@opengeni/storage 0.2.7 → 0.2.8

package/dist/index.d.ts

@@ -32,6 +32,11 @@ type ObjectStorage = {
     }>;
     headFile: (file: FileAsset) => Promise<ObjectHead>;
     getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+    /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */
+    getObjectBytes: (key: string) => Promise<{
+        bytes: Uint8Array;
+        contentType?: string;
+    } | null>;
     /**
      * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
      * in-process upload from a trusted holder of the storage credentials (e.g. the

package/dist/index.js

@@ -96,20 +96,50 @@ function createS3CompatibleObjectStorage(settings) {
         Bucket: file.bucket,
         Key: file.objectKey
       }));
-      if (!result.Body) {
-        throw new Error(`Object body is empty: ${file.objectKey}`);
-      }
-      if (typeof result.Body.transformToByteArray === "function") {
-        return await result.Body.transformToByteArray();
-      }
-      const chunks = [];
-      for await (const chunk of result.Body) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      return await s3BodyToBytes(result.Body, file.objectKey);
+    },
+    async getObjectBytes(key) {
+      try {
+        const result = await client.send(new GetObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: key
+        }));
+        const bytes = await s3BodyToBytes(result.Body, key);
+        return { bytes, ...result.ContentType ? { contentType: result.ContentType } : {} };
+      } catch (error) {
+        if (isS3NotFound(error)) {
+          return null;
+        }
+        throw error;
       }
-      return Buffer.concat(chunks);
     }
   };
 }
+async function s3BodyToBytes(body, objectKey) {
+  if (!body) {
+    throw new Error(`Object body is empty: ${objectKey}`);
+  }
+  const withTransform = body;
+  if (typeof withTransform.transformToByteArray === "function") {
+    return await withTransform.transformToByteArray();
+  }
+  const chunks = [];
+  for await (const chunk of body) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+function isS3NotFound(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const name = "name" in error ? error.name : void 0;
+  if (name === "NoSuchKey" || name === "NotFound") {
+    return true;
+  }
+  const metadata = "$metadata" in error ? error.$metadata : void 0;
+  return metadata?.httpStatusCode === 404;
+}
 function createGcsObjectStorage(settings) {
   const client = new GcsClient(gcsClientOptions(settings));
   const bucket = client.bucket(settings.objectStorageBucket);
@@ -166,9 +196,23 @@ function createGcsObjectStorage(settings) {
     async getFileBytes(file) {
       const [bytes] = await bucket.file(file.objectKey).download();
       return bytes;
+    },
+    async getObjectBytes(key) {
+      try {
+        const [bytes] = await bucket.file(key).download();
+        return { bytes };
+      } catch (error) {
+        if (isGcsNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
     }
   };
 }
+function isGcsNotFound(error) {
+  return Boolean(error) && typeof error === "object" && error.code === 404;
+}
 function createAzureBlobObjectStorage(settings) {
   const sharedKey = azureSharedKeyCredential(settings);
   const serviceClient = settings.objectStorageAzureConnectionString ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString) : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);
@@ -226,9 +270,24 @@ function createAzureBlobObjectStorage(settings) {
     },
     async getFileBytes(file) {
       return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
+    },
+    async getObjectBytes(key) {
+      try {
+        const download = await containerClient.getBlobClient(key).download();
+        const bytes = await azureDownloadToBytes(download);
+        return { bytes, ...download.contentType ? { contentType: download.contentType } : {} };
+      } catch (error) {
+        if (isAzureNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
     }
   };
 }
+function isAzureNotFound(error) {
+  return Boolean(error) && typeof error === "object" && error.statusCode === 404;
+}
 function azureSharedKeyCredential(settings) {
   if (settings.objectStorageAzureConnectionString) {
     const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  BlobSASPermissions,\n  BlobServiceClient,\n  BlockBlobClient,\n  generateBlobSASQueryParameters,\n  StorageSharedKeyCredential,\n  type BlobDownloadResponseParsed,\n  type BlobGetPropertiesResponse,\n} from \"@azure/storage-blob\";\nimport {\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  type S3ClientConfig,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\nimport { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from \"@google-cloud/storage\";\n\nexport const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;\nexport const UPLOAD_URL_TTL_SECONDS = 15 * 60;\nexport const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;\n\nexport type ObjectHead = {\n  ContentLength?: number;\n  ContentType?: string;\n  Metadata?: Record<string, string>;\n};\n\nexport type ObjectStorage = {\n  bucket: string;\n  backend: \"s3-compatible\" | \"aws-s3\" | \"azure-blob\" | \"gcs\";\n  maxSinglePutSizeBytes: number;\n  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;\n  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;\n  headFile: (file: FileAsset) => Promise<ObjectHead>;\n  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;\n  /**\n   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an\n   * in-process upload from a trusted holder of the storage credentials (e.g. the\n   * worker writing a recording), this sends the bytes straight to the storage\n   * backend over the configured endpoint with the in-process SDK client — bypassing\n   * the presigned-URL round-trip, which on split public/internal topologies (a\n   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.\n   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.\n   */\n  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;\n};\n\nexport function createObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"azure-blob\") {\n    return createAzureBlobObjectStorage(settings);\n  }\n  if (settings.objectStorageBackend === \"gcs\") {\n    return createGcsObjectStorage(settings);\n  }\n  return createS3CompatibleObjectStorage(settings);\n}\n\nfunction createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"s3-compatible\" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {\n    return null;\n  }\n  const clientConfig: S3ClientConfig = {\n    region: settings.objectStorageRegion,\n    forcePathStyle: settings.objectStorageForcePathStyle,\n    requestChecksumCalculation: \"WHEN_REQUIRED\",\n    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),\n    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {\n      accessKeyId: settings.objectStorageAccessKeyId,\n      secretAccessKey: settings.objectStorageSecretAccessKey,\n    } } : {}),\n  };\n  const client = new S3Client(clientConfig);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: settings.objectStorageBackend === \"aws-s3\" ? \"aws-s3\" : \"s3-compatible\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const requiredHeaders: Record<string, string> = {\n        \"content-type\": args.contentType,\n      };\n      const command = new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      });\n      return {\n        url: await getSignedUrl(client, command, { expiresIn }),\n        requiredHeaders,\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      return {\n        url: await getSignedUrl(client, new GetObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: args.key,\n        }), { expiresIn }),\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT against the configured (in-cluster) endpoint.\n      // A presigned URL buys nothing here — the worker already holds the creds — and\n      // on a split public/internal endpoint topology the presigned URL points at the\n      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.\n      await client.send(new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Body: args.body,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      }));\n    },\n    async headFile(file) {\n      const head = await client.send(new HeadObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      return objectHead({\n        contentLength: head.ContentLength,\n        contentType: head.ContentType,\n        metadata: head.Metadata,\n      });\n    },\n    async getFileBytes(file) {\n      const result = await client.send(new GetObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      if (!result.Body) {\n        throw new Error(`Object body is empty: ${file.objectKey}`);\n      }\n      if (typeof result.Body.transformToByteArray === \"function\") {\n        return await result.Body.transformToByteArray();\n      }\n      const chunks: Uint8Array[] = [];\n      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {\n        chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n      }\n      return Buffer.concat(chunks);\n    },\n  };\n}\n\nfunction createGcsObjectStorage(settings: Settings): ObjectStorage {\n  const client = new GcsClient(gcsClientOptions(settings));\n  const bucket = client.bucket(settings.objectStorageBucket);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"gcs\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const config: GetSignedUrlConfig = {\n        version: \"v4\",\n        action: \"write\",\n        expires: expiresAt,\n        contentType: args.contentType,\n      };\n      if (args.sha256) {\n        config.extensionHeaders = { \"x-goog-meta-sha256\": args.sha256 };\n      }\n      const [url] = await bucket.file(args.key).getSignedUrl(config);\n      return {\n        url,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          ...(args.sha256 ? { \"x-goog-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const [url] = await bucket.file(args.key).getSignedUrl({\n        version: \"v4\",\n        action: \"read\",\n        expires: expiresAt,\n      });\n      return { url, expiresAt };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).\n      await bucket.file(args.key).save(Buffer.from(args.body), {\n        contentType: args.contentType,\n        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),\n      });\n    },\n    async headFile(file) {\n      const [metadata] = await bucket.file(file.objectKey).getMetadata();\n      return objectHead({\n        contentLength: parseContentLength(metadata.size),\n        contentType: metadata.contentType,\n        metadata: stringMetadata(metadata.metadata),\n      });\n    },\n    async getFileBytes(file) {\n      const [bytes] = await bucket.file(file.objectKey).download();\n      return bytes;\n    },\n  };\n}\n\nfunction createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {\n  const sharedKey = azureSharedKeyCredential(settings);\n  const serviceClient = settings.objectStorageAzureConnectionString\n    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)\n    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);\n  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);\n\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"azure-blob\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"cw\"),\n        expiresOn: expiresAt,\n        contentType: args.contentType,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          \"x-ms-blob-type\": \"BlockBlob\",\n          ...(args.sha256 ? { \"x-ms-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"r\"),\n        expiresOn: expiresAt,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        expiresAt,\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process upload via the shared-key Azure client (no SAS).\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const body = Buffer.from(args.body);\n      await blobClient.upload(body, body.byteLength, {\n        blobHTTPHeaders: { blobContentType: args.contentType },\n        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),\n      });\n    },\n    async headFile(file) {\n      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());\n    },\n    async getFileBytes(file) {\n      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());\n    },\n  };\n}\n\nfunction azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {\n  if (settings.objectStorageAzureConnectionString) {\n    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);\n    if (parsed.AccountName && parsed.AccountKey) {\n      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);\n    }\n    throw new Error(\"Azure Blob connection string must include AccountName and AccountKey to create presigned URLs\");\n  }\n  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {\n    throw new Error(\"Azure Blob storage requires account name and account key\");\n  }\n  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);\n}\n\nfunction azureBlobServiceUrl(settings: Settings): string {\n  if (settings.objectStorageAzureEndpoint) {\n    return settings.objectStorageAzureEndpoint.replace(/\\/+$/, \"\");\n  }\n  if (!settings.objectStorageAzureAccountName) {\n    throw new Error(\"Azure Blob storage requires account name\");\n  }\n  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;\n}\n\nfunction parseConnectionString(value: string): Record<string, string> {\n  return Object.fromEntries(value.split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const index = part.indexOf(\"=\");\n      return index === -1 ? [part, \"\"] : [part.slice(0, index), part.slice(index + 1)];\n    }));\n}\n\nfunction gcsClientOptions(settings: Settings): StorageOptions {\n  const options: StorageOptions = {\n    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),\n    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),\n    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),\n  };\n  if (settings.objectStorageGcsCredentialsJson) {\n    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);\n  }\n  return options;\n}\n\nfunction parseGcsCredentials(raw: string): Record<string, string> {\n  const parsed = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"GCS credentials JSON must be an object\");\n  }\n  return parsed as Record<string, string>;\n}\n\nfunction parseContentLength(value: string | number | undefined): number | undefined {\n  if (typeof value === \"number\") {\n    return value;\n  }\n  if (typeof value !== \"string\" || value.length === 0) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {\n  if (!value) {\n    return undefined;\n  }\n  return Object.fromEntries(\n    Object.entries(value)\n      .filter((entry): entry is [string, string] => typeof entry[1] === \"string\"),\n  );\n}\n\nfunction azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {\n  return objectHead({\n    contentLength: head.contentLength,\n    contentType: head.contentType,\n    metadata: head.metadata,\n  });\n}\n\nasync function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {\n  if (!download.readableStreamBody) {\n    throw new Error(\"Azure Blob download response did not include a readable body\");\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction objectHead(input: {\n  contentLength?: number | undefined;\n  contentType?: string | undefined;\n  metadata?: Record<string, string> | undefined;\n}): ObjectHead {\n  return {\n    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),\n    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),\n    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),\n  };\n}\n\nexport function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {\n  return `data:${contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`;\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,WAAW,iBAA+D;AAE5E,IAAM,4BAA4B;AAClC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B,IAAI;AA4BrC,SAAS,oBAAoB,UAA0C;AAC5E,MAAI,SAAS,yBAAyB,cAAc;AAClD,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,yBAAyB,OAAO;AAC3C,WAAO,uBAAuB,QAAQ;AAAA,EACxC;AACA,SAAO,gCAAgC,QAAQ;AACjD;AAEA,SAAS,gCAAgC,UAA0C;AACjF,MAAI,SAAS,yBAAyB,oBAAoB,CAAC,SAAS,yBAAyB,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BAA+B;AAC1K,WAAO;AAAA,EACT;AACA,QAAM,eAA+B;AAAA,IACnC,QAAQ,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,4BAA4B;AAAA,IAC5B,GAAI,SAAS,wBAAwB,EAAE,UAAU,SAAS,sBAAsB,IAAI,CAAC;AAAA,IACrF,GAAI,SAAS,4BAA4B,SAAS,+BAA+B,EAAE,aAAa;AAAA,MAC9F,aAAa,SAAS;AAAA,MACtB,iBAAiB,SAAS;AAAA,IAC5B,EAAE,IAAI,CAAC;AAAA,EACT;AACA,QAAM,SAAS,IAAI,SAAS,YAAY;AACxC,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS,yBAAyB,WAAW,WAAW;AAAA,IACjE,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,kBAA0C;AAAA,QAC9C,gBAAgB,KAAK;AAAA,MACvB;AACA,YAAM,UAAU,IAAI,iBAAiB;AAAA,QACnC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC;AACD,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,SAAS,EAAE,UAAU,CAAC;AAAA,QACtD;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,IAAI,iBAAiB;AAAA,UACnD,QAAQ,SAAS;AAAA,UACjB,KAAK,KAAK;AAAA,QACZ,CAAC,GAAG,EAAE,UAAU,CAAC;AAAA,QACjB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAKpB,YAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACrC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,MAAM,KAAK;AAAA,QACX,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC,CAAC;AAAA,IACJ;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,MAAM,OAAO,KAAK,IAAI,kBAAkB;AAAA,QACnD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO,WAAW;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACpD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,UAAI,CAAC,OAAO,MAAM;AAChB,cAAM,IAAI,MAAM,yBAAyB,KAAK,SAAS,EAAE;AAAA,MAC3D;AACA,UAAI,OAAO,OAAO,KAAK,yBAAyB,YAAY;AAC1D,eAAO,MAAM,OAAO,KAAK,qBAAqB;AAAA,MAChD;AACA,YAAM,SAAuB,CAAC;AAC9B,uBAAiB,SAAS,OAAO,MAAqD;AACpF,eAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,MACpE;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,UAAmC;AACjE,QAAM,SAAS,IAAI,UAAU,iBAAiB,QAAQ,CAAC;AACvD,QAAM,SAAS,OAAO,OAAO,SAAS,mBAAmB;AACzD,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,SAA6B;AAAA,QACjC,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,KAAK;AAAA,MACpB;AACA,UAAI,KAAK,QAAQ;AACf,eAAO,mBAAmB,EAAE,sBAAsB,KAAK,OAAO;AAAA,MAChE;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa,MAAM;AAC7D,aAAO;AAAA,QACL;AAAA,QACA,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,GAAI,KAAK,SAAS,EAAE,sBAAsB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa;AAAA,QACrD,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,OAAO,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,KAAK,KAAK,IAAI,GAAG;AAAA,QACvD,aAAa,KAAK;AAAA,QAClB,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,CAAC,QAAQ,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,YAAY;AACjE,aAAO,WAAW;AAAA,QAChB,eAAe,mBAAmB,SAAS,IAAI;AAAA,QAC/C,aAAa,SAAS;AAAA,QACtB,UAAU,eAAe,SAAS,QAAQ;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,SAAS;AAC3D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,UAA0C;AAC9E,QAAM,YAAY,yBAAyB,QAAQ;AACnD,QAAM,gBAAgB,SAAS,qCAC3B,kBAAkB,qBAAqB,SAAS,kCAAkC,IAClF,IAAI,kBAAkB,oBAAoB,QAAQ,GAAG,SAAS;AAClE,QAAM,kBAAkB,cAAc,mBAAmB,SAAS,mBAAmB;AAErF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,IAAI;AAAA,QAC1C,WAAW;AAAA,QACX,aAAa,KAAK;AAAA,MACpB,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,kBAAkB;AAAA,UAClB,GAAI,KAAK,SAAS,EAAE,oBAAoB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,cAAc,KAAK,GAAG;AACzD,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,GAAG;AAAA,QACzC,WAAW;AAAA,MACb,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAClC,YAAM,WAAW,OAAO,MAAM,KAAK,YAAY;AAAA,QAC7C,iBAAiB,EAAE,iBAAiB,KAAK,YAAY;AAAA,QACrD,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,aAAO,sBAAsB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,cAAc,CAAC;AAAA,IAClG;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,aAAO,MAAM,qBAAqB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,SAAS,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,oCAAoC;AAC/C,UAAM,SAAS,sBAAsB,SAAS,kCAAkC;AAChF,QAAI,OAAO,eAAe,OAAO,YAAY;AAC3C,aAAO,IAAI,2BAA2B,OAAO,aAAa,OAAO,UAAU;AAAA,IAC7E;AACA,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,MAAI,CAAC,SAAS,iCAAiC,CAAC,SAAS,8BAA8B;AACrF,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,IAAI,2BAA2B,SAAS,+BAA+B,SAAS,4BAA4B;AACrH;AAEA,SAAS,oBAAoB,UAA4B;AACvD,MAAI,SAAS,4BAA4B;AACvC,WAAO,SAAS,2BAA2B,QAAQ,QAAQ,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,+BAA+B;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,WAAW,SAAS,6BAA6B;AAC1D;AAEA,SAAS,sBAAsB,OAAuC;AACpE,SAAO,OAAO,YAAY,MAAM,MAAM,GAAG,EACtC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO,EACd,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,WAAO,UAAU,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EACjF,CAAC,CAAC;AACN;AAEA,SAAS,iBAAiB,UAAoC;AAC5D,QAAM,UAA0B;AAAA,IAC9B,GAAI,SAAS,4BAA4B,EAAE,WAAW,SAAS,0BAA0B,IAAI,CAAC;AAAA,IAC9F,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,IACpG,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,EACtG;AACA,MAAI,SAAS,iCAAiC;AAC5C,YAAQ,cAAc,oBAAoB,SAAS,+BAA+B;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAqC;AAChE,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwD;AAClF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,eAAe,OAAyG;AAC/H,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,sBAAsB,MAA6C;AAC1E,SAAO,WAAW;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,qBAAqB,UAA2D;AAC7F,MAAI,CAAC,SAAS,oBAAoB;AAChC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,SAAS,oBAAmE;AACpG,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,WAAW,OAIL;AACb,SAAO;AAAA,IACL,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IAClF,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AACF;AAEO,SAAS,eAAe,OAAmB,aAA6B;AAC7E,SAAO,QAAQ,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC5E;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  BlobSASPermissions,\n  BlobServiceClient,\n  BlockBlobClient,\n  generateBlobSASQueryParameters,\n  StorageSharedKeyCredential,\n  type BlobDownloadResponseParsed,\n  type BlobGetPropertiesResponse,\n} from \"@azure/storage-blob\";\nimport {\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  type S3ClientConfig,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\nimport { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from \"@google-cloud/storage\";\n\nexport const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;\nexport const UPLOAD_URL_TTL_SECONDS = 15 * 60;\nexport const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;\n\nexport type ObjectHead = {\n  ContentLength?: number;\n  ContentType?: string;\n  Metadata?: Record<string, string>;\n};\n\nexport type ObjectStorage = {\n  bucket: string;\n  backend: \"s3-compatible\" | \"aws-s3\" | \"azure-blob\" | \"gcs\";\n  maxSinglePutSizeBytes: number;\n  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;\n  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;\n  headFile: (file: FileAsset) => Promise<ObjectHead>;\n  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;\n  /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */\n  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array; contentType?: string } | null>;\n  /**\n   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an\n   * in-process upload from a trusted holder of the storage credentials (e.g. the\n   * worker writing a recording), this sends the bytes straight to the storage\n   * backend over the configured endpoint with the in-process SDK client — bypassing\n   * the presigned-URL round-trip, which on split public/internal topologies (a\n   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.\n   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.\n   */\n  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;\n};\n\nexport function createObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"azure-blob\") {\n    return createAzureBlobObjectStorage(settings);\n  }\n  if (settings.objectStorageBackend === \"gcs\") {\n    return createGcsObjectStorage(settings);\n  }\n  return createS3CompatibleObjectStorage(settings);\n}\n\nfunction createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"s3-compatible\" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {\n    return null;\n  }\n  const clientConfig: S3ClientConfig = {\n    region: settings.objectStorageRegion,\n    forcePathStyle: settings.objectStorageForcePathStyle,\n    requestChecksumCalculation: \"WHEN_REQUIRED\",\n    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),\n    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {\n      accessKeyId: settings.objectStorageAccessKeyId,\n      secretAccessKey: settings.objectStorageSecretAccessKey,\n    } } : {}),\n  };\n  const client = new S3Client(clientConfig);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: settings.objectStorageBackend === \"aws-s3\" ? \"aws-s3\" : \"s3-compatible\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const requiredHeaders: Record<string, string> = {\n        \"content-type\": args.contentType,\n      };\n      const command = new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      });\n      return {\n        url: await getSignedUrl(client, command, { expiresIn }),\n        requiredHeaders,\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      return {\n        url: await getSignedUrl(client, new GetObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: args.key,\n        }), { expiresIn }),\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT against the configured (in-cluster) endpoint.\n      // A presigned URL buys nothing here — the worker already holds the creds — and\n      // on a split public/internal endpoint topology the presigned URL points at the\n      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.\n      await client.send(new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Body: args.body,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      }));\n    },\n    async headFile(file) {\n      const head = await client.send(new HeadObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      return objectHead({\n        contentLength: head.ContentLength,\n        contentType: head.ContentType,\n        metadata: head.Metadata,\n      });\n    },\n    async getFileBytes(file) {\n      const result = await client.send(new GetObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      return await s3BodyToBytes(result.Body, file.objectKey);\n    },\n    async getObjectBytes(key) {\n      try {\n        const result = await client.send(new GetObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: key,\n        }));\n        const bytes = await s3BodyToBytes(result.Body, key);\n        return { bytes, ...(result.ContentType ? { contentType: result.ContentType } : {}) };\n      } catch (error) {\n        if (isS3NotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nasync function s3BodyToBytes(body: unknown, objectKey: string): Promise<Uint8Array> {\n  if (!body) {\n    throw new Error(`Object body is empty: ${objectKey}`);\n  }\n  const withTransform = body as { transformToByteArray?: () => Promise<Uint8Array> };\n  if (typeof withTransform.transformToByteArray === \"function\") {\n    return await withTransform.transformToByteArray();\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of body as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction isS3NotFound(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") {\n    return false;\n  }\n  const name = \"name\" in error ? (error as { name?: unknown }).name : undefined;\n  if (name === \"NoSuchKey\" || name === \"NotFound\") {\n    return true;\n  }\n  const metadata = \"$metadata\" in error ? (error as { $metadata?: { httpStatusCode?: number } }).$metadata : undefined;\n  return metadata?.httpStatusCode === 404;\n}\n\nfunction createGcsObjectStorage(settings: Settings): ObjectStorage {\n  const client = new GcsClient(gcsClientOptions(settings));\n  const bucket = client.bucket(settings.objectStorageBucket);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"gcs\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const config: GetSignedUrlConfig = {\n        version: \"v4\",\n        action: \"write\",\n        expires: expiresAt,\n        contentType: args.contentType,\n      };\n      if (args.sha256) {\n        config.extensionHeaders = { \"x-goog-meta-sha256\": args.sha256 };\n      }\n      const [url] = await bucket.file(args.key).getSignedUrl(config);\n      return {\n        url,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          ...(args.sha256 ? { \"x-goog-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const [url] = await bucket.file(args.key).getSignedUrl({\n        version: \"v4\",\n        action: \"read\",\n        expires: expiresAt,\n      });\n      return { url, expiresAt };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).\n      await bucket.file(args.key).save(Buffer.from(args.body), {\n        contentType: args.contentType,\n        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),\n      });\n    },\n    async headFile(file) {\n      const [metadata] = await bucket.file(file.objectKey).getMetadata();\n      return objectHead({\n        contentLength: parseContentLength(metadata.size),\n        contentType: metadata.contentType,\n        metadata: stringMetadata(metadata.metadata),\n      });\n    },\n    async getFileBytes(file) {\n      const [bytes] = await bucket.file(file.objectKey).download();\n      return bytes;\n    },\n    async getObjectBytes(key) {\n      try {\n        const [bytes] = await bucket.file(key).download();\n        return { bytes };\n      } catch (error) {\n        if (isGcsNotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nfunction isGcsNotFound(error: unknown): boolean {\n  return Boolean(error) && typeof error === \"object\" && (error as { code?: unknown }).code === 404;\n}\n\nfunction createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {\n  const sharedKey = azureSharedKeyCredential(settings);\n  const serviceClient = settings.objectStorageAzureConnectionString\n    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)\n    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);\n  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);\n\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"azure-blob\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"cw\"),\n        expiresOn: expiresAt,\n        contentType: args.contentType,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          \"x-ms-blob-type\": \"BlockBlob\",\n          ...(args.sha256 ? { \"x-ms-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"r\"),\n        expiresOn: expiresAt,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        expiresAt,\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process upload via the shared-key Azure client (no SAS).\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const body = Buffer.from(args.body);\n      await blobClient.upload(body, body.byteLength, {\n        blobHTTPHeaders: { blobContentType: args.contentType },\n        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),\n      });\n    },\n    async headFile(file) {\n      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());\n    },\n    async getFileBytes(file) {\n      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());\n    },\n    async getObjectBytes(key) {\n      try {\n        const download = await containerClient.getBlobClient(key).download();\n        const bytes = await azureDownloadToBytes(download);\n        return { bytes, ...(download.contentType ? { contentType: download.contentType } : {}) };\n      } catch (error) {\n        if (isAzureNotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nfunction isAzureNotFound(error: unknown): boolean {\n  return Boolean(error) && typeof error === \"object\" && (error as { statusCode?: unknown }).statusCode === 404;\n}\n\nfunction azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {\n  if (settings.objectStorageAzureConnectionString) {\n    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);\n    if (parsed.AccountName && parsed.AccountKey) {\n      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);\n    }\n    throw new Error(\"Azure Blob connection string must include AccountName and AccountKey to create presigned URLs\");\n  }\n  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {\n    throw new Error(\"Azure Blob storage requires account name and account key\");\n  }\n  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);\n}\n\nfunction azureBlobServiceUrl(settings: Settings): string {\n  if (settings.objectStorageAzureEndpoint) {\n    return settings.objectStorageAzureEndpoint.replace(/\\/+$/, \"\");\n  }\n  if (!settings.objectStorageAzureAccountName) {\n    throw new Error(\"Azure Blob storage requires account name\");\n  }\n  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;\n}\n\nfunction parseConnectionString(value: string): Record<string, string> {\n  return Object.fromEntries(value.split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const index = part.indexOf(\"=\");\n      return index === -1 ? [part, \"\"] : [part.slice(0, index), part.slice(index + 1)];\n    }));\n}\n\nfunction gcsClientOptions(settings: Settings): StorageOptions {\n  const options: StorageOptions = {\n    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),\n    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),\n    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),\n  };\n  if (settings.objectStorageGcsCredentialsJson) {\n    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);\n  }\n  return options;\n}\n\nfunction parseGcsCredentials(raw: string): Record<string, string> {\n  const parsed = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"GCS credentials JSON must be an object\");\n  }\n  return parsed as Record<string, string>;\n}\n\nfunction parseContentLength(value: string | number | undefined): number | undefined {\n  if (typeof value === \"number\") {\n    return value;\n  }\n  if (typeof value !== \"string\" || value.length === 0) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {\n  if (!value) {\n    return undefined;\n  }\n  return Object.fromEntries(\n    Object.entries(value)\n      .filter((entry): entry is [string, string] => typeof entry[1] === \"string\"),\n  );\n}\n\nfunction azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {\n  return objectHead({\n    contentLength: head.contentLength,\n    contentType: head.contentType,\n    metadata: head.metadata,\n  });\n}\n\nasync function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {\n  if (!download.readableStreamBody) {\n    throw new Error(\"Azure Blob download response did not include a readable body\");\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction objectHead(input: {\n  contentLength?: number | undefined;\n  contentType?: string | undefined;\n  metadata?: Record<string, string> | undefined;\n}): ObjectHead {\n  return {\n    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),\n    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),\n    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),\n  };\n}\n\nexport function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {\n  return `data:${contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`;\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,WAAW,iBAA+D;AAE5E,IAAM,4BAA4B;AAClC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B,IAAI;AA8BrC,SAAS,oBAAoB,UAA0C;AAC5E,MAAI,SAAS,yBAAyB,cAAc;AAClD,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,yBAAyB,OAAO;AAC3C,WAAO,uBAAuB,QAAQ;AAAA,EACxC;AACA,SAAO,gCAAgC,QAAQ;AACjD;AAEA,SAAS,gCAAgC,UAA0C;AACjF,MAAI,SAAS,yBAAyB,oBAAoB,CAAC,SAAS,yBAAyB,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BAA+B;AAC1K,WAAO;AAAA,EACT;AACA,QAAM,eAA+B;AAAA,IACnC,QAAQ,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,4BAA4B;AAAA,IAC5B,GAAI,SAAS,wBAAwB,EAAE,UAAU,SAAS,sBAAsB,IAAI,CAAC;AAAA,IACrF,GAAI,SAAS,4BAA4B,SAAS,+BAA+B,EAAE,aAAa;AAAA,MAC9F,aAAa,SAAS;AAAA,MACtB,iBAAiB,SAAS;AAAA,IAC5B,EAAE,IAAI,CAAC;AAAA,EACT;AACA,QAAM,SAAS,IAAI,SAAS,YAAY;AACxC,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS,yBAAyB,WAAW,WAAW;AAAA,IACjE,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,kBAA0C;AAAA,QAC9C,gBAAgB,KAAK;AAAA,MACvB;AACA,YAAM,UAAU,IAAI,iBAAiB;AAAA,QACnC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC;AACD,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,SAAS,EAAE,UAAU,CAAC;AAAA,QACtD;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,IAAI,iBAAiB;AAAA,UACnD,QAAQ,SAAS;AAAA,UACjB,KAAK,KAAK;AAAA,QACZ,CAAC,GAAG,EAAE,UAAU,CAAC;AAAA,QACjB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAKpB,YAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACrC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,MAAM,KAAK;AAAA,QACX,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC,CAAC;AAAA,IACJ;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,MAAM,OAAO,KAAK,IAAI,kBAAkB;AAAA,QACnD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO,WAAW;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACpD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO,MAAM,cAAc,OAAO,MAAM,KAAK,SAAS;AAAA,IACxD;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,SAAS,MAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,UACpD,QAAQ,SAAS;AAAA,UACjB,KAAK;AAAA,QACP,CAAC,CAAC;AACF,cAAM,QAAQ,MAAM,cAAc,OAAO,MAAM,GAAG;AAClD,eAAO,EAAE,OAAO,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC,EAAG;AAAA,MACrF,SAAS,OAAO;AACd,YAAI,aAAa,KAAK,GAAG;AACvB,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,cAAc,MAAe,WAAwC;AAClF,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yBAAyB,SAAS,EAAE;AAAA,EACtD;AACA,QAAM,gBAAgB;AACtB,MAAI,OAAO,cAAc,yBAAyB,YAAY;AAC5D,WAAO,MAAM,cAAc,qBAAqB;AAAA,EAClD;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,MAAqD;AAC7E,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,aAAa,OAAyB;AAC7C,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,QAAM,OAAO,UAAU,QAAS,MAA6B,OAAO;AACpE,MAAI,SAAS,eAAe,SAAS,YAAY;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,WAAW,eAAe,QAAS,MAAsD,YAAY;AAC3G,SAAO,UAAU,mBAAmB;AACtC;AAEA,SAAS,uBAAuB,UAAmC;AACjE,QAAM,SAAS,IAAI,UAAU,iBAAiB,QAAQ,CAAC;AACvD,QAAM,SAAS,OAAO,OAAO,SAAS,mBAAmB;AACzD,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,SAA6B;AAAA,QACjC,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,KAAK;AAAA,MACpB;AACA,UAAI,KAAK,QAAQ;AACf,eAAO,mBAAmB,EAAE,sBAAsB,KAAK,OAAO;AAAA,MAChE;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa,MAAM;AAC7D,aAAO;AAAA,QACL;AAAA,QACA,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,GAAI,KAAK,SAAS,EAAE,sBAAsB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa;AAAA,QACrD,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,OAAO,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,KAAK,KAAK,IAAI,GAAG;AAAA,QACvD,aAAa,KAAK;AAAA,QAClB,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,CAAC,QAAQ,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,YAAY;AACjE,aAAO,WAAW;AAAA,QAChB,eAAe,mBAAmB,SAAS,IAAI;AAAA,QAC/C,aAAa,SAAS;AAAA,QACtB,UAAU,eAAe,SAAS,QAAQ;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,SAAS;AAC3D,aAAO;AAAA,IACT;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS;AAChD,eAAO,EAAE,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,YAAI,cAAc,KAAK,GAAG;AACxB,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,cAAc,OAAyB;AAC9C,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAa,MAA6B,SAAS;AAC/F;AAEA,SAAS,6BAA6B,UAA0C;AAC9E,QAAM,YAAY,yBAAyB,QAAQ;AACnD,QAAM,gBAAgB,SAAS,qCAC3B,kBAAkB,qBAAqB,SAAS,kCAAkC,IAClF,IAAI,kBAAkB,oBAAoB,QAAQ,GAAG,SAAS;AAClE,QAAM,kBAAkB,cAAc,mBAAmB,SAAS,mBAAmB;AAErF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,IAAI;AAAA,QAC1C,WAAW;AAAA,QACX,aAAa,KAAK;AAAA,MACpB,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,kBAAkB;AAAA,UAClB,GAAI,KAAK,SAAS,EAAE,oBAAoB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,cAAc,KAAK,GAAG;AACzD,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,GAAG;AAAA,QACzC,WAAW;AAAA,MACb,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAClC,YAAM,WAAW,OAAO,MAAM,KAAK,YAAY;AAAA,QAC7C,iBAAiB,EAAE,iBAAiB,KAAK,YAAY;AAAA,QACrD,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,aAAO,sBAAsB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,cAAc,CAAC;AAAA,IAClG;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,aAAO,MAAM,qBAAqB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,SAAS,CAAC;AAAA,IAClG;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,WAAW,MAAM,gBAAgB,cAAc,GAAG,EAAE,SAAS;AACnE,cAAM,QAAQ,MAAM,qBAAqB,QAAQ;AACjD,eAAO,EAAE,OAAO,GAAI,SAAS,cAAc,EAAE,aAAa,SAAS,YAAY,IAAI,CAAC,EAAG;AAAA,MACzF,SAAS,OAAO;AACd,YAAI,gBAAgB,KAAK,GAAG;AAC1B,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAa,MAAmC,eAAe;AAC3G;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,oCAAoC;AAC/C,UAAM,SAAS,sBAAsB,SAAS,kCAAkC;AAChF,QAAI,OAAO,eAAe,OAAO,YAAY;AAC3C,aAAO,IAAI,2BAA2B,OAAO,aAAa,OAAO,UAAU;AAAA,IAC7E;AACA,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,MAAI,CAAC,SAAS,iCAAiC,CAAC,SAAS,8BAA8B;AACrF,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,IAAI,2BAA2B,SAAS,+BAA+B,SAAS,4BAA4B;AACrH;AAEA,SAAS,oBAAoB,UAA4B;AACvD,MAAI,SAAS,4BAA4B;AACvC,WAAO,SAAS,2BAA2B,QAAQ,QAAQ,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,+BAA+B;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,WAAW,SAAS,6BAA6B;AAC1D;AAEA,SAAS,sBAAsB,OAAuC;AACpE,SAAO,OAAO,YAAY,MAAM,MAAM,GAAG,EACtC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO,EACd,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,WAAO,UAAU,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EACjF,CAAC,CAAC;AACN;AAEA,SAAS,iBAAiB,UAAoC;AAC5D,QAAM,UAA0B;AAAA,IAC9B,GAAI,SAAS,4BAA4B,EAAE,WAAW,SAAS,0BAA0B,IAAI,CAAC;AAAA,IAC9F,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,IACpG,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,EACtG;AACA,MAAI,SAAS,iCAAiC;AAC5C,YAAQ,cAAc,oBAAoB,SAAS,+BAA+B;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAqC;AAChE,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwD;AAClF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,eAAe,OAAyG;AAC/H,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,sBAAsB,MAA6C;AAC1E,SAAO,WAAW;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,qBAAqB,UAA2D;AAC7F,MAAI,CAAC,SAAS,oBAAoB;AAChC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,SAAS,oBAAmE;AACpG,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,WAAW,OAIL;AACb,SAAO;AAAA,IACL,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IAClF,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AACF;AAEO,SAAS,eAAe,OAAmB,aAA6B;AAC7E,SAAO,QAAQ,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC5E;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/storage",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -30,7 +30,7 @@
     "@aws-sdk/s3-request-presigner": "^3.1044.0",
     "@azure/storage-blob": "^12.29.1",
     "@google-cloud/storage": "^7.19.0",
-    "@opengeni/config": "^0.3.0",
+    "@opengeni/config": "^0.4.0",
     "@opengeni/contracts": "^0.9.0"
   },
   "repository": {

package/src/index.ts

@@ -37,6 +37,8 @@ export type ObjectStorage = {
   createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;
   headFile: (file: FileAsset) => Promise<ObjectHead>;
   getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+  /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */
+  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array; contentType?: string } | null>;
   /**
    * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
    * in-process upload from a trusted holder of the storage credentials (e.g. the
@@ -134,21 +136,53 @@ function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | nu
         Bucket: file.bucket,
         Key: file.objectKey,
       }));
-      if (!result.Body) {
-        throw new Error(`Object body is empty: ${file.objectKey}`);
-      }
-      if (typeof result.Body.transformToByteArray === "function") {
-        return await result.Body.transformToByteArray();
-      }
-      const chunks: Uint8Array[] = [];
-      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      return await s3BodyToBytes(result.Body, file.objectKey);
+    },
+    async getObjectBytes(key) {
+      try {
+        const result = await client.send(new GetObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: key,
+        }));
+        const bytes = await s3BodyToBytes(result.Body, key);
+        return { bytes, ...(result.ContentType ? { contentType: result.ContentType } : {}) };
+      } catch (error) {
+        if (isS3NotFound(error)) {
+          return null;
+        }
+        throw error;
       }
-      return Buffer.concat(chunks);
     },
   };
 }
 
+async function s3BodyToBytes(body: unknown, objectKey: string): Promise<Uint8Array> {
+  if (!body) {
+    throw new Error(`Object body is empty: ${objectKey}`);
+  }
+  const withTransform = body as { transformToByteArray?: () => Promise<Uint8Array> };
+  if (typeof withTransform.transformToByteArray === "function") {
+    return await withTransform.transformToByteArray();
+  }
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of body as AsyncIterable<Uint8Array | Buffer | string>) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+function isS3NotFound(error: unknown): boolean {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const name = "name" in error ? (error as { name?: unknown }).name : undefined;
+  if (name === "NoSuchKey" || name === "NotFound") {
+    return true;
+  }
+  const metadata = "$metadata" in error ? (error as { $metadata?: { httpStatusCode?: number } }).$metadata : undefined;
+  return metadata?.httpStatusCode === 404;
+}
+
 function createGcsObjectStorage(settings: Settings): ObjectStorage {
   const client = new GcsClient(gcsClientOptions(settings));
   const bucket = client.bucket(settings.objectStorageBucket);
@@ -207,9 +241,24 @@ function createGcsObjectStorage(settings: Settings): ObjectStorage {
       const [bytes] = await bucket.file(file.objectKey).download();
       return bytes;
     },
+    async getObjectBytes(key) {
+      try {
+        const [bytes] = await bucket.file(key).download();
+        return { bytes };
+      } catch (error) {
+        if (isGcsNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
   };
 }
 
+function isGcsNotFound(error: unknown): boolean {
+  return Boolean(error) && typeof error === "object" && (error as { code?: unknown }).code === 404;
+}
+
 function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {
   const sharedKey = azureSharedKeyCredential(settings);
   const serviceClient = settings.objectStorageAzureConnectionString
@@ -272,9 +321,25 @@ function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null
     async getFileBytes(file) {
       return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
     },
+    async getObjectBytes(key) {
+      try {
+        const download = await containerClient.getBlobClient(key).download();
+        const bytes = await azureDownloadToBytes(download);
+        return { bytes, ...(download.contentType ? { contentType: download.contentType } : {}) };
+      } catch (error) {
+        if (isAzureNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
   };
 }
 
+function isAzureNotFound(error: unknown): boolean {
+  return Boolean(error) && typeof error === "object" && (error as { statusCode?: unknown }).statusCode === 404;
+}
+
 function azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {
   if (settings.objectStorageAzureConnectionString) {
     const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);