@opengeni/storage 0.2.7 → 0.2.9

package/dist/index.d.ts

@@ -32,6 +32,11 @@ type ObjectStorage = {
     }>;
     headFile: (file: FileAsset) => Promise<ObjectHead>;
     getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+    /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */
+    getObjectBytes: (key: string) => Promise<{
+        bytes: Uint8Array;
+        contentType?: string;
+    } | null>;
     /**
      * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
      * in-process upload from a trusted holder of the storage credentials (e.g. the
@@ -47,6 +52,15 @@ type ObjectStorage = {
         body: Uint8Array;
         sha256?: string | null;
     }) => Promise<void>;
+    /**
+     * SERVER-SIDE authenticated delete of a single object by raw storage key.
+     * Idempotent: a missing key is a no-op (S3/GCS/Azure delete-by-key does not
+     * 404 on absent objects, or the 404 is swallowed). Used by the Workbench v2
+     * capture GC (dossier §10.1 keep-latest-10) to reap after-image blobs that no
+     * surviving revision references. Best-effort at the call site — a failed
+     * delete leaves an orphan blob, never corrupts a live capture.
+     */
+    deleteObject: (key: string) => Promise<void>;
 };
 declare function createObjectStorage(settings: Settings): ObjectStorage | null;
 declare function bytesToDataUrl(bytes: Uint8Array, contentType: string): string;

package/dist/index.js

@@ -6,13 +6,16 @@ import {
   StorageSharedKeyCredential
 } from "@azure/storage-blob";
 import {
+  DeleteObjectCommand,
   GetObjectCommand,
   HeadObjectCommand,
   PutObjectCommand,
   S3Client
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { Storage as GcsClient } from "@google-cloud/storage";
+import {
+  Storage as GcsClient
+} from "@google-cloud/storage";
 var MAX_SINGLE_PUT_SIZE_BYTES = 5e9;
 var UPLOAD_URL_TTL_SECONDS = 15 * 60;
 var DOWNLOAD_URL_TTL_SECONDS = 5 * 60;
@@ -34,10 +37,12 @@ function createS3CompatibleObjectStorage(settings) {
     forcePathStyle: settings.objectStorageForcePathStyle,
     requestChecksumCalculation: "WHEN_REQUIRED",
     ...settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {},
-    ...settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {
-      accessKeyId: settings.objectStorageAccessKeyId,
-      secretAccessKey: settings.objectStorageSecretAccessKey
-    } } : {}
+    ...settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? {
+      credentials: {
+        accessKeyId: settings.objectStorageAccessKeyId,
+        secretAccessKey: settings.objectStorageSecretAccessKey
+      }
+    } : {}
   };
   const client = new S3Client(clientConfig);
   return {
@@ -64,27 +69,35 @@ function createS3CompatibleObjectStorage(settings) {
     async createGetUrl(args) {
       const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
       return {
-        url: await getSignedUrl(client, new GetObjectCommand({
-          Bucket: settings.objectStorageBucket,
-          Key: args.key
-        }), { expiresIn }),
+        url: await getSignedUrl(
+          client,
+          new GetObjectCommand({
+            Bucket: settings.objectStorageBucket,
+            Key: args.key
+          }),
+          { expiresIn }
+        ),
         expiresAt: new Date(Date.now() + expiresIn * 1e3)
       };
     },
     async putObject(args) {
-      await client.send(new PutObjectCommand({
-        Bucket: settings.objectStorageBucket,
-        Key: args.key,
-        ContentType: args.contentType,
-        Body: args.body,
-        Metadata: args.sha256 ? { sha256: args.sha256 } : void 0
-      }));
+      await client.send(
+        new PutObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: args.key,
+          ContentType: args.contentType,
+          Body: args.body,
+          Metadata: args.sha256 ? { sha256: args.sha256 } : void 0
+        })
+      );
     },
     async headFile(file) {
-      const head = await client.send(new HeadObjectCommand({
-        Bucket: file.bucket,
-        Key: file.objectKey
-      }));
+      const head = await client.send(
+        new HeadObjectCommand({
+          Bucket: file.bucket,
+          Key: file.objectKey
+        })
+      );
       return objectHead({
         contentLength: head.ContentLength,
         contentType: head.ContentType,
@@ -92,24 +105,66 @@ function createS3CompatibleObjectStorage(settings) {
       });
     },
     async getFileBytes(file) {
-      const result = await client.send(new GetObjectCommand({
-        Bucket: file.bucket,
-        Key: file.objectKey
-      }));
-      if (!result.Body) {
-        throw new Error(`Object body is empty: ${file.objectKey}`);
-      }
-      if (typeof result.Body.transformToByteArray === "function") {
-        return await result.Body.transformToByteArray();
-      }
-      const chunks = [];
-      for await (const chunk of result.Body) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      const result = await client.send(
+        new GetObjectCommand({
+          Bucket: file.bucket,
+          Key: file.objectKey
+        })
+      );
+      return await s3BodyToBytes(result.Body, file.objectKey);
+    },
+    async getObjectBytes(key) {
+      try {
+        const result = await client.send(
+          new GetObjectCommand({
+            Bucket: settings.objectStorageBucket,
+            Key: key
+          })
+        );
+        const bytes = await s3BodyToBytes(result.Body, key);
+        return { bytes, ...result.ContentType ? { contentType: result.ContentType } : {} };
+      } catch (error) {
+        if (isS3NotFound(error)) {
+          return null;
+        }
+        throw error;
       }
-      return Buffer.concat(chunks);
+    },
+    async deleteObject(key) {
+      await client.send(
+        new DeleteObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: key
+        })
+      );
     }
   };
 }
+async function s3BodyToBytes(body, objectKey) {
+  if (!body) {
+    throw new Error(`Object body is empty: ${objectKey}`);
+  }
+  const withTransform = body;
+  if (typeof withTransform.transformToByteArray === "function") {
+    return await withTransform.transformToByteArray();
+  }
+  const chunks = [];
+  for await (const chunk of body) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+function isS3NotFound(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const name = "name" in error ? error.name : void 0;
+  if (name === "NoSuchKey" || name === "NotFound") {
+    return true;
+  }
+  const metadata = "$metadata" in error ? error.$metadata : void 0;
+  return metadata?.httpStatusCode === 404;
+}
 function createGcsObjectStorage(settings) {
   const client = new GcsClient(gcsClientOptions(settings));
   const bucket = client.bucket(settings.objectStorageBucket);
@@ -166,9 +221,26 @@ function createGcsObjectStorage(settings) {
     async getFileBytes(file) {
       const [bytes] = await bucket.file(file.objectKey).download();
       return bytes;
+    },
+    async getObjectBytes(key) {
+      try {
+        const [bytes] = await bucket.file(key).download();
+        return { bytes };
+      } catch (error) {
+        if (isGcsNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    async deleteObject(key) {
+      await bucket.file(key).delete({ ignoreNotFound: true });
     }
   };
 }
+function isGcsNotFound(error) {
+  return Boolean(error) && typeof error === "object" && error.code === 404;
+}
 function createAzureBlobObjectStorage(settings) {
   const sharedKey = azureSharedKeyCredential(settings);
   const serviceClient = settings.objectStorageAzureConnectionString ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString) : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);
@@ -181,13 +253,16 @@ function createAzureBlobObjectStorage(settings) {
       const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
       const expiresAt = new Date(Date.now() + expiresIn * 1e3);
       const blobClient = containerClient.getBlockBlobClient(args.key);
-      const sas = generateBlobSASQueryParameters({
-        containerName: settings.objectStorageBucket,
-        blobName: args.key,
-        permissions: BlobSASPermissions.parse("cw"),
-        expiresOn: expiresAt,
-        contentType: args.contentType
-      }, sharedKey).toString();
+      const sas = generateBlobSASQueryParameters(
+        {
+          containerName: settings.objectStorageBucket,
+          blobName: args.key,
+          permissions: BlobSASPermissions.parse("cw"),
+          expiresOn: expiresAt,
+          contentType: args.contentType
+        },
+        sharedKey
+      ).toString();
       return {
         url: `${blobClient.url}?${sas}`,
         requiredHeaders: {
@@ -202,12 +277,15 @@ function createAzureBlobObjectStorage(settings) {
       const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
       const expiresAt = new Date(Date.now() + expiresIn * 1e3);
       const blobClient = containerClient.getBlobClient(args.key);
-      const sas = generateBlobSASQueryParameters({
-        containerName: settings.objectStorageBucket,
-        blobName: args.key,
-        permissions: BlobSASPermissions.parse("r"),
-        expiresOn: expiresAt
-      }, sharedKey).toString();
+      const sas = generateBlobSASQueryParameters(
+        {
+          containerName: settings.objectStorageBucket,
+          blobName: args.key,
+          permissions: BlobSASPermissions.parse("r"),
+          expiresOn: expiresAt
+        },
+        sharedKey
+      ).toString();
       return {
         url: `${blobClient.url}?${sas}`,
         expiresAt
@@ -222,25 +300,52 @@ function createAzureBlobObjectStorage(settings) {
       });
     },
     async headFile(file) {
-      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());
+      return azureHeadToObjectHead(
+        await containerClient.getBlobClient(file.objectKey).getProperties()
+      );
     },
     async getFileBytes(file) {
-      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
+      return await azureDownloadToBytes(
+        await containerClient.getBlobClient(file.objectKey).download()
+      );
+    },
+    async getObjectBytes(key) {
+      try {
+        const download = await containerClient.getBlobClient(key).download();
+        const bytes = await azureDownloadToBytes(download);
+        return { bytes, ...download.contentType ? { contentType: download.contentType } : {} };
+      } catch (error) {
+        if (isAzureNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    async deleteObject(key) {
+      await containerClient.getBlockBlobClient(key).deleteIfExists();
     }
   };
 }
+function isAzureNotFound(error) {
+  return Boolean(error) && typeof error === "object" && error.statusCode === 404;
+}
 function azureSharedKeyCredential(settings) {
   if (settings.objectStorageAzureConnectionString) {
     const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);
     if (parsed.AccountName && parsed.AccountKey) {
       return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);
     }
-    throw new Error("Azure Blob connection string must include AccountName and AccountKey to create presigned URLs");
+    throw new Error(
+      "Azure Blob connection string must include AccountName and AccountKey to create presigned URLs"
+    );
   }
   if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {
     throw new Error("Azure Blob storage requires account name and account key");
   }
-  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);
+  return new StorageSharedKeyCredential(
+    settings.objectStorageAzureAccountName,
+    settings.objectStorageAzureAccountKey
+  );
 }
 function azureBlobServiceUrl(settings) {
   if (settings.objectStorageAzureEndpoint) {
@@ -252,10 +357,12 @@ function azureBlobServiceUrl(settings) {
   return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;
 }
 function parseConnectionString(value) {
-  return Object.fromEntries(value.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
-    const index = part.indexOf("=");
-    return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
-  }));
+  return Object.fromEntries(
+    value.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+      const index = part.indexOf("=");
+      return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
+    })
+  );
 }
 function gcsClientOptions(settings) {
   const options = {
@@ -290,7 +397,9 @@ function stringMetadata(value) {
     return void 0;
   }
   return Object.fromEntries(
-    Object.entries(value).filter((entry) => typeof entry[1] === "string")
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "string"
+    )
   );
 }
 function azureHeadToObjectHead(head) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  BlobSASPermissions,\n  BlobServiceClient,\n  BlockBlobClient,\n  generateBlobSASQueryParameters,\n  StorageSharedKeyCredential,\n  type BlobDownloadResponseParsed,\n  type BlobGetPropertiesResponse,\n} from \"@azure/storage-blob\";\nimport {\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  type S3ClientConfig,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\nimport { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from \"@google-cloud/storage\";\n\nexport const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;\nexport const UPLOAD_URL_TTL_SECONDS = 15 * 60;\nexport const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;\n\nexport type ObjectHead = {\n  ContentLength?: number;\n  ContentType?: string;\n  Metadata?: Record<string, string>;\n};\n\nexport type ObjectStorage = {\n  bucket: string;\n  backend: \"s3-compatible\" | \"aws-s3\" | \"azure-blob\" | \"gcs\";\n  maxSinglePutSizeBytes: number;\n  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;\n  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;\n  headFile: (file: FileAsset) => Promise<ObjectHead>;\n  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;\n  /**\n   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an\n   * in-process upload from a trusted holder of the storage credentials (e.g. the\n   * worker writing a recording), this sends the bytes straight to the storage\n   * backend over the configured endpoint with the in-process SDK client — bypassing\n   * the presigned-URL round-trip, which on split public/internal topologies (a\n   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.\n   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.\n   */\n  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;\n};\n\nexport function createObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"azure-blob\") {\n    return createAzureBlobObjectStorage(settings);\n  }\n  if (settings.objectStorageBackend === \"gcs\") {\n    return createGcsObjectStorage(settings);\n  }\n  return createS3CompatibleObjectStorage(settings);\n}\n\nfunction createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"s3-compatible\" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {\n    return null;\n  }\n  const clientConfig: S3ClientConfig = {\n    region: settings.objectStorageRegion,\n    forcePathStyle: settings.objectStorageForcePathStyle,\n    requestChecksumCalculation: \"WHEN_REQUIRED\",\n    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),\n    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {\n      accessKeyId: settings.objectStorageAccessKeyId,\n      secretAccessKey: settings.objectStorageSecretAccessKey,\n    } } : {}),\n  };\n  const client = new S3Client(clientConfig);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: settings.objectStorageBackend === \"aws-s3\" ? \"aws-s3\" : \"s3-compatible\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const requiredHeaders: Record<string, string> = {\n        \"content-type\": args.contentType,\n      };\n      const command = new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      });\n      return {\n        url: await getSignedUrl(client, command, { expiresIn }),\n        requiredHeaders,\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      return {\n        url: await getSignedUrl(client, new GetObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: args.key,\n        }), { expiresIn }),\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT against the configured (in-cluster) endpoint.\n      // A presigned URL buys nothing here — the worker already holds the creds — and\n      // on a split public/internal endpoint topology the presigned URL points at the\n      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.\n      await client.send(new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Body: args.body,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      }));\n    },\n    async headFile(file) {\n      const head = await client.send(new HeadObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      return objectHead({\n        contentLength: head.ContentLength,\n        contentType: head.ContentType,\n        metadata: head.Metadata,\n      });\n    },\n    async getFileBytes(file) {\n      const result = await client.send(new GetObjectCommand({\n        Bucket: file.bucket,\n        Key: file.objectKey,\n      }));\n      if (!result.Body) {\n        throw new Error(`Object body is empty: ${file.objectKey}`);\n      }\n      if (typeof result.Body.transformToByteArray === \"function\") {\n        return await result.Body.transformToByteArray();\n      }\n      const chunks: Uint8Array[] = [];\n      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {\n        chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n      }\n      return Buffer.concat(chunks);\n    },\n  };\n}\n\nfunction createGcsObjectStorage(settings: Settings): ObjectStorage {\n  const client = new GcsClient(gcsClientOptions(settings));\n  const bucket = client.bucket(settings.objectStorageBucket);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"gcs\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const config: GetSignedUrlConfig = {\n        version: \"v4\",\n        action: \"write\",\n        expires: expiresAt,\n        contentType: args.contentType,\n      };\n      if (args.sha256) {\n        config.extensionHeaders = { \"x-goog-meta-sha256\": args.sha256 };\n      }\n      const [url] = await bucket.file(args.key).getSignedUrl(config);\n      return {\n        url,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          ...(args.sha256 ? { \"x-goog-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const [url] = await bucket.file(args.key).getSignedUrl({\n        version: \"v4\",\n        action: \"read\",\n        expires: expiresAt,\n      });\n      return { url, expiresAt };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).\n      await bucket.file(args.key).save(Buffer.from(args.body), {\n        contentType: args.contentType,\n        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),\n      });\n    },\n    async headFile(file) {\n      const [metadata] = await bucket.file(file.objectKey).getMetadata();\n      return objectHead({\n        contentLength: parseContentLength(metadata.size),\n        contentType: metadata.contentType,\n        metadata: stringMetadata(metadata.metadata),\n      });\n    },\n    async getFileBytes(file) {\n      const [bytes] = await bucket.file(file.objectKey).download();\n      return bytes;\n    },\n  };\n}\n\nfunction createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {\n  const sharedKey = azureSharedKeyCredential(settings);\n  const serviceClient = settings.objectStorageAzureConnectionString\n    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)\n    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);\n  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);\n\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"azure-blob\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"cw\"),\n        expiresOn: expiresAt,\n        contentType: args.contentType,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          \"x-ms-blob-type\": \"BlockBlob\",\n          ...(args.sha256 ? { \"x-ms-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters({\n        containerName: settings.objectStorageBucket,\n        blobName: args.key,\n        permissions: BlobSASPermissions.parse(\"r\"),\n        expiresOn: expiresAt,\n      }, sharedKey).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        expiresAt,\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process upload via the shared-key Azure client (no SAS).\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const body = Buffer.from(args.body);\n      await blobClient.upload(body, body.byteLength, {\n        blobHTTPHeaders: { blobContentType: args.contentType },\n        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),\n      });\n    },\n    async headFile(file) {\n      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());\n    },\n    async getFileBytes(file) {\n      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());\n    },\n  };\n}\n\nfunction azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {\n  if (settings.objectStorageAzureConnectionString) {\n    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);\n    if (parsed.AccountName && parsed.AccountKey) {\n      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);\n    }\n    throw new Error(\"Azure Blob connection string must include AccountName and AccountKey to create presigned URLs\");\n  }\n  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {\n    throw new Error(\"Azure Blob storage requires account name and account key\");\n  }\n  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);\n}\n\nfunction azureBlobServiceUrl(settings: Settings): string {\n  if (settings.objectStorageAzureEndpoint) {\n    return settings.objectStorageAzureEndpoint.replace(/\\/+$/, \"\");\n  }\n  if (!settings.objectStorageAzureAccountName) {\n    throw new Error(\"Azure Blob storage requires account name\");\n  }\n  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;\n}\n\nfunction parseConnectionString(value: string): Record<string, string> {\n  return Object.fromEntries(value.split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const index = part.indexOf(\"=\");\n      return index === -1 ? [part, \"\"] : [part.slice(0, index), part.slice(index + 1)];\n    }));\n}\n\nfunction gcsClientOptions(settings: Settings): StorageOptions {\n  const options: StorageOptions = {\n    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),\n    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),\n    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),\n  };\n  if (settings.objectStorageGcsCredentialsJson) {\n    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);\n  }\n  return options;\n}\n\nfunction parseGcsCredentials(raw: string): Record<string, string> {\n  const parsed = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"GCS credentials JSON must be an object\");\n  }\n  return parsed as Record<string, string>;\n}\n\nfunction parseContentLength(value: string | number | undefined): number | undefined {\n  if (typeof value === \"number\") {\n    return value;\n  }\n  if (typeof value !== \"string\" || value.length === 0) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {\n  if (!value) {\n    return undefined;\n  }\n  return Object.fromEntries(\n    Object.entries(value)\n      .filter((entry): entry is [string, string] => typeof entry[1] === \"string\"),\n  );\n}\n\nfunction azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {\n  return objectHead({\n    contentLength: head.contentLength,\n    contentType: head.contentType,\n    metadata: head.metadata,\n  });\n}\n\nasync function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {\n  if (!download.readableStreamBody) {\n    throw new Error(\"Azure Blob download response did not include a readable body\");\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction objectHead(input: {\n  contentLength?: number | undefined;\n  contentType?: string | undefined;\n  metadata?: Record<string, string> | undefined;\n}): ObjectHead {\n  return {\n    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),\n    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),\n    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),\n  };\n}\n\nexport function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {\n  return `data:${contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`;\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,WAAW,iBAA+D;AAE5E,IAAM,4BAA4B;AAClC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B,IAAI;AA4BrC,SAAS,oBAAoB,UAA0C;AAC5E,MAAI,SAAS,yBAAyB,cAAc;AAClD,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,yBAAyB,OAAO;AAC3C,WAAO,uBAAuB,QAAQ;AAAA,EACxC;AACA,SAAO,gCAAgC,QAAQ;AACjD;AAEA,SAAS,gCAAgC,UAA0C;AACjF,MAAI,SAAS,yBAAyB,oBAAoB,CAAC,SAAS,yBAAyB,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BAA+B;AAC1K,WAAO;AAAA,EACT;AACA,QAAM,eAA+B;AAAA,IACnC,QAAQ,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,4BAA4B;AAAA,IAC5B,GAAI,SAAS,wBAAwB,EAAE,UAAU,SAAS,sBAAsB,IAAI,CAAC;AAAA,IACrF,GAAI,SAAS,4BAA4B,SAAS,+BAA+B,EAAE,aAAa;AAAA,MAC9F,aAAa,SAAS;AAAA,MACtB,iBAAiB,SAAS;AAAA,IAC5B,EAAE,IAAI,CAAC;AAAA,EACT;AACA,QAAM,SAAS,IAAI,SAAS,YAAY;AACxC,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS,yBAAyB,WAAW,WAAW;AAAA,IACjE,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,kBAA0C;AAAA,QAC9C,gBAAgB,KAAK;AAAA,MACvB;AACA,YAAM,UAAU,IAAI,iBAAiB;AAAA,QACnC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC;AACD,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,SAAS,EAAE,UAAU,CAAC;AAAA,QACtD;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,IAAI,iBAAiB;AAAA,UACnD,QAAQ,SAAS;AAAA,UACjB,KAAK,KAAK;AAAA,QACZ,CAAC,GAAG,EAAE,UAAU,CAAC;AAAA,QACjB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAKpB,YAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACrC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,MAAM,KAAK;AAAA,QACX,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC,CAAC;AAAA,IACJ;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,MAAM,OAAO,KAAK,IAAI,kBAAkB;AAAA,QACnD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO,WAAW;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,SAAS,MAAM,OAAO,KAAK,IAAI,iBAAiB;AAAA,QACpD,QAAQ,KAAK;AAAA,QACb,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,UAAI,CAAC,OAAO,MAAM;AAChB,cAAM,IAAI,MAAM,yBAAyB,KAAK,SAAS,EAAE;AAAA,MAC3D;AACA,UAAI,OAAO,OAAO,KAAK,yBAAyB,YAAY;AAC1D,eAAO,MAAM,OAAO,KAAK,qBAAqB;AAAA,MAChD;AACA,YAAM,SAAuB,CAAC;AAC9B,uBAAiB,SAAS,OAAO,MAAqD;AACpF,eAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,MACpE;AACA,aAAO,OAAO,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,UAAmC;AACjE,QAAM,SAAS,IAAI,UAAU,iBAAiB,QAAQ,CAAC;AACvD,QAAM,SAAS,OAAO,OAAO,SAAS,mBAAmB;AACzD,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,SAA6B;AAAA,QACjC,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,KAAK;AAAA,MACpB;AACA,UAAI,KAAK,QAAQ;AACf,eAAO,mBAAmB,EAAE,sBAAsB,KAAK,OAAO;AAAA,MAChE;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa,MAAM;AAC7D,aAAO;AAAA,QACL;AAAA,QACA,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,GAAI,KAAK,SAAS,EAAE,sBAAsB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa;AAAA,QACrD,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,OAAO,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,KAAK,KAAK,IAAI,GAAG;AAAA,QACvD,aAAa,KAAK;AAAA,QAClB,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,CAAC,QAAQ,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,YAAY;AACjE,aAAO,WAAW;AAAA,QAChB,eAAe,mBAAmB,SAAS,IAAI;AAAA,QAC/C,aAAa,SAAS;AAAA,QACtB,UAAU,eAAe,SAAS,QAAQ;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,SAAS;AAC3D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,UAA0C;AAC9E,QAAM,YAAY,yBAAyB,QAAQ;AACnD,QAAM,gBAAgB,SAAS,qCAC3B,kBAAkB,qBAAqB,SAAS,kCAAkC,IAClF,IAAI,kBAAkB,oBAAoB,QAAQ,GAAG,SAAS;AAClE,QAAM,kBAAkB,cAAc,mBAAmB,SAAS,mBAAmB;AAErF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,IAAI;AAAA,QAC1C,WAAW;AAAA,QACX,aAAa,KAAK;AAAA,MACpB,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,kBAAkB;AAAA,UAClB,GAAI,KAAK,SAAS,EAAE,oBAAoB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,cAAc,KAAK,GAAG;AACzD,YAAM,MAAM,+BAA+B;AAAA,QACzC,eAAe,SAAS;AAAA,QACxB,UAAU,KAAK;AAAA,QACf,aAAa,mBAAmB,MAAM,GAAG;AAAA,QACzC,WAAW;AAAA,MACb,GAAG,SAAS,EAAE,SAAS;AACvB,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAClC,YAAM,WAAW,OAAO,MAAM,KAAK,YAAY;AAAA,QAC7C,iBAAiB,EAAE,iBAAiB,KAAK,YAAY;AAAA,QACrD,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,aAAO,sBAAsB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,cAAc,CAAC;AAAA,IAClG;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,aAAO,MAAM,qBAAqB,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,SAAS,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,oCAAoC;AAC/C,UAAM,SAAS,sBAAsB,SAAS,kCAAkC;AAChF,QAAI,OAAO,eAAe,OAAO,YAAY;AAC3C,aAAO,IAAI,2BAA2B,OAAO,aAAa,OAAO,UAAU;AAAA,IAC7E;AACA,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,MAAI,CAAC,SAAS,iCAAiC,CAAC,SAAS,8BAA8B;AACrF,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,IAAI,2BAA2B,SAAS,+BAA+B,SAAS,4BAA4B;AACrH;AAEA,SAAS,oBAAoB,UAA4B;AACvD,MAAI,SAAS,4BAA4B;AACvC,WAAO,SAAS,2BAA2B,QAAQ,QAAQ,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,+BAA+B;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,WAAW,SAAS,6BAA6B;AAC1D;AAEA,SAAS,sBAAsB,OAAuC;AACpE,SAAO,OAAO,YAAY,MAAM,MAAM,GAAG,EACtC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO,EACd,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,WAAO,UAAU,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EACjF,CAAC,CAAC;AACN;AAEA,SAAS,iBAAiB,UAAoC;AAC5D,QAAM,UAA0B;AAAA,IAC9B,GAAI,SAAS,4BAA4B,EAAE,WAAW,SAAS,0BAA0B,IAAI,CAAC;AAAA,IAC9F,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,IACpG,GAAI,SAAS,8BAA8B,EAAE,aAAa,SAAS,4BAA4B,IAAI,CAAC;AAAA,EACtG;AACA,MAAI,SAAS,iCAAiC;AAC5C,YAAQ,cAAc,oBAAoB,SAAS,+BAA+B;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAqC;AAChE,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwD;AAClF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,eAAe,OAAyG;AAC/H,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM,QAAQ;AAAA,EAC9E;AACF;AAEA,SAAS,sBAAsB,MAA6C;AAC1E,SAAO,WAAW;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,qBAAqB,UAA2D;AAC7F,MAAI,CAAC,SAAS,oBAAoB;AAChC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,SAAS,oBAAmE;AACpG,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,WAAW,OAIL;AACb,SAAO;AAAA,IACL,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IAClF,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AACF;AAEO,SAAS,eAAe,OAAmB,aAA6B;AAC7E,SAAO,QAAQ,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC5E;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  BlobSASPermissions,\n  BlobServiceClient,\n  generateBlobSASQueryParameters,\n  StorageSharedKeyCredential,\n  type BlobDownloadResponseParsed,\n  type BlobGetPropertiesResponse,\n} from \"@azure/storage-blob\";\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  type S3ClientConfig,\n} from \"@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"@aws-sdk/s3-request-presigner\";\nimport {\n  Storage as GcsClient,\n  type GetSignedUrlConfig,\n  type StorageOptions,\n} from \"@google-cloud/storage\";\n\nexport const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;\nexport const UPLOAD_URL_TTL_SECONDS = 15 * 60;\nexport const DOWNLOAD_URL_TTL_SECONDS = 5 * 60;\n\nexport type ObjectHead = {\n  ContentLength?: number;\n  ContentType?: string;\n  Metadata?: Record<string, string>;\n};\n\nexport type ObjectStorage = {\n  bucket: string;\n  backend: \"s3-compatible\" | \"aws-s3\" | \"azure-blob\" | \"gcs\";\n  maxSinglePutSizeBytes: number;\n  createPutUrl: (args: {\n    key: string;\n    contentType: string;\n    sha256?: string | null;\n    expiresInSeconds?: number;\n  }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;\n  createGetUrl: (args: {\n    key: string;\n    expiresInSeconds?: number;\n  }) => Promise<{ url: string; expiresAt: Date }>;\n  headFile: (file: FileAsset) => Promise<ObjectHead>;\n  getFileBytes: (file: FileAsset) => Promise<Uint8Array>;\n  /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */\n  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array; contentType?: string } | null>;\n  /**\n   * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an\n   * in-process upload from a trusted holder of the storage credentials (e.g. the\n   * worker writing a recording), this sends the bytes straight to the storage\n   * backend over the configured endpoint with the in-process SDK client — bypassing\n   * the presigned-URL round-trip, which on split public/internal topologies (a\n   * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.\n   * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.\n   */\n  putObject: (args: {\n    key: string;\n    contentType: string;\n    body: Uint8Array;\n    sha256?: string | null;\n  }) => Promise<void>;\n  /**\n   * SERVER-SIDE authenticated delete of a single object by raw storage key.\n   * Idempotent: a missing key is a no-op (S3/GCS/Azure delete-by-key does not\n   * 404 on absent objects, or the 404 is swallowed). Used by the Workbench v2\n   * capture GC (dossier §10.1 keep-latest-10) to reap after-image blobs that no\n   * surviving revision references. Best-effort at the call site — a failed\n   * delete leaves an orphan blob, never corrupts a live capture.\n   */\n  deleteObject: (key: string) => Promise<void>;\n};\n\nexport function createObjectStorage(settings: Settings): ObjectStorage | null {\n  if (settings.objectStorageBackend === \"azure-blob\") {\n    return createAzureBlobObjectStorage(settings);\n  }\n  if (settings.objectStorageBackend === \"gcs\") {\n    return createGcsObjectStorage(settings);\n  }\n  return createS3CompatibleObjectStorage(settings);\n}\n\nfunction createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {\n  if (\n    settings.objectStorageBackend === \"s3-compatible\" &&\n    (!settings.objectStorageEndpoint ||\n      !settings.objectStorageAccessKeyId ||\n      !settings.objectStorageSecretAccessKey)\n  ) {\n    return null;\n  }\n  const clientConfig: S3ClientConfig = {\n    region: settings.objectStorageRegion,\n    forcePathStyle: settings.objectStorageForcePathStyle,\n    requestChecksumCalculation: \"WHEN_REQUIRED\",\n    ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),\n    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey\n      ? {\n          credentials: {\n            accessKeyId: settings.objectStorageAccessKeyId,\n            secretAccessKey: settings.objectStorageSecretAccessKey,\n          },\n        }\n      : {}),\n  };\n  const client = new S3Client(clientConfig);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: settings.objectStorageBackend === \"aws-s3\" ? \"aws-s3\" : \"s3-compatible\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const requiredHeaders: Record<string, string> = {\n        \"content-type\": args.contentType,\n      };\n      const command = new PutObjectCommand({\n        Bucket: settings.objectStorageBucket,\n        Key: args.key,\n        ContentType: args.contentType,\n        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n      });\n      return {\n        url: await getSignedUrl(client, command, { expiresIn }),\n        requiredHeaders,\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      return {\n        url: await getSignedUrl(\n          client,\n          new GetObjectCommand({\n            Bucket: settings.objectStorageBucket,\n            Key: args.key,\n          }),\n          { expiresIn },\n        ),\n        expiresAt: new Date(Date.now() + expiresIn * 1000),\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT against the configured (in-cluster) endpoint.\n      // A presigned URL buys nothing here — the worker already holds the creds — and\n      // on a split public/internal endpoint topology the presigned URL points at the\n      // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.\n      await client.send(\n        new PutObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: args.key,\n          ContentType: args.contentType,\n          Body: args.body,\n          Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,\n        }),\n      );\n    },\n    async headFile(file) {\n      const head = await client.send(\n        new HeadObjectCommand({\n          Bucket: file.bucket,\n          Key: file.objectKey,\n        }),\n      );\n      return objectHead({\n        contentLength: head.ContentLength,\n        contentType: head.ContentType,\n        metadata: head.Metadata,\n      });\n    },\n    async getFileBytes(file) {\n      const result = await client.send(\n        new GetObjectCommand({\n          Bucket: file.bucket,\n          Key: file.objectKey,\n        }),\n      );\n      return await s3BodyToBytes(result.Body, file.objectKey);\n    },\n    async getObjectBytes(key) {\n      try {\n        const result = await client.send(\n          new GetObjectCommand({\n            Bucket: settings.objectStorageBucket,\n            Key: key,\n          }),\n        );\n        const bytes = await s3BodyToBytes(result.Body, key);\n        return { bytes, ...(result.ContentType ? { contentType: result.ContentType } : {}) };\n      } catch (error) {\n        if (isS3NotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n    async deleteObject(key) {\n      // S3 DeleteObject is idempotent — deleting an absent key returns 204.\n      await client.send(\n        new DeleteObjectCommand({\n          Bucket: settings.objectStorageBucket,\n          Key: key,\n        }),\n      );\n    },\n  };\n}\n\nasync function s3BodyToBytes(body: unknown, objectKey: string): Promise<Uint8Array> {\n  if (!body) {\n    throw new Error(`Object body is empty: ${objectKey}`);\n  }\n  const withTransform = body as { transformToByteArray?: () => Promise<Uint8Array> };\n  if (typeof withTransform.transformToByteArray === \"function\") {\n    return await withTransform.transformToByteArray();\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of body as AsyncIterable<Uint8Array | Buffer | string>) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction isS3NotFound(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") {\n    return false;\n  }\n  const name = \"name\" in error ? (error as { name?: unknown }).name : undefined;\n  if (name === \"NoSuchKey\" || name === \"NotFound\") {\n    return true;\n  }\n  const metadata =\n    \"$metadata\" in error\n      ? (error as { $metadata?: { httpStatusCode?: number } }).$metadata\n      : undefined;\n  return metadata?.httpStatusCode === 404;\n}\n\nfunction createGcsObjectStorage(settings: Settings): ObjectStorage {\n  const client = new GcsClient(gcsClientOptions(settings));\n  const bucket = client.bucket(settings.objectStorageBucket);\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"gcs\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const config: GetSignedUrlConfig = {\n        version: \"v4\",\n        action: \"write\",\n        expires: expiresAt,\n        contentType: args.contentType,\n      };\n      if (args.sha256) {\n        config.extensionHeaders = { \"x-goog-meta-sha256\": args.sha256 };\n      }\n      const [url] = await bucket.file(args.key).getSignedUrl(config);\n      return {\n        url,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          ...(args.sha256 ? { \"x-goog-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const [url] = await bucket.file(args.key).getSignedUrl({\n        version: \"v4\",\n        action: \"read\",\n        expires: expiresAt,\n      });\n      return { url, expiresAt };\n    },\n    async putObject(args) {\n      // Authenticated in-process PUT via the GCS SDK (the server holds the creds).\n      await bucket.file(args.key).save(Buffer.from(args.body), {\n        contentType: args.contentType,\n        ...(args.sha256 ? { metadata: { metadata: { sha256: args.sha256 } } } : {}),\n      });\n    },\n    async headFile(file) {\n      const [metadata] = await bucket.file(file.objectKey).getMetadata();\n      return objectHead({\n        contentLength: parseContentLength(metadata.size),\n        contentType: metadata.contentType,\n        metadata: stringMetadata(metadata.metadata),\n      });\n    },\n    async getFileBytes(file) {\n      const [bytes] = await bucket.file(file.objectKey).download();\n      return bytes;\n    },\n    async getObjectBytes(key) {\n      try {\n        const [bytes] = await bucket.file(key).download();\n        return { bytes };\n      } catch (error) {\n        if (isGcsNotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n    async deleteObject(key) {\n      // ignoreNotFound keeps the delete idempotent (a missing blob is a no-op).\n      await bucket.file(key).delete({ ignoreNotFound: true });\n    },\n  };\n}\n\nfunction isGcsNotFound(error: unknown): boolean {\n  return Boolean(error) && typeof error === \"object\" && (error as { code?: unknown }).code === 404;\n}\n\nfunction createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {\n  const sharedKey = azureSharedKeyCredential(settings);\n  const serviceClient = settings.objectStorageAzureConnectionString\n    ? BlobServiceClient.fromConnectionString(settings.objectStorageAzureConnectionString)\n    : new BlobServiceClient(azureBlobServiceUrl(settings), sharedKey);\n  const containerClient = serviceClient.getContainerClient(settings.objectStorageBucket);\n\n  return {\n    bucket: settings.objectStorageBucket,\n    backend: \"azure-blob\",\n    maxSinglePutSizeBytes: MAX_SINGLE_PUT_SIZE_BYTES,\n    async createPutUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters(\n        {\n          containerName: settings.objectStorageBucket,\n          blobName: args.key,\n          permissions: BlobSASPermissions.parse(\"cw\"),\n          expiresOn: expiresAt,\n          contentType: args.contentType,\n        },\n        sharedKey,\n      ).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        requiredHeaders: {\n          \"content-type\": args.contentType,\n          \"x-ms-blob-type\": \"BlockBlob\",\n          ...(args.sha256 ? { \"x-ms-meta-sha256\": args.sha256 } : {}),\n        },\n        expiresAt,\n      };\n    },\n    async createGetUrl(args) {\n      const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;\n      const expiresAt = new Date(Date.now() + expiresIn * 1000);\n      const blobClient = containerClient.getBlobClient(args.key);\n      const sas = generateBlobSASQueryParameters(\n        {\n          containerName: settings.objectStorageBucket,\n          blobName: args.key,\n          permissions: BlobSASPermissions.parse(\"r\"),\n          expiresOn: expiresAt,\n        },\n        sharedKey,\n      ).toString();\n      return {\n        url: `${blobClient.url}?${sas}`,\n        expiresAt,\n      };\n    },\n    async putObject(args) {\n      // Authenticated in-process upload via the shared-key Azure client (no SAS).\n      const blobClient = containerClient.getBlockBlobClient(args.key);\n      const body = Buffer.from(args.body);\n      await blobClient.upload(body, body.byteLength, {\n        blobHTTPHeaders: { blobContentType: args.contentType },\n        ...(args.sha256 ? { metadata: { sha256: args.sha256 } } : {}),\n      });\n    },\n    async headFile(file) {\n      return azureHeadToObjectHead(\n        await containerClient.getBlobClient(file.objectKey).getProperties(),\n      );\n    },\n    async getFileBytes(file) {\n      return await azureDownloadToBytes(\n        await containerClient.getBlobClient(file.objectKey).download(),\n      );\n    },\n    async getObjectBytes(key) {\n      try {\n        const download = await containerClient.getBlobClient(key).download();\n        const bytes = await azureDownloadToBytes(download);\n        return { bytes, ...(download.contentType ? { contentType: download.contentType } : {}) };\n      } catch (error) {\n        if (isAzureNotFound(error)) {\n          return null;\n        }\n        throw error;\n      }\n    },\n    async deleteObject(key) {\n      // deleteIfExists keeps the delete idempotent (a missing blob is a no-op).\n      await containerClient.getBlockBlobClient(key).deleteIfExists();\n    },\n  };\n}\n\nfunction isAzureNotFound(error: unknown): boolean {\n  return (\n    Boolean(error) &&\n    typeof error === \"object\" &&\n    (error as { statusCode?: unknown }).statusCode === 404\n  );\n}\n\nfunction azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {\n  if (settings.objectStorageAzureConnectionString) {\n    const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);\n    if (parsed.AccountName && parsed.AccountKey) {\n      return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);\n    }\n    throw new Error(\n      \"Azure Blob connection string must include AccountName and AccountKey to create presigned URLs\",\n    );\n  }\n  if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {\n    throw new Error(\"Azure Blob storage requires account name and account key\");\n  }\n  return new StorageSharedKeyCredential(\n    settings.objectStorageAzureAccountName,\n    settings.objectStorageAzureAccountKey,\n  );\n}\n\nfunction azureBlobServiceUrl(settings: Settings): string {\n  if (settings.objectStorageAzureEndpoint) {\n    return settings.objectStorageAzureEndpoint.replace(/\\/+$/, \"\");\n  }\n  if (!settings.objectStorageAzureAccountName) {\n    throw new Error(\"Azure Blob storage requires account name\");\n  }\n  return `https://${settings.objectStorageAzureAccountName}.blob.core.windows.net`;\n}\n\nfunction parseConnectionString(value: string): Record<string, string> {\n  return Object.fromEntries(\n    value\n      .split(\";\")\n      .map((part) => part.trim())\n      .filter(Boolean)\n      .map((part) => {\n        const index = part.indexOf(\"=\");\n        return index === -1 ? [part, \"\"] : [part.slice(0, index), part.slice(index + 1)];\n      }),\n  );\n}\n\nfunction gcsClientOptions(settings: Settings): StorageOptions {\n  const options: StorageOptions = {\n    ...(settings.objectStorageGcsProjectId\n      ? { projectId: settings.objectStorageGcsProjectId }\n      : {}),\n    ...(settings.objectStorageGcsKeyFilename\n      ? { keyFilename: settings.objectStorageGcsKeyFilename }\n      : {}),\n    ...(settings.objectStorageGcsApiEndpoint\n      ? { apiEndpoint: settings.objectStorageGcsApiEndpoint }\n      : {}),\n  };\n  if (settings.objectStorageGcsCredentialsJson) {\n    options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);\n  }\n  return options;\n}\n\nfunction parseGcsCredentials(raw: string): Record<string, string> {\n  const parsed = JSON.parse(raw);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"GCS credentials JSON must be an object\");\n  }\n  return parsed as Record<string, string>;\n}\n\nfunction parseContentLength(value: string | number | undefined): number | undefined {\n  if (typeof value === \"number\") {\n    return value;\n  }\n  if (typeof value !== \"string\" || value.length === 0) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : undefined;\n}\n\nfunction stringMetadata(\n  value: Record<string, string | number | boolean | null> | undefined,\n): Record<string, string> | undefined {\n  if (!value) {\n    return undefined;\n  }\n  return Object.fromEntries(\n    Object.entries(value).filter(\n      (entry): entry is [string, string] => typeof entry[1] === \"string\",\n    ),\n  );\n}\n\nfunction azureHeadToObjectHead(head: BlobGetPropertiesResponse): ObjectHead {\n  return objectHead({\n    contentLength: head.contentLength,\n    contentType: head.contentType,\n    metadata: head.metadata,\n  });\n}\n\nasync function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promise<Uint8Array> {\n  if (!download.readableStreamBody) {\n    throw new Error(\"Azure Blob download response did not include a readable body\");\n  }\n  const chunks: Uint8Array[] = [];\n  for await (const chunk of download.readableStreamBody as AsyncIterable<\n    Uint8Array | Buffer | string\n  >) {\n    chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n  }\n  return Buffer.concat(chunks);\n}\n\nfunction objectHead(input: {\n  contentLength?: number | undefined;\n  contentType?: string | undefined;\n  metadata?: Record<string, string> | undefined;\n}): ObjectHead {\n  return {\n    ...(input.contentLength !== undefined ? { ContentLength: input.contentLength } : {}),\n    ...(input.contentType !== undefined ? { ContentType: input.contentType } : {}),\n    ...(input.metadata !== undefined ? { Metadata: input.metadata } : {}),\n  };\n}\n\nexport function bytesToDataUrl(bytes: Uint8Array, contentType: string): string {\n  return `data:${contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`;\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE,WAAW;AAAA,OAGN;AAEA,IAAM,4BAA4B;AAClC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B,IAAI;AAoDrC,SAAS,oBAAoB,UAA0C;AAC5E,MAAI,SAAS,yBAAyB,cAAc;AAClD,WAAO,6BAA6B,QAAQ;AAAA,EAC9C;AACA,MAAI,SAAS,yBAAyB,OAAO;AAC3C,WAAO,uBAAuB,QAAQ;AAAA,EACxC;AACA,SAAO,gCAAgC,QAAQ;AACjD;AAEA,SAAS,gCAAgC,UAA0C;AACjF,MACE,SAAS,yBAAyB,oBACjC,CAAC,SAAS,yBACT,CAAC,SAAS,4BACV,CAAC,SAAS,+BACZ;AACA,WAAO;AAAA,EACT;AACA,QAAM,eAA+B;AAAA,IACnC,QAAQ,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,4BAA4B;AAAA,IAC5B,GAAI,SAAS,wBAAwB,EAAE,UAAU,SAAS,sBAAsB,IAAI,CAAC;AAAA,IACrF,GAAI,SAAS,4BAA4B,SAAS,+BAC9C;AAAA,MACE,aAAa;AAAA,QACX,aAAa,SAAS;AAAA,QACtB,iBAAiB,SAAS;AAAA,MAC5B;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACA,QAAM,SAAS,IAAI,SAAS,YAAY;AACxC,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS,yBAAyB,WAAW,WAAW;AAAA,IACjE,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,kBAA0C;AAAA,QAC9C,gBAAgB,KAAK;AAAA,MACvB;AACA,YAAM,UAAU,IAAI,iBAAiB;AAAA,QACnC,QAAQ,SAAS;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,MACpD,CAAC;AACD,aAAO;AAAA,QACL,KAAK,MAAM,aAAa,QAAQ,SAAS,EAAE,UAAU,CAAC;AAAA,QACtD;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,aAAO;AAAA,QACL,KAAK,MAAM;AAAA,UACT;AAAA,UACA,IAAI,iBAAiB;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,KAAK,KAAK;AAAA,UACZ,CAAC;AAAA,UACD,EAAE,UAAU;AAAA,QACd;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,MACnD;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAKpB,YAAM,OAAO;AAAA,QACX,IAAI,iBAAiB;AAAA,UACnB,QAAQ,SAAS;AAAA,UACjB,KAAK,KAAK;AAAA,UACV,aAAa,KAAK;AAAA,UAClB,MAAM,KAAK;AAAA,UACX,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,MAAM,OAAO;AAAA,QACxB,IAAI,kBAAkB;AAAA,UACpB,QAAQ,KAAK;AAAA,UACb,KAAK,KAAK;AAAA,QACZ,CAAC;AAAA,MACH;AACA,aAAO,WAAW;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,IAAI,iBAAiB;AAAA,UACnB,QAAQ,KAAK;AAAA,UACb,KAAK,KAAK;AAAA,QACZ,CAAC;AAAA,MACH;AACA,aAAO,MAAM,cAAc,OAAO,MAAM,KAAK,SAAS;AAAA,IACxD;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,SAAS,MAAM,OAAO;AAAA,UAC1B,IAAI,iBAAiB;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,KAAK;AAAA,UACP,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,MAAM,cAAc,OAAO,MAAM,GAAG;AAClD,eAAO,EAAE,OAAO,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC,EAAG;AAAA,MACrF,SAAS,OAAO;AACd,YAAI,aAAa,KAAK,GAAG;AACvB,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,aAAa,KAAK;AAEtB,YAAM,OAAO;AAAA,QACX,IAAI,oBAAoB;AAAA,UACtB,QAAQ,SAAS;AAAA,UACjB,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,cAAc,MAAe,WAAwC;AAClF,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,yBAAyB,SAAS,EAAE;AAAA,EACtD;AACA,QAAM,gBAAgB;AACtB,MAAI,OAAO,cAAc,yBAAyB,YAAY;AAC5D,WAAO,MAAM,cAAc,qBAAqB;AAAA,EAClD;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,MAAqD;AAC7E,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,aAAa,OAAyB;AAC7C,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,QAAM,OAAO,UAAU,QAAS,MAA6B,OAAO;AACpE,MAAI,SAAS,eAAe,SAAS,YAAY;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,WACJ,eAAe,QACV,MAAsD,YACvD;AACN,SAAO,UAAU,mBAAmB;AACtC;AAEA,SAAS,uBAAuB,UAAmC;AACjE,QAAM,SAAS,IAAI,UAAU,iBAAiB,QAAQ,CAAC;AACvD,QAAM,SAAS,OAAO,OAAO,SAAS,mBAAmB;AACzD,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,SAA6B;AAAA,QACjC,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,KAAK;AAAA,MACpB;AACA,UAAI,KAAK,QAAQ;AACf,eAAO,mBAAmB,EAAE,sBAAsB,KAAK,OAAO;AAAA,MAChE;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa,MAAM;AAC7D,aAAO;AAAA,QACL;AAAA,QACA,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,GAAI,KAAK,SAAS,EAAE,sBAAsB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,CAAC,GAAG,IAAI,MAAM,OAAO,KAAK,KAAK,GAAG,EAAE,aAAa;AAAA,QACrD,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,OAAO,KAAK,KAAK,GAAG,EAAE,KAAK,OAAO,KAAK,KAAK,IAAI,GAAG;AAAA,QACvD,aAAa,KAAK;AAAA,QAClB,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,YAAM,CAAC,QAAQ,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,YAAY;AACjE,aAAO,WAAW;AAAA,QAChB,eAAe,mBAAmB,SAAS,IAAI;AAAA,QAC/C,aAAa,SAAS;AAAA,QACtB,UAAU,eAAe,SAAS,QAAQ;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,KAAK,SAAS,EAAE,SAAS;AAC3D,aAAO;AAAA,IACT;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,CAAC,KAAK,IAAI,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS;AAChD,eAAO,EAAE,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,YAAI,cAAc,KAAK,GAAG;AACxB,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,aAAa,KAAK;AAEtB,YAAM,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAEA,SAAS,cAAc,OAAyB;AAC9C,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAa,MAA6B,SAAS;AAC/F;AAEA,SAAS,6BAA6B,UAA0C;AAC9E,QAAM,YAAY,yBAAyB,QAAQ;AACnD,QAAM,gBAAgB,SAAS,qCAC3B,kBAAkB,qBAAqB,SAAS,kCAAkC,IAClF,IAAI,kBAAkB,oBAAoB,QAAQ,GAAG,SAAS;AAClE,QAAM,kBAAkB,cAAc,mBAAmB,SAAS,mBAAmB;AAErF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,SAAS;AAAA,IACT,uBAAuB;AAAA,IACvB,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,MAAM;AAAA,QACV;AAAA,UACE,eAAe,SAAS;AAAA,UACxB,UAAU,KAAK;AAAA,UACf,aAAa,mBAAmB,MAAM,IAAI;AAAA,UAC1C,WAAW;AAAA,UACX,aAAa,KAAK;AAAA,QACpB;AAAA,QACA;AAAA,MACF,EAAE,SAAS;AACX,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B,iBAAiB;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,kBAAkB;AAAA,UAClB,GAAI,KAAK,SAAS,EAAE,oBAAoB,KAAK,OAAO,IAAI,CAAC;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,YAAM,YAAY,KAAK,oBAAoB;AAC3C,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,YAAM,aAAa,gBAAgB,cAAc,KAAK,GAAG;AACzD,YAAM,MAAM;AAAA,QACV;AAAA,UACE,eAAe,SAAS;AAAA,UACxB,UAAU,KAAK;AAAA,UACf,aAAa,mBAAmB,MAAM,GAAG;AAAA,UACzC,WAAW;AAAA,QACb;AAAA,QACA;AAAA,MACF,EAAE,SAAS;AACX,aAAO;AAAA,QACL,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,MAAM;AAEpB,YAAM,aAAa,gBAAgB,mBAAmB,KAAK,GAAG;AAC9D,YAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAClC,YAAM,WAAW,OAAO,MAAM,KAAK,YAAY;AAAA,QAC7C,iBAAiB,EAAE,iBAAiB,KAAK,YAAY;AAAA,QACrD,GAAI,KAAK,SAAS,EAAE,UAAU,EAAE,QAAQ,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,IACA,MAAM,SAAS,MAAM;AACnB,aAAO;AAAA,QACL,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,cAAc;AAAA,MACpE;AAAA,IACF;AAAA,IACA,MAAM,aAAa,MAAM;AACvB,aAAO,MAAM;AAAA,QACX,MAAM,gBAAgB,cAAc,KAAK,SAAS,EAAE,SAAS;AAAA,MAC/D;AAAA,IACF;AAAA,IACA,MAAM,eAAe,KAAK;AACxB,UAAI;AACF,cAAM,WAAW,MAAM,gBAAgB,cAAc,GAAG,EAAE,SAAS;AACnE,cAAM,QAAQ,MAAM,qBAAqB,QAAQ;AACjD,eAAO,EAAE,OAAO,GAAI,SAAS,cAAc,EAAE,aAAa,SAAS,YAAY,IAAI,CAAC,EAAG;AAAA,MACzF,SAAS,OAAO;AACd,YAAI,gBAAgB,KAAK,GAAG;AAC1B,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,aAAa,KAAK;AAEtB,YAAM,gBAAgB,mBAAmB,GAAG,EAAE,eAAe;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SACE,QAAQ,KAAK,KACb,OAAO,UAAU,YAChB,MAAmC,eAAe;AAEvD;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,oCAAoC;AAC/C,UAAM,SAAS,sBAAsB,SAAS,kCAAkC;AAChF,QAAI,OAAO,eAAe,OAAO,YAAY;AAC3C,aAAO,IAAI,2BAA2B,OAAO,aAAa,OAAO,UAAU;AAAA,IAC7E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,iCAAiC,CAAC,SAAS,8BAA8B;AACrF,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,IAAI;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AACF;AAEA,SAAS,oBAAoB,UAA4B;AACvD,MAAI,SAAS,4BAA4B;AACvC,WAAO,SAAS,2BAA2B,QAAQ,QAAQ,EAAE;AAAA,EAC/D;AACA,MAAI,CAAC,SAAS,+BAA+B;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,WAAW,SAAS,6BAA6B;AAC1D;AAEA,SAAS,sBAAsB,OAAuC;AACpE,SAAO,OAAO;AAAA,IACZ,MACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO,EACd,IAAI,CAAC,SAAS;AACb,YAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,aAAO,UAAU,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,IACjF,CAAC;AAAA,EACL;AACF;AAEA,SAAS,iBAAiB,UAAoC;AAC5D,QAAM,UAA0B;AAAA,IAC9B,GAAI,SAAS,4BACT,EAAE,WAAW,SAAS,0BAA0B,IAChD,CAAC;AAAA,IACL,GAAI,SAAS,8BACT,EAAE,aAAa,SAAS,4BAA4B,IACpD,CAAC;AAAA,IACL,GAAI,SAAS,8BACT,EAAE,aAAa,SAAS,4BAA4B,IACpD,CAAC;AAAA,EACP;AACA,MAAI,SAAS,iCAAiC;AAC5C,YAAQ,cAAc,oBAAoB,SAAS,+BAA+B;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAqC;AAChE,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwD;AAClF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,eACP,OACoC;AACpC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EAAE;AAAA,MACpB,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,IAC5D;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,MAA6C;AAC1E,SAAO,WAAW;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,qBAAqB,UAA2D;AAC7F,MAAI,CAAC,SAAS,oBAAoB;AAChC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,SAAS,oBAEhC;AACD,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,WAAW,OAIL;AACb,SAAO;AAAA,IACL,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IAClF,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AACF;AAEO,SAAS,eAAe,OAAmB,aAA6B;AAC7E,SAAO,QAAQ,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC5E;","names":[]}

package/package.json

@@ -1,8 +1,17 @@
 {
   "name": "@opengeni/storage",
-  "version": "0.2.7",
-  "type": "module",
+  "version": "0.2.9",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
+    "directory": "packages/storage"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -12,17 +21,13 @@
       "import": "./dist/index.js"
     }
   },
-  "files": [
-    "dist",
-    "src"
-  ],
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "scripts": {
     "build": "tsup",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo --noEmit",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
@@ -30,12 +35,7 @@
     "@aws-sdk/s3-request-presigner": "^3.1044.0",
     "@azure/storage-blob": "^12.29.1",
     "@google-cloud/storage": "^7.19.0",
-    "@opengeni/config": "^0.3.0",
-    "@opengeni/contracts": "^0.9.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
-    "directory": "packages/storage"
+    "@opengeni/config": "^0.5.0",
+    "@opengeni/contracts": "^0.10.0"
   }
 }

package/src/index.ts

@@ -3,13 +3,13 @@ import type { FileAsset } from "@opengeni/contracts";
 import {
   BlobSASPermissions,
   BlobServiceClient,
-  BlockBlobClient,
   generateBlobSASQueryParameters,
   StorageSharedKeyCredential,
   type BlobDownloadResponseParsed,
   type BlobGetPropertiesResponse,
 } from "@azure/storage-blob";
 import {
+  DeleteObjectCommand,
   GetObjectCommand,
   HeadObjectCommand,
   PutObjectCommand,
@@ -17,7 +17,11 @@ import {
   type S3ClientConfig,
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { Storage as GcsClient, type GetSignedUrlConfig, type StorageOptions } from "@google-cloud/storage";
+import {
+  Storage as GcsClient,
+  type GetSignedUrlConfig,
+  type StorageOptions,
+} from "@google-cloud/storage";
 
 export const MAX_SINGLE_PUT_SIZE_BYTES = 5_000_000_000;
 export const UPLOAD_URL_TTL_SECONDS = 15 * 60;
@@ -33,10 +37,20 @@ export type ObjectStorage = {
   bucket: string;
   backend: "s3-compatible" | "aws-s3" | "azure-blob" | "gcs";
   maxSinglePutSizeBytes: number;
-  createPutUrl: (args: { key: string; contentType: string; sha256?: string | null; expiresInSeconds?: number }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;
-  createGetUrl: (args: { key: string; expiresInSeconds?: number }) => Promise<{ url: string; expiresAt: Date }>;
+  createPutUrl: (args: {
+    key: string;
+    contentType: string;
+    sha256?: string | null;
+    expiresInSeconds?: number;
+  }) => Promise<{ url: string; requiredHeaders: Record<string, string>; expiresAt: Date }>;
+  createGetUrl: (args: {
+    key: string;
+    expiresInSeconds?: number;
+  }) => Promise<{ url: string; expiresAt: Date }>;
   headFile: (file: FileAsset) => Promise<ObjectHead>;
   getFileBytes: (file: FileAsset) => Promise<Uint8Array>;
+  /** Fetch an object by raw storage key (not a tracked FileAsset). Returns null on 404/missing. */
+  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array; contentType?: string } | null>;
   /**
    * SERVER-SIDE authenticated direct PUT (no presign + browser fetch). For an
    * in-process upload from a trusted holder of the storage credentials (e.g. the
@@ -46,7 +60,21 @@ export type ObjectStorage = {
    * public `objectStorageEndpoint` with no in-cluster route) would otherwise 401.
    * Browser uploads keep using `createPutUrl`; this is the trusted-server twin.
    */
-  putObject: (args: { key: string; contentType: string; body: Uint8Array; sha256?: string | null }) => Promise<void>;
+  putObject: (args: {
+    key: string;
+    contentType: string;
+    body: Uint8Array;
+    sha256?: string | null;
+  }) => Promise<void>;
+  /**
+   * SERVER-SIDE authenticated delete of a single object by raw storage key.
+   * Idempotent: a missing key is a no-op (S3/GCS/Azure delete-by-key does not
+   * 404 on absent objects, or the 404 is swallowed). Used by the Workbench v2
+   * capture GC (dossier §10.1 keep-latest-10) to reap after-image blobs that no
+   * surviving revision references. Best-effort at the call site — a failed
+   * delete leaves an orphan blob, never corrupts a live capture.
+   */
+  deleteObject: (key: string) => Promise<void>;
 };
 
 export function createObjectStorage(settings: Settings): ObjectStorage | null {
@@ -60,7 +88,12 @@ export function createObjectStorage(settings: Settings): ObjectStorage | null {
 }
 
 function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | null {
-  if (settings.objectStorageBackend === "s3-compatible" && (!settings.objectStorageEndpoint || !settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)) {
+  if (
+    settings.objectStorageBackend === "s3-compatible" &&
+    (!settings.objectStorageEndpoint ||
+      !settings.objectStorageAccessKeyId ||
+      !settings.objectStorageSecretAccessKey)
+  ) {
     return null;
   }
   const clientConfig: S3ClientConfig = {
@@ -68,10 +101,14 @@ function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | nu
     forcePathStyle: settings.objectStorageForcePathStyle,
     requestChecksumCalculation: "WHEN_REQUIRED",
     ...(settings.objectStorageEndpoint ? { endpoint: settings.objectStorageEndpoint } : {}),
-    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey ? { credentials: {
-      accessKeyId: settings.objectStorageAccessKeyId,
-      secretAccessKey: settings.objectStorageSecretAccessKey,
-    } } : {}),
+    ...(settings.objectStorageAccessKeyId && settings.objectStorageSecretAccessKey
+      ? {
+          credentials: {
+            accessKeyId: settings.objectStorageAccessKeyId,
+            secretAccessKey: settings.objectStorageSecretAccessKey,
+          },
+        }
+      : {}),
   };
   const client = new S3Client(clientConfig);
   return {
@@ -98,10 +135,14 @@ function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | nu
     async createGetUrl(args) {
       const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
       return {
-        url: await getSignedUrl(client, new GetObjectCommand({
-          Bucket: settings.objectStorageBucket,
-          Key: args.key,
-        }), { expiresIn }),
+        url: await getSignedUrl(
+          client,
+          new GetObjectCommand({
+            Bucket: settings.objectStorageBucket,
+            Key: args.key,
+          }),
+          { expiresIn },
+        ),
         expiresAt: new Date(Date.now() + expiresIn * 1000),
       };
     },
@@ -110,19 +151,23 @@ function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | nu
       // A presigned URL buys nothing here — the worker already holds the creds — and
       // on a split public/internal endpoint topology the presigned URL points at the
       // PUBLIC host (no MinIO route → 401). This sends bytes straight to the backend.
-      await client.send(new PutObjectCommand({
-        Bucket: settings.objectStorageBucket,
-        Key: args.key,
-        ContentType: args.contentType,
-        Body: args.body,
-        Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,
-      }));
+      await client.send(
+        new PutObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: args.key,
+          ContentType: args.contentType,
+          Body: args.body,
+          Metadata: args.sha256 ? { sha256: args.sha256 } : undefined,
+        }),
+      );
     },
     async headFile(file) {
-      const head = await client.send(new HeadObjectCommand({
-        Bucket: file.bucket,
-        Key: file.objectKey,
-      }));
+      const head = await client.send(
+        new HeadObjectCommand({
+          Bucket: file.bucket,
+          Key: file.objectKey,
+        }),
+      );
       return objectHead({
         contentLength: head.ContentLength,
         contentType: head.ContentType,
@@ -130,25 +175,73 @@ function createS3CompatibleObjectStorage(settings: Settings): ObjectStorage | nu
       });
     },
     async getFileBytes(file) {
-      const result = await client.send(new GetObjectCommand({
-        Bucket: file.bucket,
-        Key: file.objectKey,
-      }));
-      if (!result.Body) {
-        throw new Error(`Object body is empty: ${file.objectKey}`);
-      }
-      if (typeof result.Body.transformToByteArray === "function") {
-        return await result.Body.transformToByteArray();
-      }
-      const chunks: Uint8Array[] = [];
-      for await (const chunk of result.Body as AsyncIterable<Uint8Array | Buffer | string>) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      const result = await client.send(
+        new GetObjectCommand({
+          Bucket: file.bucket,
+          Key: file.objectKey,
+        }),
+      );
+      return await s3BodyToBytes(result.Body, file.objectKey);
+    },
+    async getObjectBytes(key) {
+      try {
+        const result = await client.send(
+          new GetObjectCommand({
+            Bucket: settings.objectStorageBucket,
+            Key: key,
+          }),
+        );
+        const bytes = await s3BodyToBytes(result.Body, key);
+        return { bytes, ...(result.ContentType ? { contentType: result.ContentType } : {}) };
+      } catch (error) {
+        if (isS3NotFound(error)) {
+          return null;
+        }
+        throw error;
       }
-      return Buffer.concat(chunks);
+    },
+    async deleteObject(key) {
+      // S3 DeleteObject is idempotent — deleting an absent key returns 204.
+      await client.send(
+        new DeleteObjectCommand({
+          Bucket: settings.objectStorageBucket,
+          Key: key,
+        }),
+      );
     },
   };
 }
 
+async function s3BodyToBytes(body: unknown, objectKey: string): Promise<Uint8Array> {
+  if (!body) {
+    throw new Error(`Object body is empty: ${objectKey}`);
+  }
+  const withTransform = body as { transformToByteArray?: () => Promise<Uint8Array> };
+  if (typeof withTransform.transformToByteArray === "function") {
+    return await withTransform.transformToByteArray();
+  }
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of body as AsyncIterable<Uint8Array | Buffer | string>) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+function isS3NotFound(error: unknown): boolean {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const name = "name" in error ? (error as { name?: unknown }).name : undefined;
+  if (name === "NoSuchKey" || name === "NotFound") {
+    return true;
+  }
+  const metadata =
+    "$metadata" in error
+      ? (error as { $metadata?: { httpStatusCode?: number } }).$metadata
+      : undefined;
+  return metadata?.httpStatusCode === 404;
+}
+
 function createGcsObjectStorage(settings: Settings): ObjectStorage {
   const client = new GcsClient(gcsClientOptions(settings));
   const bucket = client.bucket(settings.objectStorageBucket);
@@ -207,9 +300,28 @@ function createGcsObjectStorage(settings: Settings): ObjectStorage {
       const [bytes] = await bucket.file(file.objectKey).download();
       return bytes;
     },
+    async getObjectBytes(key) {
+      try {
+        const [bytes] = await bucket.file(key).download();
+        return { bytes };
+      } catch (error) {
+        if (isGcsNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    async deleteObject(key) {
+      // ignoreNotFound keeps the delete idempotent (a missing blob is a no-op).
+      await bucket.file(key).delete({ ignoreNotFound: true });
+    },
   };
 }
 
+function isGcsNotFound(error: unknown): boolean {
+  return Boolean(error) && typeof error === "object" && (error as { code?: unknown }).code === 404;
+}
+
 function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null {
   const sharedKey = azureSharedKeyCredential(settings);
   const serviceClient = settings.objectStorageAzureConnectionString
@@ -225,13 +337,16 @@ function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null
       const expiresIn = args.expiresInSeconds ?? UPLOAD_URL_TTL_SECONDS;
       const expiresAt = new Date(Date.now() + expiresIn * 1000);
       const blobClient = containerClient.getBlockBlobClient(args.key);
-      const sas = generateBlobSASQueryParameters({
-        containerName: settings.objectStorageBucket,
-        blobName: args.key,
-        permissions: BlobSASPermissions.parse("cw"),
-        expiresOn: expiresAt,
-        contentType: args.contentType,
-      }, sharedKey).toString();
+      const sas = generateBlobSASQueryParameters(
+        {
+          containerName: settings.objectStorageBucket,
+          blobName: args.key,
+          permissions: BlobSASPermissions.parse("cw"),
+          expiresOn: expiresAt,
+          contentType: args.contentType,
+        },
+        sharedKey,
+      ).toString();
       return {
         url: `${blobClient.url}?${sas}`,
         requiredHeaders: {
@@ -246,12 +361,15 @@ function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null
       const expiresIn = args.expiresInSeconds ?? DOWNLOAD_URL_TTL_SECONDS;
       const expiresAt = new Date(Date.now() + expiresIn * 1000);
       const blobClient = containerClient.getBlobClient(args.key);
-      const sas = generateBlobSASQueryParameters({
-        containerName: settings.objectStorageBucket,
-        blobName: args.key,
-        permissions: BlobSASPermissions.parse("r"),
-        expiresOn: expiresAt,
-      }, sharedKey).toString();
+      const sas = generateBlobSASQueryParameters(
+        {
+          containerName: settings.objectStorageBucket,
+          blobName: args.key,
+          permissions: BlobSASPermissions.parse("r"),
+          expiresOn: expiresAt,
+        },
+        sharedKey,
+      ).toString();
       return {
         url: `${blobClient.url}?${sas}`,
         expiresAt,
@@ -267,26 +385,59 @@ function createAzureBlobObjectStorage(settings: Settings): ObjectStorage | null
       });
     },
     async headFile(file) {
-      return azureHeadToObjectHead(await containerClient.getBlobClient(file.objectKey).getProperties());
+      return azureHeadToObjectHead(
+        await containerClient.getBlobClient(file.objectKey).getProperties(),
+      );
     },
     async getFileBytes(file) {
-      return await azureDownloadToBytes(await containerClient.getBlobClient(file.objectKey).download());
+      return await azureDownloadToBytes(
+        await containerClient.getBlobClient(file.objectKey).download(),
+      );
+    },
+    async getObjectBytes(key) {
+      try {
+        const download = await containerClient.getBlobClient(key).download();
+        const bytes = await azureDownloadToBytes(download);
+        return { bytes, ...(download.contentType ? { contentType: download.contentType } : {}) };
+      } catch (error) {
+        if (isAzureNotFound(error)) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    async deleteObject(key) {
+      // deleteIfExists keeps the delete idempotent (a missing blob is a no-op).
+      await containerClient.getBlockBlobClient(key).deleteIfExists();
     },
   };
 }
 
+function isAzureNotFound(error: unknown): boolean {
+  return (
+    Boolean(error) &&
+    typeof error === "object" &&
+    (error as { statusCode?: unknown }).statusCode === 404
+  );
+}
+
 function azureSharedKeyCredential(settings: Settings): StorageSharedKeyCredential {
   if (settings.objectStorageAzureConnectionString) {
     const parsed = parseConnectionString(settings.objectStorageAzureConnectionString);
     if (parsed.AccountName && parsed.AccountKey) {
       return new StorageSharedKeyCredential(parsed.AccountName, parsed.AccountKey);
     }
-    throw new Error("Azure Blob connection string must include AccountName and AccountKey to create presigned URLs");
+    throw new Error(
+      "Azure Blob connection string must include AccountName and AccountKey to create presigned URLs",
+    );
   }
   if (!settings.objectStorageAzureAccountName || !settings.objectStorageAzureAccountKey) {
     throw new Error("Azure Blob storage requires account name and account key");
   }
-  return new StorageSharedKeyCredential(settings.objectStorageAzureAccountName, settings.objectStorageAzureAccountKey);
+  return new StorageSharedKeyCredential(
+    settings.objectStorageAzureAccountName,
+    settings.objectStorageAzureAccountKey,
+  );
 }
 
 function azureBlobServiceUrl(settings: Settings): string {
@@ -300,20 +451,29 @@ function azureBlobServiceUrl(settings: Settings): string {
 }
 
 function parseConnectionString(value: string): Record<string, string> {
-  return Object.fromEntries(value.split(";")
-    .map((part) => part.trim())
-    .filter(Boolean)
-    .map((part) => {
-      const index = part.indexOf("=");
-      return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
-    }));
+  return Object.fromEntries(
+    value
+      .split(";")
+      .map((part) => part.trim())
+      .filter(Boolean)
+      .map((part) => {
+        const index = part.indexOf("=");
+        return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
+      }),
+  );
 }
 
 function gcsClientOptions(settings: Settings): StorageOptions {
   const options: StorageOptions = {
-    ...(settings.objectStorageGcsProjectId ? { projectId: settings.objectStorageGcsProjectId } : {}),
-    ...(settings.objectStorageGcsKeyFilename ? { keyFilename: settings.objectStorageGcsKeyFilename } : {}),
-    ...(settings.objectStorageGcsApiEndpoint ? { apiEndpoint: settings.objectStorageGcsApiEndpoint } : {}),
+    ...(settings.objectStorageGcsProjectId
+      ? { projectId: settings.objectStorageGcsProjectId }
+      : {}),
+    ...(settings.objectStorageGcsKeyFilename
+      ? { keyFilename: settings.objectStorageGcsKeyFilename }
+      : {}),
+    ...(settings.objectStorageGcsApiEndpoint
+      ? { apiEndpoint: settings.objectStorageGcsApiEndpoint }
+      : {}),
   };
   if (settings.objectStorageGcsCredentialsJson) {
     options.credentials = parseGcsCredentials(settings.objectStorageGcsCredentialsJson);
@@ -340,13 +500,16 @@ function parseContentLength(value: string | number | undefined): number | undefi
   return Number.isFinite(parsed) ? parsed : undefined;
 }
 
-function stringMetadata(value: Record<string, string | number | boolean | null> | undefined): Record<string, string> | undefined {
+function stringMetadata(
+  value: Record<string, string | number | boolean | null> | undefined,
+): Record<string, string> | undefined {
   if (!value) {
     return undefined;
   }
   return Object.fromEntries(
-    Object.entries(value)
-      .filter((entry): entry is [string, string] => typeof entry[1] === "string"),
+    Object.entries(value).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
   );
 }
 
@@ -363,7 +526,9 @@ async function azureDownloadToBytes(download: BlobDownloadResponseParsed): Promi
     throw new Error("Azure Blob download response did not include a readable body");
   }
   const chunks: Uint8Array[] = [];
-  for await (const chunk of download.readableStreamBody as AsyncIterable<Uint8Array | Buffer | string>) {
+  for await (const chunk of download.readableStreamBody as AsyncIterable<
+    Uint8Array | Buffer | string
+  >) {
     chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
   }
   return Buffer.concat(chunks);