object key like `org-logos/x.png` would read\n * back as an artifact directory named `org-logos` — listing, sweeping, and removal would all\n * cross the two. Filesystems therefore retain the historical `_objects` directory. Object-store\n * providers retain their historical unprefixed keys; the configured top-level namespace\n * allowlist keeps those keys disjoint from artifact ids without a rolling-deploy layout change.\n */\nexport const OBJECT_STORE_PREFIX = '_objects';\n\n/**\n * Which store backs artifacts, and how to reach it. `provider` is any slug `@nestm/storage`\n * can build — `fs`, `s3`, `gcs`, `azure`, `r2`, `minio`, `supabase`, and ~40 more — so a\n * deployment picks its store from the environment instead of the platform shipping a driver\n * per backend. Only the selected provider's SDK is ever imported.\n */\nexport interface ArtifactStorageConfig {\n  provider: StorageProviderName;\n  /** Key prefix so artifacts can share a bucket (or a directory tree) with other apps. */\n  prefix?: string;\n  /**\n   * Flat provider settings: `bucket`/`region`/`endpoint` for an object store, `root` for the\n   * filesystem, `accountName`/`container` for Azure. Each provider reads what it needs.\n   * Credentials may be omitted wherever the provider's SDK resolves its own chain — on AWS that\n   * is the ECS task role, so S3 needs no long-lived keys in env.\n   */\n  config?: StorageProviderConfig;\n  /**\n   * Allowed top-level ObjectStore namespaces. Artifact ids matching one of these values are\n   * rejected, keeping the two public facades disjoint on providers where they share a key root.\n   */\n  objectNamespaces?: readonly string[];\n}\n\n/** Default filesystem root, shared by the api and the sandbox so zero-config dev lines up. */\nexport function defaultFsRoot(): string {\n  return join(tmpdir(), 'concepta-artifacts-artifacts');\n}\n\nfunction trimSlashes(value: string): string {\n  return value.replace(/^\\/+|\\/+$/g, '');\n}\n\n/** Resolve and validate the case-insensitive top-level ObjectStore namespace allowlist. */\nexport function resolveObjectNamespaces(\n  namespaces: readonly string[] = DEFAULT_OBJECT_NAMESPACES,\n): ReadonlySet<string> {\n  const resolved = new Set<string>();\n  for (const namespace of namespaces) {\n    const normalized = namespace.toLowerCase();\n    if (\n      namespace === '' ||\n      namespace === '.' ||\n      namespace === '..' ||\n      namespace.includes('/') ||\n      namespace.includes('\\\\') ||\n      namespace.includes('\\0') ||\n      Buffer.byteLength(namespace, 'utf8') > 255 ||\n      normalized === OBJECT_STORE_PREFIX ||\n      resolved.has(normalized)\n    ) {\n      throw new Error(\n        `invalid or duplicate object namespace: ${JSON.stringify(namespace)}`,\n      );\n    }\n    resolved.add(normalized);\n  }\n  if (resolved.size === 0) {\n    throw new Error('at least one object namespace is required');\n  }\n  return resolved;\n}\n\nfunction joinPrefix(...parts: Array<string | undefined>): string | undefined {\n  const joined = parts\n    .flatMap((part) => (part === undefined ? [] : [trimSlashes(part)]))\n    .filter((part) => part.length > 0)\n    .join('/');\n  return joined.length === 0 ? undefined : joined;\n}\n\n/** Fail fast on an unknown slug with the full list, rather than at the first upload. */\nexport function assertStorageProvider(provider: string): StorageProviderName {\n  if (!isStorageProvider(provider)) {\n    const known = listStorageProviders()\n      .map((candidate) => candidate.slug)\n      .join(', ');\n    throw new Error(\n      `Unknown storage provider ${JSON.stringify(provider)}. Known providers: ${known}`,\n    );\n  }\n  return provider;\n}\n\nfunction providerConfig(cfg: ArtifactStorageConfig): StorageProviderConfig {\n  if (cfg.provider !== 'fs') return cfg.config ?? {};\n  // The filesystem adapter needs a root; every other provider names its store some other way.\n  return { root: defaultFsRoot(), ...cfg.config };\n}\n\nfunction driver(\n  cfg: ArtifactStorageConfig,\n  prefix: string | undefined,\n): Promise<StorageDriver> {\n  return createProviderStorageDriver({\n    provider: cfg.provider,\n    config: providerConfig(cfg),\n    ...(prefix === undefined ? {} : { prefix }),\n  });\n}\n\nexport function createArtifactStorageDriver(\n  cfg: ArtifactStorageConfig,\n): Promise<StorageDriver> {\n  return driver(cfg, joinPrefix(cfg.prefix));\n}\n\nexport function createObjectStorageDriver(\n  cfg: ArtifactStorageConfig,\n): Promise<StorageDriver> {\n  return driver(\n    cfg,\n    joinPrefix(cfg.prefix, cfg.provider === 'fs' ? OBJECT_STORE_PREFIX : ''),\n  );\n}\n\nexport async function createArtifactStorageClient(\n  cfg: ArtifactStorageConfig,\n): Promise<StorageClient> {\n  return new StorageClient(\n    ARTIFACT_STORAGE_CLIENT_NAME,\n    await createArtifactStorageDriver(cfg),\n  );\n}\n\nexport async function createObjectStorageClient(\n  cfg: ArtifactStorageConfig,\n): Promise<StorageClient> {\n  return new StorageClient(\n    OBJECT_STORAGE_CLIENT_NAME,\n    await createObjectStorageDriver(cfg),\n  );\n}\n"]}