@opengeni/storage 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+import { Settings } from '@opengeni/config';
+import { FileAsset } from '@opengeni/contracts';
+
+declare const MAX_SINGLE_PUT_SIZE_BYTES = 5000000000;
+declare const UPLOAD_URL_TTL_SECONDS: number;
+declare const DOWNLOAD_URL_TTL_SECONDS: number;
+type ObjectHead = {
+    ContentLength?: number;
+    ContentType?: string;
+    Metadata?: Record<string, string>;
+};
+type ObjectStorage = {
+    bucket: string;
+    backend: "s3-compatible" | "aws-s3" | "azure-blob" | "gcs";
+    maxSinglePutSizeBytes: number;
+    createPutUrl: (args: {
+        key: string;
+        contentType: string;
+        sha256?: string | null;
+        expiresInSeconds?: number;
+    }) => Promise<{
+        url: string;
+        requiredHeaders: Record<string, string>;
+        expiresAt: Date;
+    }>;
+    createGetUrl: (args: {
+        key: string;
+        expiresInSeconds?: number;
+    }) => Promise<{
+        url: string;
+        expiresAt: Date;
+    }>;
+    headFile: (file: FileAsset) => Promise<ObjectHead>;
+    getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+    /**
+     * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
+     * in-process upload from a trusted holder of the storage credentials (e.g. the
+     * worker writing a recording), this sends the bytes straight to the storage
+     * backend over the configured endpoint with the in-process SDK client — bypassing
+     * the presigned-URL round-trip, which on split public/internal topologies (a
+     * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.
+     * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.
+     */
+    putObject: (args: {
+        key: string;
+        contentType: string;
+        body: Uint8Array;
+        sha256?: string | null;
+    }) => Promise<void>;
+};
+declare function createObjectStorage(settings: Settings): ObjectStorage | null;
+declare function bytesToDataUrl(bytes: Uint8Array, contentType: string): string;
+
+export { DOWNLOAD_URL_TTL_SECONDS, MAX_SINGLE_PUT_SIZE_BYTES, type ObjectHead, type ObjectStorage, UPLOAD_URL_TTL_SECONDS, bytesToDataUrl, createObjectStorage };

package/dist/index.js

@@ -0,0 +1,330 @@
+// src/index.ts
+import {
+  BlobSASPermissions,
+  BlobServiceClient,
+  generateBlobSASQueryParameters,
+  StorageSharedKeyCredential
+} from "@azure/storage-blob";
+import {
+  GetObjectCommand,
+  HeadObjectCommand,
+  PutObjectCommand,
+  S3Client
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { Storage as GcsClient } from "@google-cloud/storage";
+var MAX_SINGLE_PUT_SIZE_BYTES = 5e9;
+var UPLOAD_URL_TTL_SECONDS = 15 * 60;
+var DOWNLOAD_URL_TTL_SECONDS = 5 * 60;
+function createObjectStorage(settings) {
+  if (settings.objectStorageBackend === "azure-blob") {
+    return createAzureBlobObjectStorage(settings);
+  }
+  if (settings.objectStorageBackend === "gcs") {
+    return createGcsObjectStorage(settings);
+  }
+  return createS3CompatibleObjectStorage(settings);
+}
+function createS3CompatibleObjectStorage(settings) {
+  if (settings.objectStorageBackend === "s3-compatible" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
+    return null;
+  }
+  const clientConfig = {
+    region: settings.objectStorageRegion,
+    forcePathStyle: settings.objectStorageForcePathStyle,
+    requestChecksumCalculation: "WHEN_REQUIRED",
+    ...settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {},
+    ...settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {
+      accessKeyId: settings.objectStorageAccessKeyId,
+      secretAccessKey: settings.objectStorageSecretAccessKey
+    } } : {}
+  };
+  const client = new S3Client(clientConfig);
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: settings.objectStorageBackend === "aws-s3" ? "aws-s3" : "s3-compatible",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const requiredHeaders = {
+        "content-type": args.contentType
+      };
+      const command = new PutObjectCommand({
+        Bucket: settings.objectStorageBucket,
+        Key: args.key,
+        ContentType: args.contentType,
+        Metadata: args.sha256 ? { sha256: args.sha256 } : void 0
+      });
+      return {
+        url: await getSignedUrl(client, command, { expiresIn }),
+        requiredHeaders,
+        expiresAt: new Date(Date.now() + expiresIn * 1e3)
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      return {
+        url: await getSignedUrl(client, new GetObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: args.key
+        }), { expiresIn }),
+        expiresAt: new Date(Date.now() + expiresIn * 1e3)
+      };
+    },
+    async putObject(args) {
+      await client.send(new PutObjectCommand({
+        Bucket: settings.objectStorageBucket,
+        Key: args.key,
+        ContentType: args.contentType,
+        Body: args.body,
+        Metadata: args.sha256 ? { sha256: args.sha256 } : void 0
+      }));
+    },
+    async headFile(file) {
+      const head = await client.send(new HeadObjectCommand({
+        Bucket: file.bucket,
+        Key: file.objectKey
+      }));
+      return objectHead({
+        contentLength: head.ContentLength,
+        contentType: head.ContentType,
+        metadata: head.Metadata
+      });
+    },
+    async getFileBytes(file) {
+      const result = await client.send(new GetObjectCommand({
+        Bucket: file.bucket,
+        Key: file.objectKey
+      }));
+      if (!result.Body) {
+        throw new Error(`Object body is empty: ${file.objectKey}`);
+      }
+      if (typeof result.Body.transformToByteArray === "function") {
+        return await result.Body.transformToByteArray();
+      }
+      const chunks = [];
+      for await (const chunk of result.Body) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      }
+      return Buffer.concat(chunks);
+    }
+  };
+}
+function createGcsObjectStorage(settings) {
+  const client = new GcsClient(gcsClientOptions(settings));
+  const bucket = client.bucket(settings.objectStorageBucket);
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: "gcs",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1e3);
+      const config = {
+        version: "v4",
+        action: "write",
+        expires: expiresAt,
+        contentType: args.contentType
+      };
+      if (args.sha256) {
+        config.extensionHeaders = { "x-goog-meta-sha256": args.sha256 };
+      }
+      const [url] = await bucket.file(args.key).getSignedUrl(config);
+      return {
+        url,
+        requiredHeaders: {
+          "content-type": args.contentType,
+          ...args.sha256 ? { "x-goog-meta-sha256": args.sha256 } : {}
+        },
+        expiresAt
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1e3);
+      const [url] = await bucket.file(args.key).getSignedUrl({
+        version: "v4",
+        action: "read",
+        expires: expiresAt
+      });
+      return { url, expiresAt };
+    },
+    async putObject(args) {
+      await bucket.file(args.key).save(Buffer.from(args.body), {
+        contentType: args.contentType,
+        ...args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}
+      });
+    },
+    async headFile(file) {
+      const [metadata] = await bucket.file(file.objectKey).getMetadata();
+      return objectHead({
+        contentLength: parseContentLength(metadata.size),
+        contentType: metadata.contentType,
+        metadata: stringMetadata(metadata.metadata)
+      });
+    },
+    async getFileBytes(file) {
+      const [bytes] = await bucket.file(file.objectKey).download();
+      return bytes;
+    }
+  };
+}
+function createAzureBlobObjectStorage(settings) {
+  const sharedKey = azureSharedKeyCredential(settings);
+  const serviceClient = settings.objectStorageAzureConnectionString ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString) : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);
+  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: "azure-blob",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1e3);
+      const blobClient = containerClient.getBlockBlobClient(args.key);
+      const sas = generateBlobSASQueryParameters({
+        containerName: settings.objectStorageBucket,
+        blobName: args.key,
+        permissions: BlobSASPermissions.parse("cw"),
+        expiresOn: expiresAt,
+        contentType: args.contentType
+      }, sharedKey).toString();
+      return {
+        url: `${blobClient.url}?${sas}`,
+        requiredHeaders: {
+          "content-type": args.contentType,
+          "x-ms-blob-type": "BlockBlob",
+          ...args.sha256 ? { "x-ms-meta-sha256": args.sha256 } : {}
+        },
+        expiresAt
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1e3);
+      const blobClient = containerClient.getBlobClient(args.key);
+      const sas = generateBlobSASQueryParameters({
+        containerName: settings.objectStorageBucket,
+        blobName: args.key,
+        permissions: BlobSASPermissions.parse("r"),
+        expiresOn: expiresAt
+      }, sharedKey).toString();
+      return {
+        url: `${blobClient.url}?${sas}`,
+        expiresAt
+      };
+    },
+    async putObject(args) {
+      const blobClient = containerClient.getBlockBlobClient(args.key);
+      const body = Buffer.from(args.body);
+      await blobClient.upload(body, body.byteLength, {
+        blobHTTPHeaders: { blobContentType: args.contentType },
+        ...args.sha256 ? { metadata: { sha256: args.sha256 } } : {}
+      });
+    },
+    async headFile(file) {
+      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());
+    },
+    async getFileBytes(file) {
+      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
+    }
+  };
+}
+function azureSharedKeyCredential(settings) {
+  if (settings.objectStorageAzureConnectionString) {
+    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);
+    if (parsed.AccountName && parsed.AccountKey) {
+      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);
+    }
+    throw new Error("Azure Blob connection string must include AccountName and AccountKey to create presigned URLs");
+  }
+  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {
+    throw new Error("Azure Blob storage requires account name and account key");
+  }
+  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);
+}
+function azureBlobServiceUrl(settings) {
+  if (settings.objectStorageAzureEndpoint) {
+    return settings.objectStorageAzureEndpoint.replace(/\/+$/, "");
+  }
+  if (!settings.objectStorageAzureAccountName) {
+    throw new Error("Azure Blob storage requires account name");
+  }
+  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;
+}
+function parseConnectionString(value) {
+  return Object.fromEntries(value.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const index = part.indexOf("=");
+    return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
+  }));
+}
+function gcsClientOptions(settings) {
+  const options = {
+    ...settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {},
+    ...settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {},
+    ...settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}
+  };
+  if (settings.objectStorageGcsCredentialsJson) {
+    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);
+  }
+  return options;
+}
+function parseGcsCredentials(raw) {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("GCS credentials JSON must be an object");
+  }
+  return parsed;
+}
+function parseContentLength(value) {
+  if (typeof value === "number") {
+    return value;
+  }
+  if (typeof value !== "string" || value.length === 0) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function stringMetadata(value) {
+  if (!value) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(value).filter((entry) => typeof entry[1] === "string")
+  );
+}
+function azureHeadToObjectHead(head) {
+  return objectHead({
+    contentLength: head.contentLength,
+    contentType: head.contentType,
+    metadata: head.metadata
+  });
+}
+async function azureDownloadToBytes(download) {
+  if (!download.readableStreamBody) {
+    throw new Error("Azure Blob download response did not include a readable body");
+  }
+  const chunks = [];
+  for await (const chunk of download.readableStreamBody) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+function objectHead(input) {
+  return {
+    ...input.contentLength !== void 0 ? { ContentLength: input.contentLength } : {},
+    ...input.contentType !== void 0 ? { ContentType: input.contentType } : {},
+    ...input.metadata !== void 0 ? { Metadata: input.metadata } : {}
+  };
+}
+function bytesToDataUrl(bytes, contentType) {
+  return `data:${contentType};base64,${Buffer.from(bytes).toString("base64")}`;
+}
+export {
+  DOWNLOAD_URL_TTL_SECONDS,
+  MAX_SINGLE_PUT_SIZE_BYTES,
+  UPLOAD_URL_TTL_SECONDS,
+  bytesToDataUrl,
+  createObjectStorage
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  BlobSASPermissions,\n  BlobServiceClient,\n  BlockBlobClient,\n  generateBlobSASQueryParameters,\n  StorageSharedKeyCredential,\n  type BlobDownloadResponseParsed,\n  type BlobGetPropertiesResponse,\n} from \"@azure/storage-blob\";\nimport {\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  type S3ClientConfig,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\nimport { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from \"@google-cloud/storage\";\n\nexport const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;\nexport const UPLOAD_URL_TTL_SECONDS = 15 * 60;\nexport const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;\n\nexport type ObjectHead = {\n  ContentLength?: number;\n  ContentType?: string;\n  Metadata?: Record<string, string>;\n};\n\nexport type ObjectStorage = {\n  bucket: string;\n  backend: \"s3-compatible\" | \"aws-s3\" | \"azure-blob\" | \"gcs\";\n  maxSinglePutSizeBytes: number;\n  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;\n  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;\n  headFile: (file: FileAsset) => Promise<ObjectHead>;\n  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;\n  /**\n   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an\n   * in-process upload from a trusted holder of the storage credentials (e.g. the\n   * worker writing a recording), this sends the bytes straight to the storage\n   * backend over the configured endpoint with the in-process SDK client — bypassing\n   * the presigned-URL round-trip, which on split public/internal topologies (a\n   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.\n   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.\n   */\n  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;\n};\n\nexport function createObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"azure-blob\") {\n    return createAzureBlobObjectStorage(settings);\n  }\n  if (settings.objectStorageBackend === \"gcs\") {\n    return createGcsObjectStorage(settings);\n  }\n  return createS3CompatibleObjectStorage(settings);\n}\n\nfunction createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"s3-compatible\" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {\n    return null;\n  }\n  const clientConfig: S3ClientConfig = {\n    region: settings.objectStorageRegion,\n    forcePathStyle: settings.objectStorageForcePathStyle,\n    requestChecksumCalculation: \"WHEN_REQUIRED\",\n    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),\n    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {\n      accessKeyId: settings.objectStorageAccessKeyId,\n      secretAccessKey: settings.objectStorageSecretAccessKey,\n    } } : {}),\n  };\n  const client = new S3Client(clientConfig);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: settings.objectStorageBackend === \"aws-s3\" ? \"aws-s3\" : \"s3-compatible\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const requiredHeaders: Record<string, string> = {\n        \"content-type\": args.contentType,\n      };\n      const command = new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      });\n      return {\n        url: await getSignedUrl(client, command, { expiresIn }),\n        requiredHeaders,\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      return {\n        url: await getSignedUrl(client, new GetObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: args.key,\n        }), { expiresIn }),\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT against the configured (in-cluster) endpoint.\n      // A presigned URL buys nothing here — the worker already holds the creds — and\n      // on a split public/internal endpoint topology the presigned URL points at the\n      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.\n      await client.send(new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Body: args.body,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      }));\n    },\n    async headFile(file) {\n      const head = await client.send(new HeadObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      return objectHead({\n        contentLength: head.ContentLength,\n        contentType: head.ContentType,\n        metadata: head.Metadata,\n      });\n    },\n    async getFileBytes(file) {\n      const result = await client.send(new GetObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      if (!result.Body) {\n        throw new Error(`Object body is empty: ${file.objectKey}`);\n      }\n      if (typeof result.Body.transformToByteArray === \"function\") {\n        return await result.Body.transformToByteArray();\n      }\n      const chunks: Uint8Array[] = [];\n      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {\n        chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n      }\n      return Buffer.concat(chunks);\n    },\n  };\n}\n\nfunction createGcsObjectStorage(settings: Settings): ObjectStorage {\n  const client = new GcsClient(gcsClientOptions(settings));\n  const bucket = client.bucket(settings.objectStorageBucket);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"gcs\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const config: GetSignedUrlConfig = {\n        version: \"v4\",\n        action: \"write\",\n        expires: expiresAt,\n        contentType: args.contentType,\n      };\n      if (args.sha256) {\n        config.extensionHeaders = { \"x-goog-meta-sha256\": args.sha256 };\n      }\n      const [url] = await bucket.file(args.key).getSignedUrl(config);\n      return {\n        url,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          ...(args.sha256 ? { \"x-goog-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const [url] = await bucket.file(args.key).getSignedUrl({\n        version: \"v4\",\n        action: \"read\",\n        expires: expiresAt,\n      });\n      return { url, expiresAt };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).\n      await bucket.file(args.key).save(Buffer.from(args.body), {\n        contentType: args.contentType,\n        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),\n      });\n    },\n    async headFile(file) {\n      const [metadata] = await bucket.file(file.objectKey).getMetadata();\n      return objectHead({\n        contentLength: parseContentLength(metadata.size),\n        contentType: metadata.contentType,\n        metadata: stringMetadata(metadata.metadata),\n      });\n    },\n    async getFileBytes(file) {\n      const [bytes] = await bucket.file(file.objectKey).download();\n      return bytes;\n    },\n  };\n}\n\nfunction createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {\n  const sharedKey = azureSharedKeyCredential(settings);\n  const serviceClient = settings.objectStorageAzureConnectionString\n    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)\n    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);\n  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);\n\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"azure-blob\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"cw\"),\n        expiresOn: expiresAt,\n        contentType: args.contentType,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          \"x-ms-blob-type\": \"BlockBlob\",\n          ...(args.sha256 ? { \"x-ms-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"r\"),\n        expiresOn: expiresAt,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        expiresAt,\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process upload via the shared-key Azure client (no SAS).\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const body = Buffer.from(args.body);\n      await blobClient.upload(body, body.byteLength, {\n        blobHTTPHeaders: { blobContentType: args.contentType },\n        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),\n      });\n    },\n    async headFile(file) {\n      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());\n    },\n    async getFileBytes(file) {\n      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());\n    },\n  };\n}\n\nfunction azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {\n  if (settings.objectStorageAzureConnectionString) {\n    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);\n    if (parsed.AccountName && parsed.AccountKey) {\n      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);\n    }\n    throw new Error(\"Azure Blob connection string must include AccountName and AccountKey to create presigned URLs\");\n  }\n  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {\n    throw new Error(\"Azure Blob storage requires account name and account key\");\n  }\n  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);\n}\n\nfunction azureBlobServiceUrl(settings: Settings): string {\n  if (settings.objectStorageAzureEndpoint) {\n    return settings.objectStorageAzureEndpoint.replace(/\\/+$/, \"\");\n  }\n  if (!settings.objectStorageAzureAccountName) {\n    throw new Error(\"Azure Blob storage requires account name\");\n  }\n  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;\n}\n\nfunction parseConnectionString(value: string): Record<string, string> {\n  return Object.fromEntries(value.split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const index = part.indexOf(\"=\");\n      return index === -1 ? [part, \"\"] : [part.slice(0, index), part.slice(index + 1)];\n    }));\n}\n\nfunction gcsClientOptions(settings: Settings): StorageOptions {\n  const options: StorageOptions = {\n    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),\n    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),\n    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),\n  };\n  if (settings.objectStorageGcsCredentialsJson) {\n    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);\n  }\n  return options;\n}\n\nfunction parseGcsCredentials(raw: string): Record<string, string> {\n  const parsed = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"GCS credentials JSON must be an object\");\n  }\n  return parsed as Record<string, string>;\n}\n\nfunction parseContentLength(value: string | number | undefined): number | undefined {\n  if (typeof value === \"number\") {\n    return value;\n  }\n  if (typeof value !== \"string\" || value.length === 0) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {\n  if (!value) {\n    return undefined;\n  }\n  return Object.fromEntries(\n    Object.entries(value)\n      .filter((entry): entry is [string, string] => typeof entry[1] === \"string\"),\n  );\n}\n\nfunction azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {\n  return objectHead({\n    contentLength: head.contentLength,\n    contentType: head.contentType,\n    metadata: head.metadata,\n  });\n}\n\nasync function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {\n  if (!download.readableStreamBody) {\n    throw new Error(\"Azure Blob download response did not include a readable body\");\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction objectHead(input: {\n  contentLength?: number | undefined;\n  contentType?: string | undefined;\n  metadata?: Record<string, string> | undefined;\n}): ObjectHead {\n  return {\n    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),\n    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),\n    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),\n  };\n}\n\nexport function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {\n  return `data:${contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`;\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,WAAW,iBAA+D;AAE5E,IAAM,4BAA4B;AAClC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B,IAAI;AA4BrC,SAAS,oBAAoB,UAA0C;AAC5E,MAAI,SAAS,yBAAyB,cAAc;AAClD,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,yBAAyB,OAAO;AAC3C,WAAO,uBAAuB,QAAQ;AAAA,EACxC;AACA,SAAO,gCAAgC,QAAQ;AACjD;AAEA,SAAS,gCAAgC,UAA0C;AACjF,MAAI,SAAS,yBAAyB,oBAAoB,CAAC,SAAS,yBAAyB,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BAA+B;AAC1K,WAAO;AAAA,EACT;AACA,QAAM,eAA+B;AAAA,IACnC,QAAQ,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,4BAA4B;AAAA,IAC5B,GAAI,SAAS,wBAAwB,EAAE,UAAU,SAAS,sBAAsB,IAAI,CAAC;AAAA,IACrF,GAAI,SAAS,4BAA4B,SAAS,+BAA+B,EAAE,aAAa;AAAA,MAC9F,aAAa,SAAS;AAAA,MACtB,iBAAiB,SAAS;AAAA,IAC5B,EAAE,IAAI,CAAC;AAAA,EACT;AACA,QAAM,SAAS,IAAI,SAAS,YAAY;AACxC,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS,yBAAyB,WAAW,WAAW;AAAA,IACjE,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,kBAA0C;AAAA,QAC9C,gBAAgB,KAAK;AAAA,MACvB;AACA,YAAM,UAAU,IAAI,iBAAiB;AAAA,QACnC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC;AACD,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,SAAS,EAAE,UAAU,CAAC;AAAA,QACtD;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,IAAI,iBAAiB;AAAA,UACnD,QAAQ,SAAS;AAAA,UACjB,KAAK,KAAK;AAAA,QACZ,CAAC,GAAG,EAAE,UAAU,CAAC;AAAA,QACjB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAKpB,YAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACrC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,MAAM,KAAK;AAAA,QACX,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC,CAAC;AAAA,IACJ;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,MAAM,OAAO,KAAK,IAAI,kBAAkB;AAAA,QACnD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO,WAAW;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACpD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,UAAI,CAAC,OAAO,MAAM;AAChB,cAAM,IAAI,MAAM,yBAAyB,KAAK,SAAS,EAAE;AAAA,MAC3D;AACA,UAAI,OAAO,OAAO,KAAK,yBAAyB,YAAY;AAC1D,eAAO,MAAM,OAAO,KAAK,qBAAqB;AAAA,MAChD;AACA,YAAM,SAAuB,CAAC;AAC9B,uBAAiB,SAAS,OAAO,MAAqD;AACpF,eAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,MACpE;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,UAAmC;AACjE,QAAM,SAAS,IAAI,UAAU,iBAAiB,QAAQ,CAAC;AACvD,QAAM,SAAS,OAAO,OAAO,SAAS,mBAAmB;AACzD,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,SAA6B;AAAA,QACjC,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,KAAK;AAAA,MACpB;AACA,UAAI,KAAK,QAAQ;AACf,eAAO,mBAAmB,EAAE,sBAAsB,KAAK,OAAO;AAAA,MAChE;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa,MAAM;AAC7D,aAAO;AAAA,QACL;AAAA,QACA,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,GAAI,KAAK,SAAS,EAAE,sBAAsB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa;AAAA,QACrD,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,OAAO,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,KAAK,KAAK,IAAI,GAAG;AAAA,QACvD,aAAa,KAAK;AAAA,QAClB,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,CAAC,QAAQ,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,YAAY;AACjE,aAAO,WAAW;AAAA,QAChB,eAAe,mBAAmB,SAAS,IAAI;AAAA,QAC/C,aAAa,SAAS;AAAA,QACtB,UAAU,eAAe,SAAS,QAAQ;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,SAAS;AAC3D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,UAA0C;AAC9E,QAAM,YAAY,yBAAyB,QAAQ;AACnD,QAAM,gBAAgB,SAAS,qCAC3B,kBAAkB,qBAAqB,SAAS,kCAAkC,IAClF,IAAI,kBAAkB,oBAAoB,QAAQ,GAAG,SAAS;AAClE,QAAM,kBAAkB,cAAc,mBAAmB,SAAS,mBAAmB;AAErF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,IAAI;AAAA,QAC1C,WAAW;AAAA,QACX,aAAa,KAAK;AAAA,MACpB,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,kBAAkB;AAAA,UAClB,GAAI,KAAK,SAAS,EAAE,oBAAoB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,cAAc,KAAK,GAAG;AACzD,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,GAAG;AAAA,QACzC,WAAW;AAAA,MACb,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAClC,YAAM,WAAW,OAAO,MAAM,KAAK,YAAY;AAAA,QAC7C,iBAAiB,EAAE,iBAAiB,KAAK,YAAY;AAAA,QACrD,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,aAAO,sBAAsB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,cAAc,CAAC;AAAA,IAClG;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,aAAO,MAAM,qBAAqB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,SAAS,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,oCAAoC;AAC/C,UAAM,SAAS,sBAAsB,SAAS,kCAAkC;AAChF,QAAI,OAAO,eAAe,OAAO,YAAY;AAC3C,aAAO,IAAI,2BAA2B,OAAO,aAAa,OAAO,UAAU;AAAA,IAC7E;AACA,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,MAAI,CAAC,SAAS,iCAAiC,CAAC,SAAS,8BAA8B;AACrF,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,IAAI,2BAA2B,SAAS,+BAA+B,SAAS,4BAA4B;AACrH;AAEA,SAAS,oBAAoB,UAA4B;AACvD,MAAI,SAAS,4BAA4B;AACvC,WAAO,SAAS,2BAA2B,QAAQ,QAAQ,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,+BAA+B;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,WAAW,SAAS,6BAA6B;AAC1D;AAEA,SAAS,sBAAsB,OAAuC;AACpE,SAAO,OAAO,YAAY,MAAM,MAAM,GAAG,EACtC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO,EACd,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,WAAO,UAAU,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EACjF,CAAC,CAAC;AACN;AAEA,SAAS,iBAAiB,UAAoC;AAC5D,QAAM,UAA0B;AAAA,IAC9B,GAAI,SAAS,4BAA4B,EAAE,WAAW,SAAS,0BAA0B,IAAI,CAAC;AAAA,IAC9F,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,IACpG,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,EACtG;AACA,MAAI,SAAS,iCAAiC;AAC5C,YAAQ,cAAc,oBAAoB,SAAS,+BAA+B;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAqC;AAChE,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwD;AAClF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,eAAe,OAAyG;AAC/H,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,sBAAsB,MAA6C;AAC1E,SAAO,WAAW;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,qBAAqB,UAA2D;AAC7F,MAAI,CAAC,SAAS,oBAAoB;AAChC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,SAAS,oBAAmE;AACpG,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,WAAW,OAIL;AACb,SAAO;AAAA,IACL,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IAClF,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AACF;AAEO,SAAS,eAAe,OAAmB,aAA6B;AAC7E,SAAO,QAAQ,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC5E;","names":[]}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@opengeni/storage",
+  "version": "0.2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.1044.0",
+    "@aws-sdk/s3-request-presigner": "^3.1044.0",
+    "@azure/storage-blob": "^12.29.1",
+    "@google-cloud/storage": "^7.19.0",
+    "@opengeni/config": "^0.2.0",
+    "@opengeni/contracts": "^0.3.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^6.0.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
+    "directory": "packages/storage"
+  }
+}

package/src/index.ts

@@ -0,0 +1,386 @@
+import type { Settings } from "@opengeni/config";
+import type { FileAsset } from "@opengeni/contracts";
+import {
+  BlobSASPermissions,
+  BlobServiceClient,
+  BlockBlobClient,
+  generateBlobSASQueryParameters,
+  StorageSharedKeyCredential,
+  type BlobDownloadResponseParsed,
+  type BlobGetPropertiesResponse,
+} from "@azure/storage-blob";
+import {
+  GetObjectCommand,
+  HeadObjectCommand,
+  PutObjectCommand,
+  S3Client,
+  type S3ClientConfig,
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from "@google-cloud/storage";
+
+export const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;
+export const UPLOAD_URL_TTL_SECONDS = 15 * 60;
+export const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;
+
+export type ObjectHead = {
+  ContentLength?: number;
+  ContentType?: string;
+  Metadata?: Record<string, string>;
+};
+
+export type ObjectStorage = {
+  bucket: string;
+  backend: "s3-compatible" | "aws-s3" | "azure-blob" | "gcs";
+  maxSinglePutSizeBytes: number;
+  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;
+  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;
+  headFile: (file: FileAsset) => Promise<ObjectHead>;
+  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+  /**
+   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
+   * in-process upload from a trusted holder of the storage credentials (e.g. the
+   * worker writing a recording), this sends the bytes straight to the storage
+   * backend over the configured endpoint with the in-process SDK client — bypassing
+   * the presigned-URL round-trip, which on split public/internal topologies (a
+   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.
+   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.
+   */
+  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;
+};
+
+export function createObjectStorage(settings: Settings): ObjectStorage | null {
+  if (settings.objectStorageBackend === "azure-blob") {
+    return createAzureBlobObjectStorage(settings);
+  }
+  if (settings.objectStorageBackend === "gcs") {
+    return createGcsObjectStorage(settings);
+  }
+  return createS3CompatibleObjectStorage(settings);
+}
+
+function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {
+  if (settings.objectStorageBackend === "s3-compatible" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
+    return null;
+  }
+  const clientConfig: S3ClientConfig = {
+    region: settings.objectStorageRegion,
+    forcePathStyle: settings.objectStorageForcePathStyle,
+    requestChecksumCalculation: "WHEN_REQUIRED",
+    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),
+    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {
+      accessKeyId: settings.objectStorageAccessKeyId,
+      secretAccessKey: settings.objectStorageSecretAccessKey,
+    } } : {}),
+  };
+  const client = new S3Client(clientConfig);
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: settings.objectStorageBackend === "aws-s3" ? "aws-s3" : "s3-compatible",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const requiredHeaders: Record<string, string> = {
+        "content-type": args.contentType,
+      };
+      const command = new PutObjectCommand({
+        Bucket: settings.objectStorageBucket,
+        Key: args.key,
+        ContentType: args.contentType,
+        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,
+      });
+      return {
+        url: await getSignedUrl(client, command, { expiresIn }),
+        requiredHeaders,
+        expiresAt: new Date(Date.now() + expiresIn * 1000),
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      return {
+        url: await getSignedUrl(client, new GetObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: args.key,
+        }), { expiresIn }),
+        expiresAt: new Date(Date.now() + expiresIn * 1000),
+      };
+    },
+    async putObject(args) {
+      // Authenticated in-process PUT against the configured (in-cluster) endpoint.
+      // A presigned URL buys nothing here — the worker already holds the creds — and
+      // on a split public/internal endpoint topology the presigned URL points at the
+      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.
+      await client.send(new PutObjectCommand({
+        Bucket: settings.objectStorageBucket,
+        Key: args.key,
+        ContentType: args.contentType,
+        Body: args.body,
+        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,
+      }));
+    },
+    async headFile(file) {
+      const head = await client.send(new HeadObjectCommand({
+        Bucket: file.bucket,
+        Key: file.objectKey,
+      }));
+      return objectHead({
+        contentLength: head.ContentLength,
+        contentType: head.ContentType,
+        metadata: head.Metadata,
+      });
+    },
+    async getFileBytes(file) {
+      const result = await client.send(new GetObjectCommand({
+        Bucket: file.bucket,
+        Key: file.objectKey,
+      }));
+      if (!result.Body) {
+        throw new Error(`Object body is empty: ${file.objectKey}`);
+      }
+      if (typeof result.Body.transformToByteArray === "function") {
+        return await result.Body.transformToByteArray();
+      }
+      const chunks: Uint8Array[] = [];
+      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      }
+      return Buffer.concat(chunks);
+    },
+  };
+}
+
+function createGcsObjectStorage(settings: Settings): ObjectStorage {
+  const client = new GcsClient(gcsClientOptions(settings));
+  const bucket = client.bucket(settings.objectStorageBucket);
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: "gcs",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1000);
+      const config: GetSignedUrlConfig = {
+        version: "v4",
+        action: "write",
+        expires: expiresAt,
+        contentType: args.contentType,
+      };
+      if (args.sha256) {
+        config.extensionHeaders = { "x-goog-meta-sha256": args.sha256 };
+      }
+      const [url] = await bucket.file(args.key).getSignedUrl(config);
+      return {
+        url,
+        requiredHeaders: {
+          "content-type": args.contentType,
+          ...(args.sha256 ? { "x-goog-meta-sha256": args.sha256 } : {}),
+        },
+        expiresAt,
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1000);
+      const [url] = await bucket.file(args.key).getSignedUrl({
+        version: "v4",
+        action: "read",
+        expires: expiresAt,
+      });
+      return { url, expiresAt };
+    },
+    async putObject(args) {
+      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).
+      await bucket.file(args.key).save(Buffer.from(args.body), {
+        contentType: args.contentType,
+        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),
+      });
+    },
+    async headFile(file) {
+      const [metadata] = await bucket.file(file.objectKey).getMetadata();
+      return objectHead({
+        contentLength: parseContentLength(metadata.size),
+        contentType: metadata.contentType,
+        metadata: stringMetadata(metadata.metadata),
+      });
+    },
+    async getFileBytes(file) {
+      const [bytes] = await bucket.file(file.objectKey).download();
+      return bytes;
+    },
+  };
+}
+
+function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {
+  const sharedKey = azureSharedKeyCredential(settings);
+  const serviceClient = settings.objectStorageAzureConnectionString
+    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)
+    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);
+  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);
+
+  return {
+    bucket: settings.objectStorageBucket,
+    backend: "azure-blob",
+    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,
+    async createPutUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1000);
+      const blobClient = containerClient.getBlockBlobClient(args.key);
+      const sas = generateBlobSASQueryParameters({
+        containerName: settings.objectStorageBucket,
+        blobName: args.key,
+        permissions: BlobSASPermissions.parse("cw"),
+        expiresOn: expiresAt,
+        contentType: args.contentType,
+      }, sharedKey).toString();
+      return {
+        url: `${blobClient.url}?${sas}`,
+        requiredHeaders: {
+          "content-type": args.contentType,
+          "x-ms-blob-type": "BlockBlob",
+          ...(args.sha256 ? { "x-ms-meta-sha256": args.sha256 } : {}),
+        },
+        expiresAt,
+      };
+    },
+    async createGetUrl(args) {
+      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
+      const expiresAt = new Date(Date.now() + expiresIn * 1000);
+      const blobClient = containerClient.getBlobClient(args.key);
+      const sas = generateBlobSASQueryParameters({
+        containerName: settings.objectStorageBucket,
+        blobName: args.key,
+        permissions: BlobSASPermissions.parse("r"),
+        expiresOn: expiresAt,
+      }, sharedKey).toString();
+      return {
+        url: `${blobClient.url}?${sas}`,
+        expiresAt,
+      };
+    },
+    async putObject(args) {
+      // Authenticated in-process upload via the shared-key Azure client (no SAS).
+      const blobClient = containerClient.getBlockBlobClient(args.key);
+      const body = Buffer.from(args.body);
+      await blobClient.upload(body, body.byteLength, {
+        blobHTTPHeaders: { blobContentType: args.contentType },
+        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),
+      });
+    },
+    async headFile(file) {
+      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());
+    },
+    async getFileBytes(file) {
+      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
+    },
+  };
+}
+
+function azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {
+  if (settings.objectStorageAzureConnectionString) {
+    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);
+    if (parsed.AccountName && parsed.AccountKey) {
+      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);
+    }
+    throw new Error("Azure Blob connection string must include AccountName and AccountKey to create presigned URLs");
+  }
+  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {
+    throw new Error("Azure Blob storage requires account name and account key");
+  }
+  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);
+}
+
+function azureBlobServiceUrl(settings: Settings): string {
+  if (settings.objectStorageAzureEndpoint) {
+    return settings.objectStorageAzureEndpoint.replace(/\/+$/, "");
+  }
+  if (!settings.objectStorageAzureAccountName) {
+    throw new Error("Azure Blob storage requires account name");
+  }
+  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;
+}
+
+function parseConnectionString(value: string): Record<string, string> {
+  return Object.fromEntries(value.split(";")
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => {
+      const index = part.indexOf("=");
+      return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
+    }));
+}
+
+function gcsClientOptions(settings: Settings): StorageOptions {
+  const options: StorageOptions = {
+    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),
+    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),
+    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),
+  };
+  if (settings.objectStorageGcsCredentialsJson) {
+    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);
+  }
+  return options;
+}
+
+function parseGcsCredentials(raw: string): Record<string, string> {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("GCS credentials JSON must be an object");
+  }
+  return parsed as Record<string, string>;
+}
+
+function parseContentLength(value: string | number | undefined): number | undefined {
+  if (typeof value === "number") {
+    return value;
+  }
+  if (typeof value !== "string" || value.length === 0) {
+    return undefined;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {
+  if (!value) {
+    return undefined;
+  }
+  return Object.fromEntries(
+    Object.entries(value)
+      .filter((entry): entry is [string, string] => typeof entry[1] === "string"),
+  );
+}
+
+function azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {
+  return objectHead({
+    contentLength: head.contentLength,
+    contentType: head.contentType,
+    metadata: head.metadata,
+  });
+}
+
+async function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {
+  if (!download.readableStreamBody) {
+    throw new Error("Azure Blob download response did not include a readable body");
+  }
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+function objectHead(input: {
+  contentLength?: number | undefined;
+  contentType?: string | undefined;
+  metadata?: Record<string, string> | undefined;
+}): ObjectHead {
+  return {
+    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),
+    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),
+    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),
+  };
+}
+
+export function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {
+  return `data:${contentType};base64,${Buffer.from(bytes).toString("base64")}`;
+}