@rebasepro/server 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/storage/routes.d.ts

@@ -10,20 +10,35 @@ import { Hono } from "hono";
 import { StorageController, type StorageAuthorize, type StorageAuthorizeData } from "./types.js";
 import { type StorageRegistry } from "./storage-registry.js";
 import { type StorageSourceDefinition, type AuthAdapter } from "@rebasepro/types";
-import { type ResolveUploadConstraints } from "./property-limits.js";
+import { type ResolveUploadConstraints, type ResolveUploadPathConstraints } from "./property-limits.js";
 import { HonoEnv } from "../api/types.js";
 import { type StorageTrigger } from "./triggers.js";
 import { type RenditionCacheConfig } from "./rendition-cache.js";
+/**
+ * The policy every SVG response carries.
+ *
+ * An SVG embedded with `<img>` never runs script. Opened directly — a link, a
+ * new tab, an `<iframe>` — it is a document on the API origin, and its
+ * `<script>` would run there, next to the refresh cookie. `sandbox` gives that
+ * document an opaque origin with scripts disabled, and `default-src 'none'`
+ * stops it loading anything; `style-src 'unsafe-inline'` keeps the inline
+ * styles most SVGs are drawn with. It is what GitHub serves user content
+ * under. Serving SVG as a download instead made every SVG logo a broken
+ * thumbnail in the panel.
+ */
+export declare const SVG_CONTENT_SECURITY_POLICY = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
 /**
  * Decide what to actually serve for a stored content type.
  *
- * Returns the type to send and whether to force a download. The check is an
+ * Returns the type to send, whether to force a download, and the
+ * `Content-Security-Policy` the response must carry, if any. The check is an
  * allowlist rather than a blocklist of dangerous types: the set of types a
  * browser will execute grows, and the set we want to render inline does not.
  */
 export declare function resolveServedContentType(storedContentType: string): {
     contentType: string;
     attachment: boolean;
+    contentSecurityPolicy?: string;
 };
 export interface StorageRoutesConfig {
     /**
@@ -73,6 +88,13 @@ export interface StorageRoutesConfig {
      * to the global cap exactly as before.
      */
     uploadConstraints?: ResolveUploadConstraints;
+    /**
+     * The limits of the properties whose `storagePath` an upload's key falls
+     * in, by source and key — see `createUploadPathResolver`. Applied to every
+     * upload, whether or not it names a property, so a property's limits hold
+     * for every file written where its files go.
+     */
+    uploadPathConstraints?: ResolveUploadPathConstraints;
     /**
      * When provided, storage routes delegate auth to this adapter instead
      * of the built-in JWT module. This mirrors how data routes use
@@ -105,25 +127,41 @@ export interface StorageRoutesConfig {
      * Run something when an object lands, or when one goes. See `triggers.ts`.
      */
     triggers?: StorageTrigger[];
+    /**
+     * How long the download token `/metadata` mints for a private object stays
+     * valid, in seconds. {@link DEFAULT_DOWNLOAD_TOKEN_TTL_SECONDS} unless set;
+     * at most {@link MAX_DOWNLOAD_TOKEN_TTL_SECONDS}.
+     */
+    downloadTokenTtlSeconds?: number;
 }
+/** Five minutes: long enough to render a page of thumbnails, short enough to be worthless in a log. */
+export declare const DEFAULT_DOWNLOAD_TOKEN_TTL_SECONDS = 300;
 /**
- * Extract the wildcard portion of a route path from the full request path.
- *
- * Hono's `c.req.param('*')` does not work reliably in sub-routers mounted
- * via `app.route(prefix, subRouter)`. Instead we derive the wildcard value
- * from the fully-resolved `c.req.path` and `c.req.routePath`.
+ * A week. The token travels in a URL — into access logs, Referer headers and
+ * browser history — so a lifetime past this is a permanent link to a private
+ * file. A file that must be linked forever belongs under the public prefix.
+ */
+export declare const MAX_DOWNLOAD_TOKEN_TTL_SECONDS: number;
+/** Most keys `POST /metadata` takes in one request. */
+export declare const DOWNLOAD_METADATA_BATCH_MAX = 100;
+/**
+ * What a storage request costs against the data rate limit: one, except a
+ * `POST /metadata` of N keys, which costs ⌈N/10⌉.
  *
- * For a route `/metadata/*` mounted at `/api/storage`, a request to
- * `/api/storage/metadata/default/file.jpg` yields routePath
- * `/api/storage/metadata/*`.  We strip the prefix (everything before `/*`)
- * plus one character for the trailing `/` to obtain `default/file.jpg`.
+ * One request per key let a page of thumbnails spend a hundred requests of a
+ * caller's allowance; one per batch would make a batch of a hundred keys a
+ * hundred times cheaper to scrape with than the route it replaces. A tenth
+ * keeps a budget against enumeration while a page of thumbnails costs ten.
+ * Read before the route runs (the limiter is ahead of it); the body is parsed
+ * once, and the route reads Hono's cached copy.
  */
-export declare function extractWildcardPath(c: {
+export declare function storageRateLimitCost(c: {
     req: {
+        method: string;
         path: string;
-        routePath: string;
+        json(): Promise<unknown>;
     };
-}): string;
+}): Promise<number>;
 /**
  * Create storage REST API routes
  */

package/dist/storage/source-variables.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The variable that binds a declared object-store source's bucket on a
+ * deployment — `S3_BUCKET__MEDIA`, `GCS_BUCKET__ARCHIVE`, `S3_BUCKET` for the
+ * default source.
+ *
+ * One spelling for the three places that tell an operator to set it: the boot
+ * warning, the 501 a request to the unbound source answers, and `rebase
+ * status`. The 501 used to say "the media suffixed environment variables".
+ */
+export declare function storageBucketVariable(key: string, engine: string | undefined): string;

package/dist/storage/streams.d.ts

@@ -0,0 +1,42 @@
+/** Anything that hands over bytes a chunk at a time: a Node readable, an SDK body. */
+type ByteSource = AsyncIterable<Uint8Array>;
+/**
+ * A byte source as a web stream that reads a chunk only when the consumer asks
+ * for one, and releases the source when the consumer stops early.
+ *
+ * Pull-based with a zero high-water mark, so nothing is read ahead of the
+ * reader: a slow client holds one chunk, not a queue of them. A source given
+ * as a function is opened on the first read, which keeps a stream nobody reads
+ * — a `HEAD`, a 304 decided late — from holding a file descriptor or a
+ * connection open. Cancelling (a client that disconnects mid-download)
+ * returns the iterator, which destroys a Node stream and so closes its file or
+ * socket.
+ */
+export declare function webStreamFrom(source: ByteSource | (() => ByteSource)): ReadableStream<Uint8Array>;
+/**
+ * A file on disk, or an inclusive byte range of it, as a web stream. The file
+ * is opened on the first read; see {@link webStreamFrom}.
+ */
+export declare function fileWebStream(filePath: string, range?: {
+    start: number;
+    end: number;
+}): ReadableStream<Uint8Array>;
+/** A buffer already in memory as a web stream of views onto it, never copies. */
+export declare function bufferWebStream(bytes: Uint8Array, chunkSize?: number): ReadableStream<Uint8Array>;
+/**
+ * Read a stream into one buffer.
+ *
+ * For the one consumer that needs the whole object at once — an image decode.
+ * With the size known the bytes are copied once, into a buffer of that size,
+ * rather than collected and then concatenated (which holds them twice); a
+ * stream that turns out longer or shorter than announced still comes back
+ * whole and exact.
+ */
+export declare function readStreamFully(stream: ReadableStream<Uint8Array>, expectedSize?: number): Promise<Buffer>;
+/**
+ * The bytes of a buffer as a `Uint8Array` the response APIs accept, without
+ * copying them. `new Uint8Array(buffer)` copies; a view does not. Only a buffer
+ * over shared memory — which nothing here produces — is copied.
+ */
+export declare function bytesView(bytes: Uint8Array): Uint8Array<ArrayBuffer>;
+export {};

package/dist/storage/tus-handler.d.ts

@@ -10,13 +10,29 @@
 import type { Context } from "hono";
 import type { StorageController } from "./types.js";
 import { type StorageRegistry } from "./storage-registry.js";
-import { type ResolveUploadConstraints } from "./property-limits.js";
+import { type ResolveUploadConstraints, type ResolveUploadPathConstraints } from "./property-limits.js";
+/**
+ * The header a resumable upload's last `PATCH` answers with the stored object
+ * in — `{ key, bucket, storageUrl }`, the `data` of `POST /upload`, as
+ * URI-encoded JSON — so a client gets from the resumable path what it gets
+ * from the multipart one. `create` answers it with `on-complete`, which tells
+ * a client this server will, before it sends a byte.
+ */
+export declare const UPLOAD_RESULT_HEADER = "Rebase-Upload-Result";
 /**
  * TUS resumable upload handler.
  *
  * Each instance manages uploads for a single storage root. The
  * `storageController` is used to finalize completed uploads by
  * calling `putObject`.
+ *
+ * An upload lives in the upload directory, not in this process: its bytes in
+ * `<id>`, and what `create` decided about it in `<id>.json` beside them. Its
+ * offset is the length of the bytes file. So a restart — a rolling deploy —
+ * resumes an upload where it stopped instead of sending the client back to
+ * byte 0, and every process that shares the directory (one volume at
+ * `STORAGE_PATH`) serves every upload. The map below only remembers records
+ * already read.
  */
 export declare class TusHandler {
     private storageController?;
@@ -65,6 +81,18 @@ export declare class TusHandler {
      * accept is refused before the first chunk rather than after the last.
      */
     private uploadConstraints?;
+    /**
+     * The limits of the properties whose storage path the upload's key
+     * falls in — checked whether or not the upload names a property, as
+     * `POST /upload` checks them.
+     */
+    private uploadPathConstraints?;
+    /**
+     * Upload records this process has read or written, by id. A cache of the
+     * `<id>.json` files: it never holds the offset (the bytes file's length
+     * does), and an upload another process finished or cancelled is noticed
+     * when its bytes file is gone.
+     */
     private uploads;
     private tusDir;
     private cleanupTimer?;
@@ -123,21 +151,50 @@ export declare class TusHandler {
      * and the metadata's content type, so a file the property will not
      * accept is refused before the first chunk rather than after the last.
      */
-    uploadConstraints?: ResolveUploadConstraints | undefined);
+    uploadConstraints?: ResolveUploadConstraints | undefined, 
+    /**
+     * The limits of the properties whose storage path the upload's key
+     * falls in — checked whether or not the upload names a property, as
+     * `POST /upload` checks them.
+     */
+    uploadPathConstraints?: ResolveUploadPathConstraints | undefined);
     /** Ensure the temp directory exists. */
     private ensureDir;
     /** Start periodic cleanup of stale uploads. */
     startCleanup(): void;
-    /** Remove uploads that have been idle for longer than UPLOAD_EXPIRY_MS. */
+    /**
+     * Remove uploads created more than {@link UPLOAD_EXPIRY_MS} ago.
+     *
+     * From the directory rather than from this process's memory, so an upload
+     * a crashed or replaced process abandoned is collected too. A record is
+     * written once, at creation, so its file's mtime is when the upload began;
+     * a bytes file with no record (left by an earlier version) is judged by
+     * its own.
+     */
     private cleanupStale;
+    /** The upload's bytes and record, gone; from every process, since they are files. */
+    private forget;
     /**
      * Parse the `Upload-Metadata` header.
      *
      * Format: `key base64value,key2 base64value2`
      */
     private parseMetadata;
-    /** `OPTIONS /tus` — TUS capability discovery. */
-    options(): Response;
+    /** The controller an upload to this storage source is written to. */
+    private targetFor;
+    /**
+     * The largest upload this source takes: the source's own limit, under the
+     * deployment's and the protocol ceiling. One function for what `OPTIONS`
+     * advertises and what `create` enforces, which used to be 5 GB and 50 MB.
+     */
+    private limitFor;
+    /**
+     * `OPTIONS /tus` — TUS capability discovery.
+     *
+     * `Tus-Max-Size` is the limit `create` holds this source to, for the source
+     * named by `?storageId` (the default one otherwise).
+     */
+    options(c?: Context): Response;
     /** `POST /tus` — Create a new upload. */
     create(c: Context): Promise<Response>;
     /**
@@ -160,9 +217,21 @@ export declare class TusHandler {
      * the rest.
      */
     private ownedUpload;
+    /**
+     * The upload with this id: from this process's memory, or from its record
+     * in the upload directory — written by another process sharing it, or by
+     * this one before a restart. `null` when there is no such upload.
+     */
+    private lookup;
+    /**
+     * Bytes received so far: the length of the bytes file. `null` when it is
+     * gone — finished or cancelled by another process — and then this one
+     * forgets the upload too.
+     */
+    private offsetOf;
     /** `HEAD /tus/:id` — Query upload progress. */
-    head(c: Context, id: string): Response;
-    /** `PATCH /tus/:id` — Append data to an upload. */
+    head(c: Context, id: string): Promise<Response>;
+    /** `PATCH /tus/:id` — Write one chunk of an upload, at its offset. */
     patch(c: Context, id: string): Promise<Response>;
     /** `DELETE /tus/:id` — Cancel and remove an upload. */
     delete(c: Context, id: string): Promise<Response>;

package/dist/storage/types.d.ts

@@ -23,6 +23,14 @@ export interface LocalStorageConfig {
      * production, where an unbound object store stays unbound.
      */
     standsInFor?: string;
+    /**
+     * Set when nothing chose this backend: no `STORAGE_TYPE` and no declared
+     * engine, so local disk is only the default a source falls back to.
+     * Production drops a local backend either way. This only decides how that
+     * is reported: an implicit default being dropped means the project uses no
+     * storage, which is not a misconfiguration.
+     */
+    implicit?: boolean;
 }
 /**
  * S3-compatible storage configuration (works with AWS S3 and MinIO)
@@ -45,8 +53,6 @@ export interface S3StorageConfig {
     maxFileSize?: number;
     /** Allowed MIME types (if not set, all types allowed) */
     allowedMimeTypes?: string[];
-    /** URL expiration time in seconds for signed URLs (default: 3600) */
-    signedUrlExpiration?: number;
 }
 /**
  * Google Cloud Storage configuration (works with GCS and Firebase Storage)
@@ -69,8 +75,6 @@ export interface GCSStorageConfig {
     maxFileSize?: number;
     /** Allowed MIME types */
     allowedMimeTypes?: string[];
-    /** Signed URL expiration in seconds (default: 3600) */
-    signedUrlExpiration?: number;
 }
 /**
  * Storage configuration — local filesystem, S3-compatible, or Google Cloud Storage.
@@ -88,16 +92,40 @@ export interface GCSStorageConfig {
 export type BackendStorageConfig = LocalStorageConfig | S3StorageConfig | GCSStorageConfig;
 /** What a storage request is trying to do to an object. */
 export type { StorageOperation, StorageAuthorizeUser, StorageAuthorizeContext, StorageAuthorizeData, StorageAuthorize } from "@rebasepro/types";
+/**
+ * How the server writes an object. See {@link StorageController.putObject}.
+ */
+export interface PutObjectOptions {
+    /**
+     * Hold this write to the controller's upload limits: `maxFileSize` and
+     * `allowedMimeTypes`. Defaults to `true`.
+     *
+     * Those limits say what a user may upload. A write the server makes for
+     * itself, such as a database backup, passes `false`. A dump is neither of
+     * an allowed type nor, past a small database, under 50 MB. The upload
+     * routes never pass it.
+     */
+    uploadLimits?: boolean;
+}
 /**
  * Storage controller interface for backend implementations
  */
 export interface StorageController {
     /**
-     * Upload an object
+     * Upload an object.
+     *
+     * A write is held to the controller's upload limits — `maxFileSize` and
+     * `allowedMimeTypes` — unless `options.uploadLimits` is `false`. Only the
+     * server's own writes pass that; nothing a request sends reaches it.
      */
-    putObject(props: UploadFileProps): Promise<UploadFileResult>;
+    putObject(props: UploadFileProps, options?: PutObjectOptions): Promise<UploadFileResult>;
     /**
-     * Get a download URL (signed URL equivalent) for an object
+     * Get a download URL (signed URL equivalent) for an object.
+     *
+     * For server-side code only: no route hands this URL to a client. A
+     * client reads a private object through `/file/*` with the download
+     * token `GET /metadata/*` mints. The built-in S3 and GCS controllers sign
+     * it for an hour.
      */
     getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig>;
     /**
@@ -120,6 +148,29 @@ export interface StorageController {
      * Get object as a File
      */
     getObject(key: string, bucket?: string): Promise<File | null>;
+    /**
+     * Describe an object for serving it — its size, stored type and version —
+     * without reading its bytes, or `null` when there is no such object.
+     *
+     * Optional, together with {@link getObjectStream}. A controller that has
+     * both is served streamed: `GET /file/*` answers a `304`, a `416`, a `HEAD`
+     * and a cached image rendition from this alone, and otherwise reads only
+     * the bytes it sends — the requested range, a chunk at a time. One without
+     * them is served through {@link getObject}, which holds the whole object in
+     * memory for every request, a `Range` request for one megabyte included.
+     */
+    statObject?(key: string, bucket?: string): Promise<StoredObjectInfo | null>;
+    /**
+     * Read an object, or one byte range of it, as a stream, or `null` when
+     * there is no such object. See {@link statObject}.
+     *
+     * The stream holds a file or a connection until it is read to the end or
+     * cancelled, so a caller that decides not to read it must cancel it.
+     */
+    getObjectStream?(key: string, options?: {
+        bucket?: string;
+        range?: StoredObjectRange;
+    }): Promise<StoredObjectStream | null>;
     /**
      * Delete an object
      */
@@ -159,6 +210,49 @@ export interface StorageController {
      * when the caller names none, and each provider maps it to its own.
      */
     knownBuckets?(): string[];
+    /**
+     * The largest file this controller accepts, in bytes.
+     *
+     * Every door that takes a file reads it, so the number a client is told is
+     * the number it is held to: the upload route checks it before anything is
+     * stored, the resumable route checks it at creation — before the first
+     * chunk rather than after the last — and advertises it as `Tus-Max-Size`,
+     * and the server's upload body limit is the largest of them. A controller
+     * that does not implement this is held to the deployment-wide limit alone.
+     */
+    maxFileSize?(): number;
+}
+/**
+ * What serving an object needs to know before deciding whether to read it.
+ * See {@link StorageController.statObject}.
+ */
+export interface StoredObjectInfo {
+    /** The whole object's size in bytes. */
+    size: number;
+    /** The stored content type — the uploader's claim, not a sniffed one. */
+    contentType: string;
+    /**
+     * The object's own modification time, in milliseconds since the epoch.
+     * The routes build `ETag`, `Last-Modified` and the transform cache key from
+     * it, so it must be the object's version, not the time of the read.
+     */
+    lastModified: number;
+}
+/** An inclusive byte range, as `Range: bytes=start-end` names one. */
+export interface StoredObjectRange {
+    start: number;
+    end: number;
+}
+/** An object's bytes as a stream. See {@link StorageController.getObjectStream}. */
+export interface StoredObjectStream extends StoredObjectInfo {
+    /** The bytes: the range when {@link range} is set, the whole object otherwise. */
+    stream: ReadableStream<Uint8Array>;
+    /**
+     * The range {@link stream} holds — the one asked for — or absent when it
+     * holds the whole object. A controller may answer a range with the whole
+     * object, as HTTP lets a server do; the caller then serves it whole.
+     */
+    range?: StoredObjectRange;
 }
 /**
  * Default maximum file size (50MB)

package/dist/storage/upload-validation.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What every storage controller checks about a file before it stores it: the
+ * source's own size cap and, when configured, its allowed content types.
+ *
+ * One function for the three controllers, which carried a copy each. Both
+ * refusals are `ApiError`s, so they reach the caller as what they are. A plain
+ * `Error` was a 500 "Internal Server Error" on `/upload` and a 502 on TUS —
+ * after the client had sent every byte.
+ */
+export declare function validateUploadedFile(file: {
+    size: number;
+    type: string;
+}, maxSize: number, allowedMimeTypes: string[] | undefined): void;

package/dist/storage-resumable-VO-cMpse-C_YX71pO.js

@@ -0,0 +1,125 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import "./resumable-upload-threshold-CKv-Ry0l.js";
+//#region ../common/src/util/resumable-upload.ts
+/** What `create` answers in `Rebase-Upload-Result` when the last `PATCH` will carry the stored object there. */
+var RESULT_ON_COMPLETE = "on-complete";
+var DEFAULT_RETRY_DELAYS_MS = [
+	250,
+	1e3,
+	3e3
+];
+/** `value` as UTF-8, base64-encoded — what `Upload-Metadata` carries. */
+function base64Utf8(value) {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/** Worth asking for the offset and sending again: an offset conflict, a lock, a rate limit, a server fault. */
+var isRetryable = (status) => status === 409 || status === 423 || status === 429 || status >= 500;
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The stored object a finished upload reports, or `null` when the header says nothing readable. */
+function storedObjectOf(header) {
+	if (!header) return null;
+	let value;
+	try {
+		value = JSON.parse(decodeURIComponent(header));
+	} catch {
+		return null;
+	}
+	if (typeof value !== "object" || value === null) return null;
+	const key = "key" in value ? value.key : void 0;
+	const bucket = "bucket" in value ? value.bucket : void 0;
+	const storageUrl = "storageUrl" in value ? value.storageUrl : void 0;
+	if (typeof key !== "string" || typeof bucket !== "string" || typeof storageUrl !== "string") return null;
+	return {
+		key,
+		bucket,
+		storageUrl
+	};
+}
+/**
+* Upload `file` through a Rebase server's TUS endpoint, one chunk at a time.
+*
+* The server holds every upload to what `POST /storage/upload` holds a file
+* to — the source's and the property's limits, the authorize hook, the bucket
+* — and stores it with the same key, type and custom metadata, and fires the
+* same triggers. So a refusal is thrown as the multipart route would have
+* thrown it. A chunk that fails on the way — a dropped connection, a 5xx, a
+* conflict over the offset — is retried from the offset the server reports.
+*
+* Answers `unavailable` when the resumable path cannot carry this file and
+* the multipart one can: a server without the endpoint (or one too old to
+* report the stored object), an upload another instance cannot see (several
+* instances, no shared volume, no sticky sessions), or a chunk over the
+* server's body limit.
+*/
+async function uploadResumable(options) {
+	const { file, send } = options;
+	const chunkSize = Math.max(1, options.chunkSize ?? 8388608);
+	const retryDelays = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+	const tus = { "Tus-Resumable": "1.0.0" };
+	const created = await send("POST", "", {
+		...tus,
+		"Upload-Length": String(file.size),
+		"Upload-Metadata": Object.entries(options.metadata).map(([name, value]) => `${name} ${base64Utf8(value)}`).join(",")
+	});
+	if (created.status === 404 || created.status === 405 || created.status === 501) return { unavailable: `the server has no resumable upload endpoint (${created.status})` };
+	if (created.status < 200 || created.status >= 300) throw created.error ?? /* @__PURE__ */ new Error(`The upload was refused (${created.status}).`);
+	const id = created.header("Location")?.split("?")[0].split("/").filter(Boolean).pop();
+	if (!id) return { unavailable: "the server did not say where the upload lives" };
+	const path = `/${encodeURIComponent(id)}`;
+	if (created.header("Rebase-Upload-Result") !== RESULT_ON_COMPLETE) {
+		await send("DELETE", path, tus).catch(() => void 0);
+		return { unavailable: "the server does not report the object a resumable upload stores" };
+	}
+	let offset = 0;
+	let lastFailure;
+	for (let attempt = 0;;) {
+		const end = Math.min(file.size, offset + chunkSize);
+		let response;
+		try {
+			response = await send("PATCH", path, {
+				...tus,
+				"Upload-Offset": String(offset),
+				"Content-Type": "application/offset+octet-stream"
+			}, file.slice(offset, end));
+		} catch (error) {
+			lastFailure = error instanceof Error ? error : new Error(String(error));
+		}
+		if (response && response.status >= 200 && response.status < 300) {
+			attempt = 0;
+			const reported = Number(response.header("Upload-Offset"));
+			offset = Number.isFinite(reported) && reported > offset ? reported : end;
+			if (offset < file.size) continue;
+			const stored = storedObjectOf(response.header("Rebase-Upload-Result"));
+			if (!stored) throw new Error("The upload finished, but the server did not say where it stored it.");
+			return { stored };
+		}
+		if (response?.status === 404) return { unavailable: "the server no longer knows this upload — another instance may have answered" };
+		if (response?.status === 413) {
+			await send("DELETE", path, tus).catch(() => void 0);
+			return { unavailable: "a chunk is over the server's request body limit" };
+		}
+		if (response && !isRetryable(response.status)) {
+			await send("DELETE", path, tus).catch(() => void 0);
+			throw response.error ?? /* @__PURE__ */ new Error(`The upload was refused (${response.status}).`);
+		}
+		if (response) lastFailure = response.error ?? /* @__PURE__ */ new Error(`The upload failed (${response.status}).`);
+		if (attempt >= retryDelays.length) throw lastFailure ?? /* @__PURE__ */ new Error("The upload failed.");
+		await sleep(retryDelays[attempt++]);
+		try {
+			const progress = await send("HEAD", path, tus);
+			if (progress.status === 404) return { unavailable: "the server no longer knows this upload — another instance may have answered" };
+			const held = Number(progress.header("Upload-Offset"));
+			if (progress.status >= 200 && progress.status < 300 && Number.isFinite(held)) offset = held;
+		} catch {}
+	}
+}
+//#endregion
+export { uploadResumable };
+
+//# sourceMappingURL=storage-resumable-VO-cMpse-C_YX71pO.js.map

package/dist/storage-resumable-VO-cMpse-C_YX71pO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-resumable-VO-cMpse-C_YX71pO.js","names":[],"sources":["../../common/src/util/resumable-upload.ts"],"sourcesContent":["import type { UploadFileResult } from \"@rebasepro/types\";\nimport { RESUMABLE_UPLOAD_THRESHOLD } from \"./resumable-upload-threshold\";\n\n/** One response, as the resumable upload reads it. */\nexport interface ResumableUploadResponse {\n    status: number;\n    header(name: string): string | null;\n    /** The error a non-2xx response stands for, as the transport reports it. */\n    error?: Error;\n}\n\n/**\n * Send one TUS request. `path` is `\"\"` for the creation request and\n * `/<upload id>` after it, relative to the source's `…/storage/tus` endpoint.\n * Answers every HTTP status; throws only when no response arrived.\n */\nexport type ResumableUploadSend = (\n    method: \"POST\" | \"PATCH\" | \"HEAD\" | \"DELETE\",\n    path: string,\n    headers: Record<string, string>,\n    body?: Blob\n) => Promise<ResumableUploadResponse>;\n\nexport interface ResumableUploadOptions {\n    file: Blob;\n    /** `Upload-Metadata` entries: `key`, `filename`, `filetype`, `bucket`, `storageId`, `collection`, `property`, `metadata_<name>`. */\n    metadata: Record<string, string>;\n    send: ResumableUploadSend;\n    /** Bytes per `PATCH`. Default {@link RESUMABLE_UPLOAD_THRESHOLD}. */\n    chunkSize?: number;\n    /** How long to wait before each retry of a chunk; its length is the number of retries. */\n    retryDelaysMs?: readonly number[];\n}\n\n/**\n * What a resumable upload came to: the stored object, or — for a reason the\n * multipart route does not share — nothing, and the caller sends the file\n * through `POST /storage/upload` instead.\n */\nexport type ResumableUploadOutcome =\n    | { stored: UploadFileResult }\n    | { unavailable: string };\n\n/** What `create` answers in `Rebase-Upload-Result` when the last `PATCH` will carry the stored object there. */\nconst RESULT_ON_COMPLETE = \"on-complete\";\nconst DEFAULT_RETRY_DELAYS_MS = [250, 1_000, 3_000];\n\n/** `value` as UTF-8, base64-encoded — what `Upload-Metadata` carries. */\nfunction base64Utf8(value: string): string {\n    const bytes = new TextEncoder().encode(value);\n    let binary = \"\";\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return btoa(binary);\n}\n\n/** Worth asking for the offset and sending again: an offset conflict, a lock, a rate limit, a server fault. */\nconst isRetryable = (status: number) => status === 409 || status === 423 || status === 429 || status >= 500;\n\nconst sleep = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms));\n\n/** The stored object a finished upload reports, or `null` when the header says nothing readable. */\nfunction storedObjectOf(header: string | null): UploadFileResult | null {\n    if (!header) return null;\n    let value: unknown;\n    try {\n        value = JSON.parse(decodeURIComponent(header));\n    } catch {\n        return null;\n    }\n    if (typeof value !== \"object\" || value === null) return null;\n    const key = \"key\" in value ? value.key : undefined;\n    const bucket = \"bucket\" in value ? value.bucket : undefined;\n    const storageUrl = \"storageUrl\" in value ? value.storageUrl : undefined;\n    if (typeof key !== \"string\" || typeof bucket !== \"string\" || typeof storageUrl !== \"string\") return null;\n    return { key, bucket, storageUrl };\n}\n\n/**\n * Upload `file` through a Rebase server's TUS endpoint, one chunk at a time.\n *\n * The server holds every upload to what `POST /storage/upload` holds a file\n * to — the source's and the property's limits, the authorize hook, the bucket\n * — and stores it with the same key, type and custom metadata, and fires the\n * same triggers. So a refusal is thrown as the multipart route would have\n * thrown it. A chunk that fails on the way — a dropped connection, a 5xx, a\n * conflict over the offset — is retried from the offset the server reports.\n *\n * Answers `unavailable` when the resumable path cannot carry this file and\n * the multipart one can: a server without the endpoint (or one too old to\n * report the stored object), an upload another instance cannot see (several\n * instances, no shared volume, no sticky sessions), or a chunk over the\n * server's body limit.\n */\nexport async function uploadResumable(options: ResumableUploadOptions): Promise<ResumableUploadOutcome> {\n    const { file, send } = options;\n    const chunkSize = Math.max(1, options.chunkSize ?? RESUMABLE_UPLOAD_THRESHOLD);\n    const retryDelays = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;\n    const tus = { \"Tus-Resumable\": \"1.0.0\" };\n\n    const created = await send(\"POST\", \"\", {\n        ...tus,\n        \"Upload-Length\": String(file.size),\n        \"Upload-Metadata\": Object.entries(options.metadata)\n            .map(([name, value]) => `${name} ${base64Utf8(value)}`)\n            .join(\",\")\n    });\n    if (created.status === 404 || created.status === 405 || created.status === 501) {\n        return { unavailable: `the server has no resumable upload endpoint (${created.status})` };\n    }\n    if (created.status < 200 || created.status >= 300) {\n        throw created.error ?? new Error(`The upload was refused (${created.status}).`);\n    }\n    const id = created.header(\"Location\")?.split(\"?\")[0].split(\"/\").filter(Boolean).pop();\n    if (!id) return { unavailable: \"the server did not say where the upload lives\" };\n    const path = `/${encodeURIComponent(id)}`;\n    if (created.header(\"Rebase-Upload-Result\") !== RESULT_ON_COMPLETE) {\n        await send(\"DELETE\", path, tus).catch(() => undefined);\n        return { unavailable: \"the server does not report the object a resumable upload stores\" };\n    }\n\n    let offset = 0;\n    let lastFailure: Error | undefined;\n    for (let attempt = 0; ;) {\n        const end = Math.min(file.size, offset + chunkSize);\n        let response: ResumableUploadResponse | undefined;\n        try {\n            response = await send(\"PATCH\", path, {\n                ...tus,\n                \"Upload-Offset\": String(offset),\n                \"Content-Type\": \"application/offset+octet-stream\"\n            }, file.slice(offset, end));\n        } catch (error: unknown) {\n            // No response: the connection dropped. Ask where the upload got to.\n            lastFailure = error instanceof Error ? error : new Error(String(error));\n        }\n\n        if (response && response.status >= 200 && response.status < 300) {\n            attempt = 0;\n            const reported = Number(response.header(\"Upload-Offset\"));\n            offset = Number.isFinite(reported) && reported > offset ? reported : end;\n            if (offset < file.size) continue;\n            const stored = storedObjectOf(response.header(\"Rebase-Upload-Result\"));\n            if (!stored) throw new Error(\"The upload finished, but the server did not say where it stored it.\");\n            return { stored };\n        }\n        if (response?.status === 404) {\n            return { unavailable: \"the server no longer knows this upload — another instance may have answered\" };\n        }\n        if (response?.status === 413) {\n            await send(\"DELETE\", path, tus).catch(() => undefined);\n            return { unavailable: \"a chunk is over the server's request body limit\" };\n        }\n        if (response && !isRetryable(response.status)) {\n            await send(\"DELETE\", path, tus).catch(() => undefined);\n            throw response.error ?? new Error(`The upload was refused (${response.status}).`);\n        }\n        if (response) lastFailure = response.error ?? new Error(`The upload failed (${response.status}).`);\n\n        if (attempt >= retryDelays.length) throw lastFailure ?? new Error(\"The upload failed.\");\n        await sleep(retryDelays[attempt++]);\n        // Resume from what the server holds, which may be more than was\n        // acknowledged (the chunk arrived, its answer did not) or less.\n        try {\n            const progress = await send(\"HEAD\", path, tus);\n            if (progress.status === 404) {\n                return { unavailable: \"the server no longer knows this upload — another instance may have answered\" };\n            }\n            const held = Number(progress.header(\"Upload-Offset\"));\n            if (progress.status >= 200 && progress.status < 300 && Number.isFinite(held)) offset = held;\n        } catch {\n            // Still no connection: the next attempt asks again.\n        }\n    }\n}\n"],"mappings":";;;;;;;AA4CA,IAAM,qBAAqB;AAC3B,IAAM,0BAA0B;CAAC;CAAK;CAAO;AAAK;;AAGlD,SAAS,WAAW,OAAuB;CACvC,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM;AACtB;;AAGA,IAAM,eAAe,WAAmB,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,UAAU;AAExG,IAAM,SAAS,OAAe,IAAI,SAAc,YAAW,WAAW,SAAS,EAAE,CAAC;;AAGlF,SAAS,eAAe,QAAgD;CACpE,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI;CACJ,IAAI;EACA,QAAQ,KAAK,MAAM,mBAAmB,MAAM,CAAC;CACjD,QAAQ;EACJ,OAAO;CACX;CACA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,MAAM,SAAS,QAAQ,MAAM,MAAM,KAAA;CACzC,MAAM,SAAS,YAAY,QAAQ,MAAM,SAAS,KAAA;CAClD,MAAM,aAAa,gBAAgB,QAAQ,MAAM,aAAa,KAAA;CAC9D,IAAI,OAAO,QAAQ,YAAY,OAAO,WAAW,YAAY,OAAO,eAAe,UAAU,OAAO;CACpG,OAAO;EAAE;EAAK;EAAQ;CAAW;AACrC;;;;;;;;;;;;;;;;;AAkBA,eAAsB,gBAAgB,SAAkE;CACpG,MAAM,EAAE,MAAM,SAAS;CACvB,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,aAAA,OAAuC;CAC7E,MAAM,cAAc,QAAQ,iBAAiB;CAC7C,MAAM,MAAM,EAAE,iBAAiB,QAAQ;CAEvC,MAAM,UAAU,MAAM,KAAK,QAAQ,IAAI;EACnC,GAAG;EACH,iBAAiB,OAAO,KAAK,IAAI;EACjC,mBAAmB,OAAO,QAAQ,QAAQ,QAAQ,CAAC,CAC9C,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC,CACtD,KAAK,GAAG;CACjB,CAAC;CACD,IAAI,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KACvE,OAAO,EAAE,aAAa,gDAAgD,QAAQ,OAAO,GAAG;CAE5F,IAAI,QAAQ,SAAS,OAAO,QAAQ,UAAU,KAC1C,MAAM,QAAQ,yBAAS,IAAI,MAAM,2BAA2B,QAAQ,OAAO,GAAG;CAElF,MAAM,KAAK,QAAQ,OAAO,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI;CACpF,IAAI,CAAC,IAAI,OAAO,EAAE,aAAa,gDAAgD;CAC/E,MAAM,OAAO,IAAI,mBAAmB,EAAE;CACtC,IAAI,QAAQ,OAAO,sBAAsB,MAAM,oBAAoB;EAC/D,MAAM,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;EACrD,OAAO,EAAE,aAAa,kEAAkE;CAC5F;CAEA,IAAI,SAAS;CACb,IAAI;CACJ,KAAK,IAAI,UAAU,KAAM;EACrB,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,SAAS,SAAS;EAClD,IAAI;EACJ,IAAI;GACA,WAAW,MAAM,KAAK,SAAS,MAAM;IACjC,GAAG;IACH,iBAAiB,OAAO,MAAM;IAC9B,gBAAgB;GACpB,GAAG,KAAK,MAAM,QAAQ,GAAG,CAAC;EAC9B,SAAS,OAAgB;GAErB,cAAc,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;EAC1E;EAEA,IAAI,YAAY,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;GAC7D,UAAU;GACV,MAAM,WAAW,OAAO,SAAS,OAAO,eAAe,CAAC;GACxD,SAAS,OAAO,SAAS,QAAQ,KAAK,WAAW,SAAS,WAAW;GACrE,IAAI,SAAS,KAAK,MAAM;GACxB,MAAM,SAAS,eAAe,SAAS,OAAO,sBAAsB,CAAC;GACrE,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,qEAAqE;GAClG,OAAO,EAAE,OAAO;EACpB;EACA,IAAI,UAAU,WAAW,KACrB,OAAO,EAAE,aAAa,8EAA8E;EAExG,IAAI,UAAU,WAAW,KAAK;GAC1B,MAAM,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;GACrD,OAAO,EAAE,aAAa,kDAAkD;EAC5E;EACA,IAAI,YAAY,CAAC,YAAY,SAAS,MAAM,GAAG;GAC3C,MAAM,KAAK,UAAU,MAAM,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;GACrD,MAAM,SAAS,yBAAS,IAAI,MAAM,2BAA2B,SAAS,OAAO,GAAG;EACpF;EACA,IAAI,UAAU,cAAc,SAAS,yBAAS,IAAI,MAAM,sBAAsB,SAAS,OAAO,GAAG;EAEjG,IAAI,WAAW,YAAY,QAAQ,MAAM,+BAAe,IAAI,MAAM,oBAAoB;EACtF,MAAM,MAAM,YAAY,UAAU;EAGlC,IAAI;GACA,MAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,GAAG;GAC7C,IAAI,SAAS,WAAW,KACpB,OAAO,EAAE,aAAa,8EAA8E;GAExG,MAAM,OAAO,OAAO,SAAS,OAAO,eAAe,CAAC;GACpD,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS,OAAO,OAAO,SAAS,IAAI,GAAG,SAAS;EAC3F,QAAQ,CAER;CACJ;AACJ"}