@ultimabase/files 0.3.0 → 0.4.0-canary.20261102132223

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @ultimabase/files
 
+## 0.4.0-canary.20261102132223
+
+### Minor Changes
+
+- 1d37bc8: `diskFiles({ dir, secret })` stores the files in a directory, for one server with a persistent volume, and `memoryFiles()` now gives real URLs: the application serves both at `GET /files/<key>`, a private file at a signed URL, sandboxed and never sniffed (D-202).
+
+### Patch Changes
+
+- 1d7fda8: `ultimabase` exports `QueryOptions`, the `{ as }` every query, model command
+  and `fn.run` take; auth, files and password use it instead of their own
+  copies.
+- 08e0dec: A private file's URL stays the same for 15 minutes: `s3()` signs it with the start of its 15-minute window and an expiry of 30 minutes, so a row read again, as a live read resends it, keeps its URLs (D-200).
+- Updated dependencies [8dca2cf]
+- Updated dependencies [9b491fb]
+- Updated dependencies [9b491fb]
+- Updated dependencies [1d7fda8]
+- Updated dependencies [a778695]
+- Updated dependencies [e61e1c2]
+  - ultimabase@0.4.0-canary.20261102132223
+  - @ultimabase/http@0.4.0-canary.20261102132223
+
 ## 0.3.0
 
 ### Minor Changes

package/dist/disk.d.ts

@@ -0,0 +1,13 @@
+import type { FileStorage } from './storage.ts';
+/** What `diskFiles` takes; each option takes `undefined`, which start refuses. */
+export interface DiskOptions {
+    /** The directory it stores in, made when missing. */
+    readonly dir: string | undefined;
+    /** Signs the private files' URLs: 32 characters at least, the same on every start. */
+    readonly secret: string | undefined;
+    /** The origin its URLs start with: the HTTP server's address by default. */
+    readonly servedAt?: string | undefined;
+}
+/** A storage in `dir`, its files served at `GET /files/<key>`. */
+export declare function diskFiles(options: DiskOptions): FileStorage;
+//# sourceMappingURL=disk.d.ts.map

package/dist/disk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disk.d.ts","sourceRoot":"","sources":["../src/disk.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAgBD,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CAmF3D"}

package/dist/disk.js

@@ -0,0 +1,100 @@
+// `diskFiles({ dir, secret })` (D-202): a storage in a directory, which the
+// application serves; for one server whose directory is a persistent volume.
+import { randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream, mkdirSync } from 'node:fs';
+import { readdir, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { serving } from './served.js';
+import { keyPattern } from './storage.js';
+function checked(key) {
+    if (!keyPattern.test(key))
+        throw new Error(`diskFiles: ${key} is not a file key.`);
+    return key;
+}
+const isMeta = (value) => typeof value === 'object' &&
+    value !== null &&
+    typeof Reflect.get(value, 'type') === 'string' &&
+    typeof Reflect.get(value, 'attachment') === 'boolean';
+/** A storage in `dir`, its files served at `GET /files/<key>`. */
+export function diskFiles(options) {
+    const { secret } = options;
+    const dir = options.dir ?? '';
+    const served = serving('diskFiles', options);
+    const pathOf = (key) => join(dir, checked(key));
+    return {
+        start: (server) => {
+            if (dir === '')
+                throw new Error('diskFiles() needs dir: undefined or empty.');
+            if (secret === undefined || secret.length < 32) {
+                throw new Error('diskFiles() needs a secret of 32 characters at least.');
+            }
+            for (const prefix of ['public', 'private']) {
+                mkdirSync(join(dir, prefix), { recursive: true });
+            }
+            served.start(server);
+        },
+        put: async (key, body, { type, size, attachment }) => {
+            const path = pathOf(key);
+            const temporary = `${path}.${randomUUID()}.tmp`;
+            let total = 0;
+            // Counted as it is written: a streamed body stops past its size.
+            async function* counted(chunks) {
+                for await (const chunk of chunks) {
+                    total += chunk.length;
+                    if (total > size)
+                        throw new Error(`diskFiles: ${key} has over ${size} bytes.`);
+                    yield chunk;
+                }
+            }
+            try {
+                const source = Readable.from(body instanceof Uint8Array ? [body] : body);
+                await pipeline(source, counted, createWriteStream(temporary));
+                if (total !== size) {
+                    throw new Error(`diskFiles: ${key} has ${total} bytes, not ${size}.`);
+                }
+                await writeFile(`${temporary}.json`, JSON.stringify({ type, attachment }));
+                // The type first: a body without it is never served.
+                await rename(`${temporary}.json`, `${path}.json`);
+                await rename(temporary, path);
+            }
+            finally {
+                await rm(temporary, { force: true });
+                await rm(`${temporary}.json`, { force: true });
+            }
+        },
+        delete: async (key) => {
+            const path = pathOf(key);
+            await rm(path, { force: true });
+            await rm(`${path}.json`, { force: true });
+        },
+        keys: async () => {
+            const listed = await Promise.all(['public', 'private'].map(async (prefix) => {
+                const names = await readdir(join(dir, prefix));
+                return names.map((name) => `${prefix}/${name}`);
+            }));
+            return listed.flat().filter((key) => keyPattern.test(key));
+        },
+        url: (key) => served.url(checked(key)),
+        serve: (key, url) => served.serve(key, url, async () => {
+            const path = pathOf(key);
+            try {
+                const [meta, { size }] = await Promise.all([
+                    readFile(`${path}.json`, 'utf8'),
+                    stat(path),
+                ]);
+                const parsed = JSON.parse(meta);
+                if (!isMeta(parsed))
+                    throw new Error(`diskFiles: ${key}.json is not a file's type.`);
+                const body = Readable.toWeb(createReadStream(path));
+                return { ...parsed, size, body };
+            }
+            catch (error) {
+                if (error instanceof Error && Reflect.get(error, 'code') === 'ENOENT')
+                    return undefined;
+                throw error;
+            }
+        }),
+    };
+}

package/dist/field.d.ts

@@ -31,7 +31,7 @@ export interface FileOptions {
     readonly maxSize?: number;
     /** MIME types or patterns: `['image/*', 'application/pdf']`; any by default. */
     readonly accept?: readonly string[];
-    /** Served to everyone at a stable URL; presigned for one hour otherwise. */
+    /** Served to everyone at a stable URL; presigned otherwise, the same for 15 minutes. */
     readonly public?: boolean;
     readonly inline?: {
         readonly [key: string]: Inline;

package/dist/field.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field.d.ts","sourceRoot":"","sources":["../src/field.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAU1E,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;AAC3E,kEAAkE;AAClE,MAAM,MAAM,MAAM,GACjB,SAAS,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;AAEzE,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;AAC7E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACvD;AAED,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;CACjD,GACE,CAAC,GACD,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,CAAC,GACtC,OAAO,CAAC,CAAC,CAAC,GACV,KAAK,CAAA;AACT,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;CAAE,GAClD;IAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK;CAAE,CAAA;AACnC,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GACxD;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,GAAG,IAAI;CAAE,GAC/C;IAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK;CAAE,CAAA;AACnC,6CAA6C;AAC7C,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChD,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GACpB,MAAM,CAAC,CAAC,CAAC,CAAA;AACZ,KAAK,GAAG,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;AACrC,+EAA+E;AAC/E,KAAK,SAAS,GACX,SAAS,MAAM,EAAE,GACjB;IACA,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG;KAAE,GAAG;QACvD,QAAQ,EAAE,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK;KAC7C;CACA,CAAC,SAAS,CAAC,CAAA;AACf,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,CAAA;AAExE,mDAAmD;AACnD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAC/B,OAAO,CAAC,CAAC,CAAC,EACV,CAAC,EACD,OAAO,EACP,KAAK,EACL,OAAO,CAAC,CAAC,CAAC,EACV,IAAI,EACJ,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAClD,CAAA;AAED,aAAa;AACb,eAAO,MAAM,cAAc,EAAE,MAAyB,CAAA;AAEtD,gDAAgD;AAChD,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,OACR,CAAA;AAGnC,eAAO,MAAM,MAAM,YAAa,WAAW,KAAG,IAG5C,CAAA;AAqHF;;;GAGG;AACH,wBAAgB,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,CAAA;AAGrC,wBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,WAAW,EAC/C,OAAO,EAAE,CAAC,GACR,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"field.d.ts","sourceRoot":"","sources":["../src/field.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAU1E,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;AAC3E,kEAAkE;AAClE,MAAM,MAAM,MAAM,GACjB,SAAS,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;AAEzE,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;AAC7E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACvD;AAED,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;CACjD,GACE,CAAC,GACD,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,CAAC,GACtC,OAAO,CAAC,CAAC,CAAC,GACV,KAAK,CAAA;AACT,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;CAAE,GAClD;IAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK;CAAE,CAAA;AACnC,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GACxD;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,GAAG,IAAI;CAAE,GAC/C;IAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK;CAAE,CAAA;AACnC,6CAA6C;AAC7C,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChD,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GACpB,MAAM,CAAC,CAAC,CAAC,CAAA;AACZ,KAAK,GAAG,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;AACrC,+EAA+E;AAC/E,KAAK,SAAS,GACX,SAAS,MAAM,EAAE,GACjB;IACA,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG;KAAE,GAAG;QACvD,QAAQ,EAAE,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK;KAC7C;CACA,CAAC,SAAS,CAAC,CAAA;AACf,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,CAAA;AAExE,mDAAmD;AACnD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAC/B,OAAO,CAAC,CAAC,CAAC,EACV,CAAC,EACD,OAAO,EACP,KAAK,EACL,OAAO,CAAC,CAAC,CAAC,EACV,IAAI,EACJ,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAClD,CAAA;AAED,aAAa;AACb,eAAO,MAAM,cAAc,EAAE,MAAyB,CAAA;AAEtD,gDAAgD;AAChD,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,OACR,CAAA;AAGnC,eAAO,MAAM,MAAM,YAAa,WAAW,KAAG,IAG5C,CAAA;AAqHF;;;GAGG;AACH,wBAAgB,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,CAAA;AAGrC,wBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,WAAW,EAC/C,OAAO,EAAE,CAAC,GACR,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA"}

package/dist/index.d.ts

@@ -1,10 +1,12 @@
 export type { FileField, FileInput, FileOf, FileOptions, Inline, InlineRun, MadeVariant, Variant, } from './field.ts';
 export type { Checked } from './lifecycle.ts';
-export type { MemoryFiles, MemoryObject } from './memory.ts';
+export type { DiskOptions } from './disk.ts';
+export type { MemoryFiles, MemoryObject, MemoryOptions } from './memory.ts';
 export type { Files, FilesOptions, UploadArgs } from './plugin.ts';
 export type { S3Options } from './s3.ts';
-export type { FileBody, FileStorage, PutOptions } from './storage.ts';
+export type { FileBody, FileStorage, PutOptions, Server } from './storage.ts';
 export type { FileValue, FileVariant } from './values.ts';
+export { diskFiles } from './disk.ts';
 export { file } from './field.ts';
 export { memoryFiles } from './memory.ts';
 export { files, filesPlugin } from './plugin.ts';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACX,SAAS,EACT,SAAS,EACT,MAAM,EACN,WAAW,EACX,MAAM,EACN,SAAS,EACT,WAAW,EACX,OAAO,GACP,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC5D,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACrE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACX,SAAS,EACT,SAAS,EACT,MAAM,EACN,WAAW,EACX,MAAM,EACN,SAAS,EACT,WAAW,EACX,OAAO,GACP,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC7E,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA"}

package/dist/index.js

@@ -1,3 +1,4 @@
+export { diskFiles } from './disk.js';
 export { file } from './field.js';
 export { memoryFiles } from './memory.js';
 export { files, filesPlugin } from './plugin.js';

package/dist/memory.d.ts

@@ -11,6 +11,11 @@ export interface MemoryFiles extends FileStorage {
 }
 /** The bytes of a body, read to its end. */
 export declare function bytesOf(body: FileBody): Promise<Uint8Array>;
-/** A storage in memory: its URLs are `memory://files/<key>`, never served. */
-export declare function memoryFiles(): MemoryFiles;
+/** What `memoryFiles` takes. */
+export interface MemoryOptions {
+    /** The origin its URLs start with: the HTTP server's address by default. */
+    readonly servedAt?: string | undefined;
+}
+/** A storage in memory, its files served at `GET /files/<key>`. */
+export declare function memoryFiles(options?: MemoryOptions): MemoryFiles;
 //# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGzD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACnD;AAED,4CAA4C;AAC5C,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAGjE;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,IAAI,WAAW,CAqBzC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAEzD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACnD;AAED,4CAA4C;AAC5C,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAGjE;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,OAAO,GAAE,aAAkB,GAAG,WAAW,CA0BpE"}

package/dist/memory.js

@@ -1,16 +1,19 @@
-import { isPublic } from './storage.js';
+// `memoryFiles()` (D-152, D-202): a storage in memory, which tests use, so
+// that no test writes to a real storage; the application serves its files.
+import { serving } from './served.js';
 /** The bytes of a body, read to its end. */
 export async function bytesOf(body) {
     if (body instanceof Uint8Array)
         return body;
     return new Uint8Array(await new Response(body).arrayBuffer());
 }
-/** A storage in memory: its URLs are `memory://files/<key>`, never served. */
-export function memoryFiles() {
+/** A storage in memory, its files served at `GET /files/<key>`. */
+export function memoryFiles(options = {}) {
     const objects = new Map();
+    const served = serving('memoryFiles', options);
     return {
         objects,
-        start: () => { },
+        start: served.start,
         put: async (key, body, { type, size, attachment }) => {
             const bytes = await bytesOf(body);
             if (bytes.length !== size) {
@@ -22,6 +25,10 @@ export function memoryFiles() {
             objects.delete(key);
         },
         keys: async () => [...objects.keys()],
-        url: (key) => `memory://files/${key}${isPublic(key) ? '' : '?expires=3600'}`,
+        url: served.url,
+        serve: (key, url) => served.serve(key, url, async () => {
+            const object = objects.get(key);
+            return object && { ...object, size: object.body.length };
+        }),
     };
 }

package/dist/plugin.d.ts

@@ -1,5 +1,5 @@
 import type { Http } from '@ultimabase/http';
-import type { CallerRule, Identity, PluginOf, PluginTypes } from 'ultimabase';
+import type { CallerRule, PluginOf, PluginTypes, QueryOptions } from 'ultimabase';
 import type { Checked } from './lifecycle.ts';
 import type { FileStorage } from './storage.ts';
 /** What `filesPlugin` takes (D-152). */
@@ -21,11 +21,10 @@ export interface Files extends PluginTypes {
 /** Files for the application's file fields; it requires `httpPlugin()`. */
 export declare const filesPlugin: PluginOf<Files>;
 /** What `files.upload` takes. */
-export interface UploadArgs {
+export interface UploadArgs extends QueryOptions {
     /** The field the file is for: `Post.cover`. */
     readonly for: string;
     readonly name: string;
-    readonly as?: Identity;
 }
 /** The running files plugin, from server code (D-152). */
 export declare const files: {

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,KAAK,EACX,UAAU,EAEV,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAW7C,OAAO,KAAK,EAAY,WAAW,EAAE,MAAM,cAAc,CAAA;AAKzD,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;KAC5B,CAAA;CACD;AAED,uCAAuC;AACvC,MAAM,WAAW,KAAM,SAAQ,WAAW;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACvB;AA6ED,2EAA2E;AAC3E,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAqB,CAAA;AAE7D,iCAAiC;AACjC,MAAM,WAAW,UAAU;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;CACtB;AAED,0DAA0D;AAC1D,eAAO,MAAM,KAAK,EAAE;IACnB,6DAA6D;IAC7D,MAAM,CACL,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,IAAI,EAAE,UAAU,GACd,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnC,oDAAoD;IACpD,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAWhE,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,KAAK,EACX,UAAU,EAEV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAW7C,OAAO,KAAK,EAAY,WAAW,EAAE,MAAM,cAAc,CAAA;AAKzD,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;KAC5B,CAAA;CACD;AAED,uCAAuC;AACvC,MAAM,WAAW,KAAM,SAAQ,WAAW;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACvB;AAgFD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAqB,CAAA;AAE7D,iCAAiC;AACjC,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC/C,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,0DAA0D;AAC1D,eAAO,MAAM,KAAK,EAAE;IACnB,6DAA6D;IAC7D,MAAM,CACL,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,IAAI,EAAE,UAAU,GACd,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnC,oDAAoD;IACpD,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAWhE,CAAA"}

package/dist/plugin.js

@@ -4,7 +4,7 @@ import manifest from '../package.json' with { type: 'json' };
 import { defaultMaxSize, isByteCount } from './field.js';
 import { attach, check, deleteHeld, deleteLost, release, resolve, sweep, } from './lifecycle.js';
 import { FilesBlob } from './model.js';
-import { uploads } from './routes.js';
+import { served, uploads } from './routes.js';
 import { upload } from './upload.js';
 import { runningOf, useRunning } from './values.js';
 /** Ten minutes, between two sweeps. */
@@ -38,8 +38,12 @@ const definition = definePlugin({
     manifest,
     requires: { http: httpPlugin },
     models: [FilesBlob],
-    api: ({ plugins }) => {
+    api: ({ plugins, options }) => {
         plugins.http.mount(uploads(), { bodyLimit: false });
+        // A storage the application serves gets its route (D-202).
+        const serve = options.storage.serve?.bind(options.storage);
+        if (serve !== undefined)
+            plugins.http.mount(served(serve));
     },
     hooks: {
         beforeCreate: (facts) => resolve(facts),
@@ -50,12 +54,12 @@ const definition = definePlugin({
         afterUpdateCommit: (facts) => deleteLost(facts),
         afterDeleteCommit: (facts) => deleteHeld(facts),
     },
-    start: async ({ options, models, logger }) => {
+    start: async ({ options, models, logger, plugins }) => {
         const { storage, access, maxSize = defaultMaxSize } = options;
         if (!isByteCount(maxSize)) {
             throw new Error('filesPlugin’s maxSize is a number of bytes.');
         }
-        storage.start();
+        storage.start({ url: plugins.http.url() });
         const fields = fieldsOf(models);
         useRunning({
             storage,

package/dist/routes.d.ts

@@ -1,4 +1,6 @@
 import type { Routes } from '@ultimabase/http';
 /** The upload route, which the plugin mounts without the body limit. */
 export declare const uploads: () => Routes;
+/** The route of a storage's files, which `serve` answers. */
+export declare const served: (serve: (key: string, url: URL) => Promise<Response>) => Routes;
 //# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAW9C,wEAAwE;AACxE,eAAO,MAAM,OAAO,QAAO,MA2BxB,CAAA"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAY9C,wEAAwE;AACxE,eAAO,MAAM,OAAO,QAAO,MA2BxB,CAAA;AAEH,6DAA6D;AAC7D,eAAO,MAAM,MAAM,UACX,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,KACjD,MAUA,CAAA"}

package/dist/routes.js

@@ -1,5 +1,6 @@
 import { routes } from '@ultimabase/http';
 import { PublicError } from 'ultimabase';
+import { keyPattern } from './storage.js';
 import { upload } from './upload.js';
 /** An upload's own refusals, which the HTTP plugin does not know. */
 const statuses = new Map([
@@ -30,3 +31,11 @@ export const uploads = () => routes().post('/files', async (c) => {
         return c.json({ code: error.code, message: error.message }, status);
     }
 });
+/** The route of a storage's files, which `serve` answers. */
+export const served = (serve) => routes().get('/files/:visibility/:id', async (c) => {
+    const key = `${c.req.param('visibility')}/${c.req.param('id')}`;
+    if (!keyPattern.test(key)) {
+        return c.json({ code: 'NOT_FOUND', message: 'No file at this address.' }, 404);
+    }
+    return serve(key, new URL(c.req.url));
+});

package/dist/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../src/s3.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AA+DD,qFAAqF;AACrF,wBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,GAAG,WAAW,CAyDlD"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../src/s3.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AA+DD,qFAAqF;AACrF,wBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,GAAG,WAAW,CA8DlD"}

package/dist/s3.js

@@ -1,5 +1,5 @@
 import { presign } from './sigv4.js';
-import { isPublic } from './storage.js';
+import { isPublic, windowOf } from './storage.js';
 const required = [
     'bucket',
     'region',
@@ -46,7 +46,7 @@ export function s3(options) {
     let config;
     const configured = () => (config ??= configOf(options));
     const objectUrl = (key) => new URL(`${configured().base}/${key}`);
-    const signed = (method, url, expires, headers = {}) => presign(configured(), { method, url, expires, headers });
+    const signed = (method, url, expires, headers = {}, at) => presign(configured(), { method, url, expires, headers }, at);
     return {
         start: () => {
             configured();
@@ -88,8 +88,11 @@ export function s3(options) {
             return keys;
         },
         url: (key) => {
-            if (!isPublic(key))
-                return signed('GET', objectUrl(key), 3600);
+            if (!isPublic(key)) {
+                // The same URL for a whole window, valid one more (D-200).
+                const start = new Date(windowOf(Date.now()));
+                return signed('GET', objectUrl(key), 1800, {}, start);
+            }
             const { publicUrl } = options;
             return publicUrl === undefined
                 ? objectUrl(key).href

package/dist/served.d.ts

@@ -0,0 +1,23 @@
+import type { FileBody, Server } from './storage.ts';
+/** An object a storage reads back. */
+export interface StoredObject {
+    readonly body: FileBody;
+    readonly size: number;
+    readonly type: string;
+    readonly attachment: boolean;
+}
+/** Where a served storage's files are, and how a private one is signed. */
+export interface Serving {
+    readonly start: (server: Server) => void;
+    readonly url: (key: string) => string;
+    readonly serve: (key: string, url: URL, read: () => Promise<StoredObject | undefined>) => Promise<Response>;
+}
+/**
+ * A storage's URLs, at `servedAt` or the HTTP server's address; `secret`
+ * signs the private ones, drawn at random when none is given.
+ */
+export declare function serving(name: string, options: {
+    readonly servedAt?: string | undefined;
+    readonly secret?: string | undefined;
+}): Serving;
+//# sourceMappingURL=served.d.ts.map

package/dist/served.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"served.d.ts","sourceRoot":"","sources":["../src/served.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAGpD,sCAAsC;AACtC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,CACf,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,KACzC,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtB;AAKD;;;GAGG;AACH,wBAAgB,OAAO,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACR,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC,GACC,OAAO,CA6DT"}

package/dist/served.js

@@ -0,0 +1,62 @@
+// The files a storage serves itself (D-202): their URLs on the
+// application's origin, a private one signed for D-200's window, and the
+// answer of `GET /files/<key>`.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { isPublic, urlWindow, windowOf } from './storage.js';
+const answer = (status, code, message) => Response.json({ code, message }, { status });
+/**
+ * A storage's URLs, at `servedAt` or the HTTP server's address; `secret`
+ * signs the private ones, drawn at random when none is given.
+ */
+export function serving(name, options) {
+    const secret = options.secret ?? randomBytes(32).toString('base64url');
+    let origin;
+    const signature = (key, expires) => createHmac('sha256', secret).update(`${key}\n${expires}`).digest();
+    const signed = (key, url) => {
+        const expires = Number(url.searchParams.get('expires'));
+        const given = Buffer.from(url.searchParams.get('signature') ?? '', 'base64url');
+        const expected = signature(key, expires);
+        return (expires * 1000 > Date.now() &&
+            given.length === expected.length &&
+            timingSafeEqual(given, expected));
+    };
+    return {
+        start: (server) => {
+            origin = (options.servedAt ?? server.url).replace(/\/+$/u, '');
+        },
+        url: (key) => {
+            if (origin === undefined) {
+                throw new Error(`${name} gives a file's URL once the application starts.`);
+            }
+            if (isPublic(key))
+                return `${origin}/files/${key}`;
+            // The same URL for a whole window, valid one more (D-200).
+            const expires = (windowOf(Date.now()) + 2 * urlWindow) / 1000;
+            const sig = signature(key, expires).toString('base64url');
+            return `${origin}/files/${key}?expires=${expires}&signature=${sig}`;
+        },
+        serve: async (key, url, read) => {
+            if (!isPublic(key) && !signed(key, url)) {
+                return answer(403, 'FORBIDDEN', 'This file URL is not signed, or has expired.');
+            }
+            const object = await read();
+            if (object === undefined) {
+                return answer(404, 'NOT_FOUND', 'No file at this address.');
+            }
+            const expires = Number(url.searchParams.get('expires'));
+            const headers = new Headers({
+                'Content-Type': object.type,
+                'Content-Length': String(object.size),
+                'X-Content-Type-Options': 'nosniff',
+                // An origin of its own, even when it is opened (D-202).
+                'Content-Security-Policy': 'sandbox',
+                'Cache-Control': isPublic(key)
+                    ? 'public, max-age=31536000, immutable'
+                    : `private, max-age=${Math.max(0, Math.floor(expires - Date.now() / 1000))}`,
+            });
+            if (object.attachment)
+                headers.set('Content-Disposition', 'attachment');
+            return new Response(object.body, { headers });
+        },
+    };
+}

package/dist/sigv4.d.ts

@@ -13,6 +13,6 @@ export interface Presigned {
     /** In seconds. */
     readonly expires: number;
 }
-/** The URL that runs the request until it expires, signed now. */
-export declare function presign(signer: Signer, request: Presigned): string;
+/** The URL that runs the request until `expires` seconds after `at`. */
+export declare function presign(signer: Signer, request: Presigned, at?: Date): string;
 //# sourceMappingURL=sigv4.d.ts.map

package/dist/sigv4.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../src/sigv4.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACrD,kBAAkB;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAmBD,kEAAkE;AAClE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CA0ClE"}
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../src/sigv4.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACrD,kBAAkB;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAmBD,wEAAwE;AACxE,wBAAgB,OAAO,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,EAClB,EAAE,GAAE,IAAiB,GACnB,MAAM,CA0CR"}

package/dist/sigv4.js

@@ -10,10 +10,10 @@ const stampOf = (now) => now
     .toISOString()
     .replaceAll(/[-:]/g, '')
     .replace(/\.\d{3}/, '');
-/** The URL that runs the request until it expires, signed now. */
-export function presign(signer, request) {
+/** The URL that runs the request until `expires` seconds after `at`. */
+export function presign(signer, request, at = new Date()) {
     const { method, url, expires } = request;
-    const stamp = stampOf(new Date());
+    const stamp = stampOf(at);
     const day = stamp.slice(0, 8);
     const scope = `${day}/${signer.region}/s3/aws4_request`;
     const headers = new Map(Object.entries({ ...request.headers, host: url.host }).map(([name, value]) => [name.toLowerCase(), value.trim()]));

package/dist/storage.d.ts

@@ -8,18 +8,34 @@ export interface PutOptions {
     /** Served as a download, so a browser never runs it: SVG, undetected types. */
     readonly attachment: boolean;
 }
-/** A storage adapter: `s3()` or `memoryFiles()`. */
+/** The running HTTP server, which a storage that serves its files reads. */
+export interface Server {
+    /** Its address, as `http://localhost:3000`. */
+    readonly url: string;
+}
+/** A storage adapter: `s3()`, `diskFiles()` or `memoryFiles()`. */
 export interface FileStorage {
     /** Checks its options when the application starts. */
-    start(): void;
+    start(server: Server): void;
     put(key: string, body: FileBody, options: PutOptions): Promise<void>;
     /** Deletes an object; a missing one is not an error. */
     delete(key: string): Promise<void>;
     /** Every key it stores. */
     keys(): Promise<readonly string[]>;
-    /** A public object's stable URL, a private one's presigned for one hour. */
+    /** A public object's stable URL, a private one's presigned, the same for 15 minutes (D-200). */
     url(key: string): string;
+    /**
+     * The answer of `GET /files/<key>`, for a storage the application serves
+     * (D-202); `url` then gives that route's URL.
+     */
+    serve?(key: string, url: URL): Promise<Response>;
 }
+/** A private file's URL stays the same this long, in milliseconds (D-200). */
+export declare const urlWindow: number;
+/** The start of the window `now` is in, in milliseconds. */
+export declare const windowOf: (now: number) => number;
+/** A file's key: `public/<uuid>` or `private/<uuid>`. */
+export declare const keyPattern: RegExp;
 /** Whether a key is served to everyone. */
 export declare const isPublic: (key: string) => boolean;
 /**

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAIA,kEAAkE;AAClE,MAAM,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;AAE9D,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC3B,sDAAsD;IACtD,KAAK,IAAI,IAAI,CAAA;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,wDAAwD;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,2BAA2B;IAC3B,IAAI,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IAClC,4EAA4E;IAC5E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CACxB;AAED,2CAA2C;AAC3C,eAAO,MAAM,QAAQ,QAAS,MAAM,KAAG,OAAoC,CAAA;AAE3E;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC9B,QAAQ,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAC7B,OAAO,CAAC,CAAC,EAAE,CAAC,CAOd"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAIA,kEAAkE;AAClE,MAAM,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;AAE9D,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,4EAA4E;AAC5E,MAAM,WAAW,MAAM;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC3B,sDAAsD;IACtD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,wDAAwD;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,2BAA2B;IAC3B,IAAI,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IAClC,gGAAgG;IAChG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB;;;OAGG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChD;AAED,8EAA8E;AAC9E,eAAO,MAAM,SAAS,EAAE,MAAuB,CAAA;AAE/C,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,QAAS,MAAM,KAAG,MACC,CAAA;AAExC,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,MAA6C,CAAA;AAEtE,2CAA2C;AAC3C,eAAO,MAAM,QAAQ,QAAS,MAAM,KAAG,OAAoC,CAAA;AAE3E;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC9B,QAAQ,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAC7B,OAAO,CAAC,CAAC,EAAE,CAAC,CAOd"}

package/dist/storage.js

@@ -1,6 +1,12 @@
-// What `filesPlugin` stores files in (D-152): an S3-compatible storage, or
-// memory for tests. A key starts with `public/` or `private/`, which says
-// how the object is served.
+// What `filesPlugin` stores files in (D-152, D-202): an S3-compatible
+// storage, a disk, or memory for tests. A key starts with `public/` or
+// `private/`, which says how the object is served.
+/** A private file's URL stays the same this long, in milliseconds (D-200). */
+export const urlWindow = 15 * 60 * 1000;
+/** The start of the window `now` is in, in milliseconds. */
+export const windowOf = (now) => Math.floor(now / urlWindow) * urlWindow;
+/** A file's key: `public/<uuid>` or `private/<uuid>`. */
+export const keyPattern = /^(public|private)\/[0-9a-f-]{36}$/u;
 /** Whether a key is served to everyone. */
 export const isPublic = (key) => key.startsWith('public/');
 /**

package/dist/upload.d.ts

@@ -1,13 +1,12 @@
-import type { Identity } from 'ultimabase';
+import type { QueryOptions } from 'ultimabase';
 import type { FileBody } from './storage.ts';
 /** What an upload says of its file. */
-export interface UploadOptions {
+export interface UploadOptions extends QueryOptions {
     /** The field the file is for: `Post.cover`. */
     readonly for: string;
     readonly name: string;
     /** The declared `Content-Type`, read only when the bytes say none. */
     readonly type?: string | undefined;
-    readonly as?: Identity | undefined;
 }
 /**
  * Stores a file for `options.for`, as `POST /files` does, and gives its id,

package/dist/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../src/upload.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAa,MAAM,YAAY,CAAA;AAKrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAI5C,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAClC;AAmKD;;;GAGG;AACH,wBAAsB,MAAM,CAC3B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAuFlC"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../src/upload.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAA;AAKnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAI5C,uCAAuC;AACvC,MAAM,WAAW,aAAc,SAAQ,YAAY;IAClD,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAmKD;;;GAGG;AACH,wBAAsB,MAAM,CAC3B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAuFlC"}

package/dist/values.d.ts

@@ -17,7 +17,7 @@ export interface FileValue<I extends object = {
     readonly name: string;
     readonly type: string;
     readonly size: number;
-    /** Stable for a public file, presigned for one hour for a private one. */
+    /** Stable for a public file, presigned for a private one, the same for 15 minutes. */
     readonly url: string;
     readonly inline: I;
     readonly variants: V;

package/dist/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS,CACzB,CAAC,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAAE,EAC/D,CAAC,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAA;CAAE;IAEjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;CACpB;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAAA;KAAE,CAAA;CAC5D;AAED,sDAAsD;AACtD,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEhE,wEAAwE;AACxE,qBAAa,OAAO;IACnB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAGvD;CACD;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAKD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAE3D;AAED,wBAAgB,SAAS,IAAI,OAAO,CAGnC;AAKD,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CA2BnE;AAED,qDAAqD;AACrD,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,KAAK,IAAI,SACgB,CAAA;AAEjE,qDAAqD;AACrD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAShE;AAuBD,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBpE;AAED,iDAAiD;AACjD,eAAO,MAAM,UAAU,SAAU,UAAU,KAAG,SAa5C,CAAA;AAEF,oCAAoC;AACpC,eAAO,MAAM,QAAQ,UAAW,SAAS,KAAG,SAe1C,CAAA"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS,CACzB,CAAC,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAAE,EAC/D,CAAC,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAA;CAAE;IAEjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;CACpB;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;IACtD,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAAA;KAAE,CAAA;CAC5D;AAED,sDAAsD;AACtD,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEhE,wEAAwE;AACxE,qBAAa,OAAO;IACnB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAGvD;CACD;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAKD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAE3D;AAED,wBAAgB,SAAS,IAAI,OAAO,CAGnC;AAKD,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CA2BnE;AAED,qDAAqD;AACrD,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,KAAK,IAAI,SACgB,CAAA;AAEjE,qDAAqD;AACrD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAShE;AAuBD,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBpE;AAED,iDAAiD;AACjD,eAAO,MAAM,UAAU,SAAU,UAAU,KAAG,SAa5C,CAAA;AAEF,oCAAoC;AACpC,eAAO,MAAM,QAAQ,UAAW,SAAS,KAAG,SAe1C,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimabase/files",
-  "version": "0.3.0",
+  "version": "0.4.0-canary.20261102132223",
   "description": "Files for UltimaBase: uploads to S3-compatible storage, file fields, variants, and no orphan ever.",
   "type": "module",
   "license": "Apache-2.0",
@@ -34,15 +34,15 @@
     "file-type": "22.2.0"
   },
   "peerDependencies": {
-    "@ultimabase/http": "^0.3.0",
-    "ultimabase": "^0.3.0"
+    "@ultimabase/http": "0.4.0-canary.20261102132223",
+    "ultimabase": "0.4.0-canary.20261102132223"
   },
   "devDependencies": {
     "@types/pg": "8.23.1",
-    "@ultimabase/http": "0.3.0",
-    "@ultimabase/postgres": "0.3.0",
+    "@ultimabase/http": "0.4.0-canary.20261102132223",
+    "@ultimabase/postgres": "0.4.0-canary.20261102132223",
     "pg": "8.23.1",
-    "ultimabase": "0.3.0",
+    "ultimabase": "0.4.0-canary.20261102132223",
     "vite": "8.3.4",
     "vitest": "5.0.5"
   }

package/src/disk.ts

@@ -0,0 +1,128 @@
+// `diskFiles({ dir, secret })` (D-202): a storage in a directory, which the
+// application serves; for one server whose directory is a persistent volume.
+import { randomUUID } from 'node:crypto'
+import { createReadStream, createWriteStream, mkdirSync } from 'node:fs'
+import {
+	readdir,
+	readFile,
+	rename,
+	rm,
+	stat,
+	writeFile,
+} from 'node:fs/promises'
+import { join } from 'node:path'
+import { Readable } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
+import { serving } from './served.ts'
+import type { FileStorage } from './storage.ts'
+import { keyPattern } from './storage.ts'
+
+/** What `diskFiles` takes; each option takes `undefined`, which start refuses. */
+export interface DiskOptions {
+	/** The directory it stores in, made when missing. */
+	readonly dir: string | undefined
+	/** Signs the private files' URLs: 32 characters at least, the same on every start. */
+	readonly secret: string | undefined
+	/** The origin its URLs start with: the HTTP server's address by default. */
+	readonly servedAt?: string | undefined
+}
+
+function checked(key: string): string {
+	if (!keyPattern.test(key))
+		throw new Error(`diskFiles: ${key} is not a file key.`)
+	return key
+}
+
+const isMeta = (
+	value: unknown,
+): value is { type: string; attachment: boolean } =>
+	typeof value === 'object' &&
+	value !== null &&
+	typeof Reflect.get(value, 'type') === 'string' &&
+	typeof Reflect.get(value, 'attachment') === 'boolean'
+
+/** A storage in `dir`, its files served at `GET /files/<key>`. */
+export function diskFiles(options: DiskOptions): FileStorage {
+	const { secret } = options
+	const dir = options.dir ?? ''
+	const served = serving('diskFiles', options)
+	const pathOf = (key: string) => join(dir, checked(key))
+	return {
+		start: (server) => {
+			if (dir === '')
+				throw new Error('diskFiles() needs dir: undefined or empty.')
+			if (secret === undefined || secret.length < 32) {
+				throw new Error('diskFiles() needs a secret of 32 characters at least.')
+			}
+			for (const prefix of ['public', 'private']) {
+				mkdirSync(join(dir, prefix), { recursive: true })
+			}
+			served.start(server)
+		},
+		put: async (key, body, { type, size, attachment }) => {
+			const path = pathOf(key)
+			const temporary = `${path}.${randomUUID()}.tmp`
+			let total = 0
+			// Counted as it is written: a streamed body stops past its size.
+			async function* counted(chunks: AsyncIterable<Uint8Array>) {
+				for await (const chunk of chunks) {
+					total += chunk.length
+					if (total > size)
+						throw new Error(`diskFiles: ${key} has over ${size} bytes.`)
+					yield chunk
+				}
+			}
+			try {
+				const source = Readable.from(body instanceof Uint8Array ? [body] : body)
+				await pipeline(source, counted, createWriteStream(temporary))
+				if (total !== size) {
+					throw new Error(`diskFiles: ${key} has ${total} bytes, not ${size}.`)
+				}
+				await writeFile(
+					`${temporary}.json`,
+					JSON.stringify({ type, attachment }),
+				)
+				// The type first: a body without it is never served.
+				await rename(`${temporary}.json`, `${path}.json`)
+				await rename(temporary, path)
+			} finally {
+				await rm(temporary, { force: true })
+				await rm(`${temporary}.json`, { force: true })
+			}
+		},
+		delete: async (key) => {
+			const path = pathOf(key)
+			await rm(path, { force: true })
+			await rm(`${path}.json`, { force: true })
+		},
+		keys: async () => {
+			const listed = await Promise.all(
+				['public', 'private'].map(async (prefix) => {
+					const names = await readdir(join(dir, prefix))
+					return names.map((name) => `${prefix}/${name}`)
+				}),
+			)
+			return listed.flat().filter((key) => keyPattern.test(key))
+		},
+		url: (key) => served.url(checked(key)),
+		serve: (key, url) =>
+			served.serve(key, url, async () => {
+				const path = pathOf(key)
+				try {
+					const [meta, { size }] = await Promise.all([
+						readFile(`${path}.json`, 'utf8'),
+						stat(path),
+					])
+					const parsed: unknown = JSON.parse(meta)
+					if (!isMeta(parsed))
+						throw new Error(`diskFiles: ${key}.json is not a file's type.`)
+					const body = Readable.toWeb(createReadStream(path))
+					return { ...parsed, size, body }
+				} catch (error) {
+					if (error instanceof Error && Reflect.get(error, 'code') === 'ENOENT')
+						return undefined
+					throw error
+				}
+			}),
+	}
+}

package/src/field.ts

@@ -46,7 +46,7 @@ export interface FileOptions {
 	readonly maxSize?: number
 	/** MIME types or patterns: `['image/*', 'application/pdf']`; any by default. */
 	readonly accept?: readonly string[]
-	/** Served to everyone at a stable URL; presigned for one hour otherwise. */
+	/** Served to everyone at a stable URL; presigned otherwise, the same for 15 minutes. */
 	readonly public?: boolean
 	readonly inline?: { readonly [key: string]: Inline }
 	readonly variants?: { readonly [key: string]: Variant }

package/src/index.ts

@@ -1,5 +1,5 @@
-// `@ultimabase/files` (D-152): file fields stored in an S3-compatible
-// storage, uploaded with `POST /files`, and never an orphan.
+// `@ultimabase/files` (D-152, D-202): file fields stored in an S3-compatible
+// storage, a disk or memory, uploaded with `POST /files`, and never an orphan.
 export type {
 	FileField,
 	FileInput,
@@ -11,11 +11,13 @@ export type {
 	Variant,
 } from './field.ts'
 export type { Checked } from './lifecycle.ts'
-export type { MemoryFiles, MemoryObject } from './memory.ts'
+export type { DiskOptions } from './disk.ts'
+export type { MemoryFiles, MemoryObject, MemoryOptions } from './memory.ts'
 export type { Files, FilesOptions, UploadArgs } from './plugin.ts'
 export type { S3Options } from './s3.ts'
-export type { FileBody, FileStorage, PutOptions } from './storage.ts'
+export type { FileBody, FileStorage, PutOptions, Server } from './storage.ts'
 export type { FileValue, FileVariant } from './values.ts'
+export { diskFiles } from './disk.ts'
 export { file } from './field.ts'
 export { memoryFiles } from './memory.ts'
 export { files, filesPlugin } from './plugin.ts'

package/src/memory.ts

@@ -1,7 +1,7 @@
-// `memoryFiles()` (D-152): a storage in memory, which tests use, so that no
-// test writes to a real storage.
+// `memoryFiles()` (D-152, D-202): a storage in memory, which tests use, so
+// that no test writes to a real storage; the application serves its files.
+import { serving } from './served.ts'
 import type { FileBody, FileStorage } from './storage.ts'
-import { isPublic } from './storage.ts'
 
 /** An object `memoryFiles()` holds. */
 export interface MemoryObject {
@@ -21,12 +21,19 @@ export async function bytesOf(body: FileBody): Promise<Uint8Array> {
 	return new Uint8Array(await new Response(body).arrayBuffer())
 }
 
-/** A storage in memory: its URLs are `memory://files/<key>`, never served. */
-export function memoryFiles(): MemoryFiles {
+/** What `memoryFiles` takes. */
+export interface MemoryOptions {
+	/** The origin its URLs start with: the HTTP server's address by default. */
+	readonly servedAt?: string | undefined
+}
+
+/** A storage in memory, its files served at `GET /files/<key>`. */
+export function memoryFiles(options: MemoryOptions = {}): MemoryFiles {
 	const objects = new Map<string, MemoryObject>()
+	const served = serving('memoryFiles', options)
 	return {
 		objects,
-		start: () => {},
+		start: served.start,
 		put: async (key, body, { type, size, attachment }) => {
 			const bytes = await bytesOf(body)
 			if (bytes.length !== size) {
@@ -40,7 +47,11 @@ export function memoryFiles(): MemoryFiles {
 			objects.delete(key)
 		},
 		keys: async () => [...objects.keys()],
-		url: (key) =>
-			`memory://files/${key}${isPublic(key) ? '' : '?expires=3600'}`,
+		url: served.url,
+		serve: (key, url) =>
+			served.serve(key, url, async () => {
+				const object = objects.get(key)
+				return object && { ...object, size: object.body.length }
+			}),
 	}
 }

package/src/plugin.ts

@@ -6,9 +6,9 @@ import { httpPlugin } from '@ultimabase/http'
 import type {
 	CallerRule,
 	ExposedModel,
-	Identity,
 	PluginOf,
 	PluginTypes,
+	QueryOptions,
 } from 'ultimabase'
 import { definePlugin } from 'ultimabase'
 import manifest from '../package.json' with { type: 'json' }
@@ -26,7 +26,7 @@ import {
 } from './lifecycle.ts'
 import { FilesBlob } from './model.ts'
 import type { FileBody, FileStorage } from './storage.ts'
-import { uploads } from './routes.ts'
+import { served, uploads } from './routes.ts'
 import { upload } from './upload.ts'
 import { runningOf, useRunning } from './values.ts'
 
@@ -86,8 +86,11 @@ const definition = definePlugin<Files>({
 	manifest,
 	requires: { http: httpPlugin },
 	models: [FilesBlob],
-	api: ({ plugins }) => {
+	api: ({ plugins, options }) => {
 		plugins.http.mount(uploads(), { bodyLimit: false })
+		// A storage the application serves gets its route (D-202).
+		const serve = options.storage.serve?.bind(options.storage)
+		if (serve !== undefined) plugins.http.mount(served(serve))
 	},
 	hooks: {
 		beforeCreate: (facts) => resolve(facts),
@@ -98,12 +101,12 @@ const definition = definePlugin<Files>({
 		afterUpdateCommit: (facts) => deleteLost(facts),
 		afterDeleteCommit: (facts) => deleteHeld(facts),
 	},
-	start: async ({ options, models, logger }) => {
+	start: async ({ options, models, logger, plugins }) => {
 		const { storage, access, maxSize = defaultMaxSize } = options
 		if (!isByteCount(maxSize)) {
 			throw new Error('filesPlugin’s maxSize is a number of bytes.')
 		}
-		storage.start()
+		storage.start({ url: plugins.http.url() })
 		const fields = fieldsOf(models)
 		useRunning({
 			storage,
@@ -127,11 +130,10 @@ const definition = definePlugin<Files>({
 export const filesPlugin: PluginOf<Files> = definition.plugin
 
 /** What `files.upload` takes. */
-export interface UploadArgs {
+export interface UploadArgs extends QueryOptions {
 	/** The field the file is for: `Post.cover`. */
 	readonly for: string
 	readonly name: string
-	readonly as?: Identity
 }
 
 /** The running files plugin, from server code (D-152). */

package/src/routes.ts

@@ -1,8 +1,10 @@
 // `POST /files?for=Post.cover&name=photo.jpg` (D-152): the file as the raw
-// body, which its field's `maxSize` limits, not the HTTP plugin (D-153).
+// body, which its field's `maxSize` limits, not the HTTP plugin (D-153); and
+// `GET /files/<key>`, for a storage the application serves (D-202).
 import type { Routes } from '@ultimabase/http'
 import { routes } from '@ultimabase/http'
 import { PublicError } from 'ultimabase'
+import { keyPattern } from './storage.ts'
 import { upload } from './upload.ts'
 
 /** An upload's own refusals, which the HTTP plugin does not know. */
@@ -40,3 +42,18 @@ export const uploads = (): Routes =>
 			return c.json({ code: error.code, message: error.message }, status)
 		}
 	})
+
+/** The route of a storage's files, which `serve` answers. */
+export const served = (
+	serve: (key: string, url: URL) => Promise<Response>,
+): Routes =>
+	routes().get('/files/:visibility/:id', async (c) => {
+		const key = `${c.req.param('visibility')}/${c.req.param('id')}`
+		if (!keyPattern.test(key)) {
+			return c.json(
+				{ code: 'NOT_FOUND', message: 'No file at this address.' },
+				404,
+			)
+		}
+		return serve(key, new URL(c.req.url))
+	})

package/src/s3.ts

@@ -3,7 +3,7 @@
 import type { Signer } from './sigv4.ts'
 import { presign } from './sigv4.ts'
 import type { FileStorage } from './storage.ts'
-import { isPublic } from './storage.ts'
+import { isPublic, windowOf } from './storage.ts'
 
 /** What `s3()` takes; the first five are required, read when the application starts. */
 export interface S3Options {
@@ -90,7 +90,8 @@ export function s3(options: S3Options): FileStorage {
 		url: URL,
 		expires: number,
 		headers: { readonly [name: string]: string } = {},
-	) => presign(configured(), { method, url, expires, headers })
+		at?: Date,
+	) => presign(configured(), { method, url, expires, headers }, at)
 	return {
 		start: () => {
 			configured()
@@ -131,7 +132,11 @@ export function s3(options: S3Options): FileStorage {
 			return keys
 		},
 		url: (key) => {
-			if (!isPublic(key)) return signed('GET', objectUrl(key), 3600)
+			if (!isPublic(key)) {
+				// The same URL for a whole window, valid one more (D-200).
+				const start = new Date(windowOf(Date.now()))
+				return signed('GET', objectUrl(key), 1800, {}, start)
+			}
 			const { publicUrl } = options
 			return publicUrl === undefined
 				? objectUrl(key).href

package/src/served.ts

@@ -0,0 +1,101 @@
+// The files a storage serves itself (D-202): their URLs on the
+// application's origin, a private one signed for D-200's window, and the
+// answer of `GET /files/<key>`.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+import type { FileBody, Server } from './storage.ts'
+import { isPublic, urlWindow, windowOf } from './storage.ts'
+
+/** An object a storage reads back. */
+export interface StoredObject {
+	readonly body: FileBody
+	readonly size: number
+	readonly type: string
+	readonly attachment: boolean
+}
+
+/** Where a served storage's files are, and how a private one is signed. */
+export interface Serving {
+	readonly start: (server: Server) => void
+	readonly url: (key: string) => string
+	readonly serve: (
+		key: string,
+		url: URL,
+		read: () => Promise<StoredObject | undefined>,
+	) => Promise<Response>
+}
+
+const answer = (status: 403 | 404, code: string, message: string) =>
+	Response.json({ code, message }, { status })
+
+/**
+ * A storage's URLs, at `servedAt` or the HTTP server's address; `secret`
+ * signs the private ones, drawn at random when none is given.
+ */
+export function serving(
+	name: string,
+	options: {
+		readonly servedAt?: string | undefined
+		readonly secret?: string | undefined
+	},
+): Serving {
+	const secret = options.secret ?? randomBytes(32).toString('base64url')
+	let origin: string | undefined
+	const signature = (key: string, expires: number) =>
+		createHmac('sha256', secret).update(`${key}\n${expires}`).digest()
+	const signed = (key: string, url: URL) => {
+		const expires = Number(url.searchParams.get('expires'))
+		const given = Buffer.from(
+			url.searchParams.get('signature') ?? '',
+			'base64url',
+		)
+		const expected = signature(key, expires)
+		return (
+			expires * 1000 > Date.now() &&
+			given.length === expected.length &&
+			timingSafeEqual(given, expected)
+		)
+	}
+	return {
+		start: (server) => {
+			origin = (options.servedAt ?? server.url).replace(/\/+$/u, '')
+		},
+		url: (key) => {
+			if (origin === undefined) {
+				throw new Error(
+					`${name} gives a file's URL once the application starts.`,
+				)
+			}
+			if (isPublic(key)) return `${origin}/files/${key}`
+			// The same URL for a whole window, valid one more (D-200).
+			const expires = (windowOf(Date.now()) + 2 * urlWindow) / 1000
+			const sig = signature(key, expires).toString('base64url')
+			return `${origin}/files/${key}?expires=${expires}&signature=${sig}`
+		},
+		serve: async (key, url, read) => {
+			if (!isPublic(key) && !signed(key, url)) {
+				return answer(
+					403,
+					'FORBIDDEN',
+					'This file URL is not signed, or has expired.',
+				)
+			}
+			const object = await read()
+			if (object === undefined) {
+				return answer(404, 'NOT_FOUND', 'No file at this address.')
+			}
+			const expires = Number(url.searchParams.get('expires'))
+			const headers = new Headers({
+				'Content-Type': object.type,
+				'Content-Length': String(object.size),
+				'X-Content-Type-Options': 'nosniff',
+				// An origin of its own, even when it is opened (D-202).
+				'Content-Security-Policy': 'sandbox',
+				'Cache-Control': isPublic(key)
+					? 'public, max-age=31536000, immutable'
+					: `private, max-age=${Math.max(0, Math.floor(expires - Date.now() / 1000))}`,
+			})
+			if (object.attachment) headers.set('Content-Disposition', 'attachment')
+			return new Response(object.body, { headers })
+		},
+	}
+}

package/src/sigv4.ts

@@ -35,10 +35,14 @@ const stampOf = (now: Date): string =>
 		.replaceAll(/[-:]/g, '')
 		.replace(/\.\d{3}/, '')
 
-/** The URL that runs the request until it expires, signed now. */
-export function presign(signer: Signer, request: Presigned): string {
+/** The URL that runs the request until `expires` seconds after `at`. */
+export function presign(
+	signer: Signer,
+	request: Presigned,
+	at: Date = new Date(),
+): string {
 	const { method, url, expires } = request
-	const stamp = stampOf(new Date())
+	const stamp = stampOf(at)
 	const day = stamp.slice(0, 8)
 	const scope = `${day}/${signer.region}/s3/aws4_request`
 	const headers = new Map(

package/src/storage.ts

@@ -1,6 +1,6 @@
-// What `filesPlugin` stores files in (D-152): an S3-compatible storage, or
-// memory for tests. A key starts with `public/` or `private/`, which says
-// how the object is served.
+// What `filesPlugin` stores files in (D-152, D-202): an S3-compatible
+// storage, a disk, or memory for tests. A key starts with `public/` or
+// `private/`, which says how the object is served.
 
 /** A file's bytes: streamed from a request, or held in memory. */
 export type FileBody = ReadableStream<Uint8Array> | Uint8Array
@@ -14,19 +14,40 @@ export interface PutOptions {
 	readonly attachment: boolean
 }
 
-/** A storage adapter: `s3()` or `memoryFiles()`. */
+/** The running HTTP server, which a storage that serves its files reads. */
+export interface Server {
+	/** Its address, as `http://localhost:3000`. */
+	readonly url: string
+}
+
+/** A storage adapter: `s3()`, `diskFiles()` or `memoryFiles()`. */
 export interface FileStorage {
 	/** Checks its options when the application starts. */
-	start(): void
+	start(server: Server): void
 	put(key: string, body: FileBody, options: PutOptions): Promise<void>
 	/** Deletes an object; a missing one is not an error. */
 	delete(key: string): Promise<void>
 	/** Every key it stores. */
 	keys(): Promise<readonly string[]>
-	/** A public object's stable URL, a private one's presigned for one hour. */
+	/** A public object's stable URL, a private one's presigned, the same for 15 minutes (D-200). */
 	url(key: string): string
+	/**
+	 * The answer of `GET /files/<key>`, for a storage the application serves
+	 * (D-202); `url` then gives that route's URL.
+	 */
+	serve?(key: string, url: URL): Promise<Response>
 }
 
+/** A private file's URL stays the same this long, in milliseconds (D-200). */
+export const urlWindow: number = 15 * 60 * 1000
+
+/** The start of the window `now` is in, in milliseconds. */
+export const windowOf = (now: number): number =>
+	Math.floor(now / urlWindow) * urlWindow
+
+/** A file's key: `public/<uuid>` or `private/<uuid>`. */
+export const keyPattern: RegExp = /^(public|private)\/[0-9a-f-]{36}$/u
+
 /** Whether a key is served to everyone. */
 export const isPublic = (key: string): boolean => key.startsWith('public/')
 

package/src/upload.ts

@@ -3,7 +3,7 @@
 // fails, its objects and its rows are deleted.
 import { randomUUID } from 'node:crypto'
 import { fileTypeFromBuffer } from 'file-type'
-import type { Identity, JsonValue } from 'ultimabase'
+import type { Identity, JsonValue, QueryOptions } from 'ultimabase'
 import { isMaster, PublicError } from 'ultimabase'
 import type { FileInput, FileOptions, Inline } from './field.ts'
 import { bytesOf } from './memory.ts'
@@ -13,13 +13,12 @@ import { settled } from './storage.ts'
 import { runningOf } from './values.ts'
 
 /** What an upload says of its file. */
-export interface UploadOptions {
+export interface UploadOptions extends QueryOptions {
 	/** The field the file is for: `Post.cover`. */
 	readonly for: string
 	readonly name: string
 	/** The declared `Content-Type`, read only when the bytes say none. */
 	readonly type?: string | undefined
-	readonly as?: Identity | undefined
 }
 
 /** How many first bytes the type is read from, as `file-type` reads them. */

package/src/values.ts

@@ -21,7 +21,7 @@ export interface FileValue<
 	readonly name: string
 	readonly type: string
 	readonly size: number
-	/** Stable for a public file, presigned for one hour for a private one. */
+	/** Stable for a public file, presigned for a private one, the same for 15 minutes. */
 	readonly url: string
 	readonly inline: I
 	readonly variants: V