@velajs/cloudflare 1.28.0 → 1.30.0

package/dist/scheduled-event.js

@@ -0,0 +1,68 @@
+import { InjectionToken, Scope, defineProvider } from "@velajs/vela";
+import { SCHEDULE_INVOCATION_SEED } from "@velajs/vela/module-kit";
+//#region src/scheduled-event.ts
+/**
+* Request-scoped Cloudflare view of the scheduled trigger, seeded into each
+* `@Cron` job's invocation scope by the Cloudflare adapter. Inject it where a
+* job needs platform controls such as `noRetry()`; the job's argument stays
+* the portable `ScheduleInvocation`. It resolves only inside a scheduled
+* invocation; resolving it anywhere else throws. A cron job fired on demand
+* (Studio's run-now) receives a synthetic event: `cron` is the job's
+* expression and `noRetry()` does nothing.
+*
+* The token provides itself as request-scoped in every container, so a class
+* that injects it is request-scoped wherever the graph boots (a Worker, a
+* Durable Object, the CLI or a testing module) and is built only for an
+* invocation, never at bootstrap.
+*
+* @example
+* ```ts
+* @Injectable({ scope: Scope.REQUEST })
+* class Reports {
+*   constructor(@Inject(CLOUDFLARE_SCHEDULED_EVENT) private readonly trigger: CloudflareScheduledEvent) {}
+*
+*   @Cron('0 3 * * *', { dialect: 'cloudflare' })
+*   async nightly(tick: CronInvocation) {
+*     if (!(await this.upstreamAvailable(tick.signal))) this.trigger.noRetry();
+*   }
+* }
+* ```
+*/
+const CLOUDFLARE_SCHEDULED_EVENT = new InjectionToken("@velajs/cloudflare:scheduled-event", {
+	scope: Scope.REQUEST,
+	factory: () => {
+		throw new Error("CLOUDFLARE_SCHEDULED_EVENT can only be resolved inside a scheduled invocation: the Cloudflare adapter seeds it into each @Cron job scope for a cron trigger.");
+	}
+});
+/** @internal Freeze the injected view; `noRetry` keeps the native receiver. */
+function cloudflareScheduledEvent(event, scheduledTime) {
+	return Object.freeze({
+		cron: event.cron,
+		scheduledTime,
+		noRetry: () => {
+			event.noRetry?.();
+		}
+	});
+}
+/**
+* Seeds a cron job fired outside a trigger (Studio's run-now) the way a
+* trigger would: a synthetic event whose `cron` is the invocation's
+* expression, with its `scheduledTime` and a `noRetry()` that does nothing.
+* Interval jobs never run from Workers triggers, so they get no event.
+*/
+const seedScheduledEvent = (scope, invocation) => {
+	if (invocation.kind !== "cron") return;
+	scope.setRequestInstance(CLOUDFLARE_SCHEDULED_EVENT, cloudflareScheduledEvent({ cron: invocation.expression }, invocation.scheduledTime));
+};
+/**
+* @internal Provide `SCHEDULE_INVOCATION_SEED`, so jobs fired on demand get a
+* synthetic event. Each trigger seeds the real event into its jobs' scopes.
+*/
+function registerScheduledEventSeed(container) {
+	container.register(defineProvider(SCHEDULE_INVOCATION_SEED, { useValue: seedScheduledEvent }));
+	container.markGlobalToken(SCHEDULE_INVOCATION_SEED);
+}
+//#endregion
+export { CLOUDFLARE_SCHEDULED_EVENT, cloudflareScheduledEvent, registerScheduledEventSeed };
+
+//# sourceMappingURL=scheduled-event.js.map

package/dist/scheduled-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-event.js","names":[],"sources":["../src/scheduled-event.ts"],"sourcesContent":["import { InjectionToken, Scope, defineProvider } from '@velajs/vela';\nimport { SCHEDULE_INVOCATION_SEED } from '@velajs/vela/module-kit';\nimport type { ScheduleInvocationSeed, Container } from '@velajs/vela/module-kit';\n\n/**\n * The event a Worker's `scheduled()` export receives. The native\n * `ScheduledController` satisfies it; direct calls (tests, scripts) may omit\n * `scheduledTime`, which then defaults to the current time, and `noRetry`.\n */\nexport interface ScheduledEvent {\n  readonly cron: string;\n  readonly scheduledTime?: number;\n  noRetry?(): void;\n}\n\n/** The Cloudflare trigger behind the current scheduled invocation. */\nexport interface CloudflareScheduledEvent {\n  /** The trigger's exact cron string; it equals the invocation's `expression`. */\n  readonly cron: string;\n  /** The platform's scheduled time in Unix milliseconds. */\n  readonly scheduledTime: number;\n  /**\n   * Ask Cloudflare not to retry this trigger if the invocation fails. Already\n   * bound to the native controller, so it can be passed around or destructured.\n   * A no-op for direct calls that supplied no controller.\n   */\n  readonly noRetry: () => void;\n}\n\n/**\n * Request-scoped Cloudflare view of the scheduled trigger, seeded into each\n * `@Cron` job's invocation scope by the Cloudflare adapter. Inject it where a\n * job needs platform controls such as `noRetry()`; the job's argument stays\n * the portable `ScheduleInvocation`. It resolves only inside a scheduled\n * invocation; resolving it anywhere else throws. A cron job fired on demand\n * (Studio's run-now) receives a synthetic event: `cron` is the job's\n * expression and `noRetry()` does nothing.\n *\n * The token provides itself as request-scoped in every container, so a class\n * that injects it is request-scoped wherever the graph boots (a Worker, a\n * Durable Object, the CLI or a testing module) and is built only for an\n * invocation, never at bootstrap.\n *\n * @example\n * ```ts\n * @Injectable({ scope: Scope.REQUEST })\n * class Reports {\n *   constructor(@Inject(CLOUDFLARE_SCHEDULED_EVENT) private readonly trigger: CloudflareScheduledEvent) {}\n *\n *   @Cron('0 3 * * *', { dialect: 'cloudflare' })\n *   async nightly(tick: CronInvocation) {\n *     if (!(await this.upstreamAvailable(tick.signal))) this.trigger.noRetry();\n *   }\n * }\n * ```\n */\nexport const CLOUDFLARE_SCHEDULED_EVENT = new InjectionToken<CloudflareScheduledEvent>(\n  '@velajs/cloudflare:scheduled-event',\n  {\n    scope: Scope.REQUEST,\n    factory: () => {\n      throw new Error(\n        'CLOUDFLARE_SCHEDULED_EVENT can only be resolved inside a scheduled invocation: ' +\n          'the Cloudflare adapter seeds it into each @Cron job scope for a cron trigger.',\n      );\n    },\n  },\n);\n\n/** @internal Freeze the injected view; `noRetry` keeps the native receiver. */\nexport function cloudflareScheduledEvent(\n  event: ScheduledEvent,\n  scheduledTime: number,\n): CloudflareScheduledEvent {\n  return Object.freeze({\n    cron: event.cron,\n    scheduledTime,\n    noRetry: () => {\n      event.noRetry?.();\n    },\n  });\n}\n\n/**\n * Seeds a cron job fired outside a trigger (Studio's run-now) the way a\n * trigger would: a synthetic event whose `cron` is the invocation's\n * expression, with its `scheduledTime` and a `noRetry()` that does nothing.\n * Interval jobs never run from Workers triggers, so they get no event.\n */\nconst seedScheduledEvent: ScheduleInvocationSeed = (scope, invocation) => {\n  if (invocation.kind !== 'cron') return;\n  scope.setRequestInstance(\n    CLOUDFLARE_SCHEDULED_EVENT,\n    cloudflareScheduledEvent({ cron: invocation.expression }, invocation.scheduledTime),\n  );\n};\n\n/**\n * @internal Provide `SCHEDULE_INVOCATION_SEED`, so jobs fired on demand get a\n * synthetic event. Each trigger seeds the real event into its jobs' scopes.\n */\nexport function registerScheduledEventSeed(container: Container): void {\n  container.register(defineProvider(SCHEDULE_INVOCATION_SEED, { useValue: seedScheduledEvent }));\n  container.markGlobalToken(SCHEDULE_INVOCATION_SEED);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAa,6BAA6B,IAAI,eAC5C,sCACA;CACE,OAAO,MAAM;CACb,eAAe;EACb,MAAM,IAAI,MACR,8JAEF;CACF;AACF,CACF;;AAGA,SAAgB,yBACd,OACA,eAC0B;CAC1B,OAAO,OAAO,OAAO;EACnB,MAAM,MAAM;EACZ;EACA,eAAe;GACb,MAAM,UAAU;EAClB;CACF,CAAC;AACH;;;;;;;AAQA,MAAM,sBAA8C,OAAO,eAAe;CACxE,IAAI,WAAW,SAAS,QAAQ;CAChC,MAAM,mBACJ,4BACA,yBAAyB,EAAE,MAAM,WAAW,WAAW,GAAG,WAAW,aAAa,CACpF;AACF;;;;;AAMA,SAAgB,2BAA2B,WAA4B;CACrE,UAAU,SAAS,eAAe,0BAA0B,EAAE,UAAU,mBAAmB,CAAC,CAAC;CAC7F,UAAU,gBAAgB,wBAAwB;AACpD"}

package/dist/services/flagship-flag.driver.js

@@ -0,0 +1,52 @@
+//#region src/services/flagship-flag.driver.ts
+/**
+* {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.
+*
+* A thin, honest wrapper: each contract method maps 1:1 onto the binding's
+* corresponding value method, forwarding the caller's `fallback` (the binding's
+* `defaultValue`) and evaluation context. The binding resolves the fallback on
+* evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`
+* dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns
+* the never-throw guarantee.
+*
+* Build the driver inside a provider factory with the native environment:
+*
+* ```ts
+* FeatureFlagsModule.forRootAsync({
+*   inject: [ENV],
+*   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),
+* });
+* ```
+*
+* Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the
+* Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a
+* bare driver.
+*/
+var FlagshipFlagDriver = class {
+	name;
+	resolve;
+	constructor(binding, options = {}) {
+		this.resolve = typeof binding === "function" ? binding : () => binding;
+		this.name = options.name ?? "flagship";
+	}
+	getBoolean(key, fallback, ctx) {
+		return this.resolve().getBooleanValue(key, fallback, ctx);
+	}
+	getString(key, fallback, ctx) {
+		return this.resolve().getStringValue(key, fallback, ctx);
+	}
+	getNumber(key, fallback, ctx) {
+		return this.resolve().getNumberValue(key, fallback, ctx);
+	}
+	getObject(key, fallback, ctx) {
+		return this.resolve().getObjectValue(key, fallback, ctx);
+	}
+};
+/** Convenience factory for {@link FlagshipFlagDriver}. */
+function flagshipFlagDriver(binding, options) {
+	return new FlagshipFlagDriver(binding, options);
+}
+//#endregion
+export { FlagshipFlagDriver, flagshipFlagDriver };
+
+//# sourceMappingURL=flagship-flag.driver.js.map

package/dist/services/flagship-flag.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagship-flag.driver.js","names":[],"sources":["../../src/services/flagship-flag.driver.ts"],"sourcesContent":["import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\n/**\n * The subset of a Cloudflare **Flagship** binding this driver evaluates against\n * — the four typed value methods. The binding itself returns the supplied\n * `defaultValue` on evaluation errors; transport-level failures reject and are\n * left to propagate (never-throw is the service layer's job, not the driver's).\n *\n * @see https://developers.cloudflare.com/flagship/binding/\n */\nexport interface FlagshipBinding {\n  getBooleanValue(key: string, defaultValue: boolean, context?: FlagContext): Promise<boolean>;\n  getStringValue(key: string, defaultValue: string, context?: FlagContext): Promise<string>;\n  getNumberValue(key: string, defaultValue: number, context?: FlagContext): Promise<number>;\n  getObjectValue(key: string, defaultValue: object, context?: FlagContext): Promise<unknown>;\n}\n\nexport interface FlagshipFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"flagship\"`. */\n  name?: string;\n}\n\n/**\n * {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.\n *\n * A thin, honest wrapper: each contract method maps 1:1 onto the binding's\n * corresponding value method, forwarding the caller's `fallback` (the binding's\n * `defaultValue`) and evaluation context. The binding resolves the fallback on\n * evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`\n * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns\n * the never-throw guarantee.\n *\n * Build the driver inside a provider factory with the native environment:\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),\n * });\n * ```\n *\n * Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the\n * Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a\n * bare driver.\n */\nexport class FlagshipFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly resolve: () => FlagshipBinding;\n\n  constructor(\n    binding: FlagshipBinding | (() => FlagshipBinding),\n    options: FlagshipFlagDriverOptions = {},\n  ) {\n    this.resolve = typeof binding === 'function' ? binding : () => binding;\n    this.name = options.name ?? 'flagship';\n  }\n\n  getBoolean(key: string, fallback: boolean, ctx?: FlagContext): Promise<boolean> {\n    return this.resolve().getBooleanValue(key, fallback, ctx);\n  }\n\n  getString(key: string, fallback: string, ctx?: FlagContext): Promise<string> {\n    return this.resolve().getStringValue(key, fallback, ctx);\n  }\n\n  getNumber(key: string, fallback: number, ctx?: FlagContext): Promise<number> {\n    return this.resolve().getNumberValue(key, fallback, ctx);\n  }\n\n  getObject(key: string, fallback: object, ctx?: FlagContext): Promise<unknown> {\n    return this.resolve().getObjectValue(key, fallback, ctx);\n  }\n}\n\n/** Convenience factory for {@link FlagshipFlagDriver}. */\nexport function flagshipFlagDriver(\n  binding: FlagshipBinding | (() => FlagshipBinding),\n  options?: FlagshipFlagDriverOptions,\n): FlagshipFlagDriver {\n  return new FlagshipFlagDriver(binding, options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa,qBAAb,MAA6D;CAC3D;CACA;CAEA,YACE,SACA,UAAqC,CAAC,GACtC;EACA,KAAK,UAAU,OAAO,YAAY,aAAa,gBAAgB;EAC/D,KAAK,OAAO,QAAQ,QAAQ;CAC9B;CAEA,WAAW,KAAa,UAAmB,KAAqC;EAC9E,OAAO,KAAK,QAAQ,CAAC,CAAC,gBAAgB,KAAK,UAAU,GAAG;CAC1D;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAqC;EAC5E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;AACF;;AAGA,SAAgB,mBACd,SACA,SACoB;CACpB,OAAO,IAAI,mBAAmB,SAAS,OAAO;AAChD"}

package/dist/services/kv-cache.store.js

@@ -0,0 +1,82 @@
+//#region src/services/kv-cache.store.ts
+/**
+* Native KV JSON value store. Metadata retains logical expiry even when KV's
+* physical retention rounds up to its 60-second minimum. Legacy values without
+* metadata remain readable, but cannot safely backfill another tier.
+*/
+var KVCacheStore = class {
+	ns;
+	constructor(ns) {
+		this.ns = ns;
+	}
+	async get(key) {
+		return (await this.getEntry(key))?.value;
+	}
+	async getEntry(key) {
+		const { value, metadata } = await this.ns.getWithMetadata(key, "json");
+		if (value === null) return void 0;
+		if (typeof metadata === "object" && metadata !== null && "velaCacheExpiresAt" in metadata) {
+			const expiresAt = metadata.velaCacheExpiresAt;
+			if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= Date.now()) return void 0;
+			return {
+				value,
+				expiresAt
+			};
+		}
+		return { value };
+	}
+	async set(key, value, ttl) {
+		if (ttl !== void 0 && (!Number.isFinite(ttl) || ttl < 0)) throw new TypeError("Cache TTL must be finite and nonnegative.");
+		if (ttl !== void 0) return this.setEntry(key, {
+			value,
+			expiresAt: Date.now() + ttl * 1e3
+		});
+		await this.ns.put(key, JSON.stringify(value));
+	}
+	async setEntry(key, entry) {
+		if (!Number.isFinite(entry.expiresAt)) throw new TypeError("Cache expiry must be finite.");
+		const remaining = (entry.expiresAt - Date.now()) / 1e3;
+		if (remaining <= 0) return this.del(key);
+		await this.ns.put(key, JSON.stringify(entry.value), {
+			expirationTtl: Math.max(60, Math.ceil(remaining)),
+			metadata: { velaCacheExpiresAt: entry.expiresAt }
+		});
+	}
+	async del(key) {
+		await this.ns.delete(key);
+	}
+	/** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */
+	async clear() {
+		let cursor;
+		do {
+			const list = await this.ns.list(cursor ? { cursor } : void 0);
+			await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));
+			cursor = list.list_complete ? void 0 : list.cursor;
+		} while (cursor);
+	}
+};
+/**
+* Optional, eventually consistent generation store. Use a dedicated KV namespace
+* without TTL/lifecycle cleanup. Never delete/reset generations while entries can
+* survive. Concurrent writes and cached/negative reads prevent strong invalidation;
+* this is unsuitable for strict read-after-write or authorization revocation.
+*/
+var KVCacheInvalidationStore = class {
+	ns;
+	constructor(ns) {
+		this.ns = ns;
+	}
+	async getVersion(key) {
+		const value = await this.ns.get(key, "json");
+		if (value === null) return "initial";
+		if (typeof value !== "string" || value.length === 0 || value.length > 2048) throw new TypeError("Invalid cache generation.");
+		return value;
+	}
+	async invalidate(key) {
+		await this.ns.put(key, JSON.stringify(crypto.randomUUID()));
+	}
+};
+//#endregion
+export { KVCacheInvalidationStore, KVCacheStore };
+
+//# sourceMappingURL=kv-cache.store.js.map

package/dist/services/kv-cache.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kv-cache.store.js","names":[],"sources":["../../src/services/kv-cache.store.ts"],"sourcesContent":["import type {\n  AsyncCacheStore,\n  CacheEntryReader,\n  CacheEntryWriter,\n  CacheEntry,\n  CacheInvalidationStore,\n} from '@velajs/vela/cache';\n\n/**\n * Native KV JSON value store. Metadata retains logical expiry even when KV's\n * physical retention rounds up to its 60-second minimum. Legacy values without\n * metadata remain readable, but cannot safely backfill another tier.\n */\nexport class KVCacheStore implements AsyncCacheStore, CacheEntryReader, CacheEntryWriter {\n  constructor(private readonly ns: KVNamespace) {}\n\n  async get(key: string): Promise<unknown> {\n    return (await this.getEntry(key))?.value;\n  }\n\n  async getEntry(key: string): Promise<{ value: unknown; expiresAt?: number } | undefined> {\n    const { value, metadata } = await this.ns.getWithMetadata<unknown, unknown>(key, 'json');\n    if (value === null) return undefined;\n    if (typeof metadata === 'object' && metadata !== null && 'velaCacheExpiresAt' in metadata) {\n      const expiresAt = metadata.velaCacheExpiresAt;\n      if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= Date.now())\n        return undefined;\n      return { value, expiresAt };\n    }\n    return { value };\n  }\n\n  async set(key: string, value: unknown, ttl?: number): Promise<void> {\n    if (ttl !== undefined && (!Number.isFinite(ttl) || ttl < 0))\n      throw new TypeError('Cache TTL must be finite and nonnegative.');\n    if (ttl !== undefined) return this.setEntry(key, { value, expiresAt: Date.now() + ttl * 1000 });\n    await this.ns.put(key, JSON.stringify(value));\n  }\n\n  async setEntry(key: string, entry: CacheEntry): Promise<void> {\n    if (!Number.isFinite(entry.expiresAt)) throw new TypeError('Cache expiry must be finite.');\n    const remaining = (entry.expiresAt - Date.now()) / 1000;\n    if (remaining <= 0) return this.del(key);\n    await this.ns.put(key, JSON.stringify(entry.value), {\n      expirationTtl: Math.max(60, Math.ceil(remaining)),\n      metadata: { velaCacheExpiresAt: entry.expiresAt },\n    });\n  }\n\n  async del(key: string): Promise<void> {\n    await this.ns.delete(key);\n  }\n\n  /** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */\n  async clear(): Promise<void> {\n    let cursor: string | undefined;\n    do {\n      const list = await this.ns.list(cursor ? { cursor } : undefined);\n      await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));\n      cursor = list.list_complete ? undefined : list.cursor;\n    } while (cursor);\n  }\n}\n\n/**\n * Optional, eventually consistent generation store. Use a dedicated KV namespace\n * without TTL/lifecycle cleanup. Never delete/reset generations while entries can\n * survive. Concurrent writes and cached/negative reads prevent strong invalidation;\n * this is unsuitable for strict read-after-write or authorization revocation.\n */\nexport class KVCacheInvalidationStore implements CacheInvalidationStore {\n  constructor(private readonly ns: KVNamespace) {}\n  async getVersion(key: string): Promise<string> {\n    const value: unknown = await this.ns.get(key, 'json');\n    if (value === null) return 'initial';\n    if (typeof value !== 'string' || value.length === 0 || value.length > 2048)\n      throw new TypeError('Invalid cache generation.');\n    return value;\n  }\n  async invalidate(key: string): Promise<void> {\n    await this.ns.put(key, JSON.stringify(crypto.randomUUID()));\n  }\n}\n"],"mappings":";;;;;;AAaA,IAAa,eAAb,MAAyF;CAC1D;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAE/C,MAAM,IAAI,KAA+B;EACvC,QAAQ,MAAM,KAAK,SAAS,GAAG,EAAA,EAAI;CACrC;CAEA,MAAM,SAAS,KAA0E;EACvF,MAAM,EAAE,OAAO,aAAa,MAAM,KAAK,GAAG,gBAAkC,KAAK,MAAM;EACvF,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,wBAAwB,UAAU;GACzF,MAAM,YAAY,SAAS;GAC3B,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,IAAI,GACxF,OAAO,KAAA;GACT,OAAO;IAAE;IAAO;GAAU;EAC5B;EACA,OAAO,EAAE,MAAM;CACjB;CAEA,MAAM,IAAI,KAAa,OAAgB,KAA6B;EAClE,IAAI,QAAQ,KAAA,MAAc,CAAC,OAAO,SAAS,GAAG,KAAK,MAAM,IACvD,MAAM,IAAI,UAAU,2CAA2C;EACjE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK,SAAS,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,MAAM;EAAK,CAAC;EAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC;CAC9C;CAEA,MAAM,SAAS,KAAa,OAAkC;EAC5D,IAAI,CAAC,OAAO,SAAS,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,8BAA8B;EACzF,MAAM,aAAa,MAAM,YAAY,KAAK,IAAI,KAAK;EACnD,IAAI,aAAa,GAAG,OAAO,KAAK,IAAI,GAAG;EACvC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;GAClD,eAAe,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;GAChD,UAAU,EAAE,oBAAoB,MAAM,UAAU;EAClD,CAAC;CACH;CAEA,MAAM,IAAI,KAA4B;EACpC,MAAM,KAAK,GAAG,OAAO,GAAG;CAC1B;;CAGA,MAAM,QAAuB;EAC3B,IAAI;EACJ,GAAG;GACD,MAAM,OAAO,MAAM,KAAK,GAAG,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;GAC/D,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,UAAU,KAAK,GAAG,OAAO,MAAM,IAAI,CAAC,CAAC;GACtE,SAAS,KAAK,gBAAgB,KAAA,IAAY,KAAK;EACjD,SAAS;CACX;AACF;;;;;;;AAQA,IAAa,2BAAb,MAAwE;CACzC;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAC/C,MAAM,WAAW,KAA8B;EAC7C,MAAM,QAAiB,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM;EACpD,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACpE,MAAM,IAAI,UAAU,2BAA2B;EACjD,OAAO;CACT;CACA,MAAM,WAAW,KAA4B;EAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,OAAO,WAAW,CAAC,CAAC;CAC5D;AACF"}

package/dist/services/kv-flag.driver.js

@@ -0,0 +1,62 @@
+//#region src/services/kv-flag.driver.ts
+/**
+* Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON
+* values under an optional key prefix and read with `get(key, 'json')`. Reads
+* are type-checked against the requested type: a missing key or a value of the
+* wrong JSON type returns the caller's `fallback`. KV has no targeting, so the
+* evaluation context is ignored.
+*
+* The driver stays honest — it does **not** swallow errors. A KV failure (or a
+* `SyntaxError` from a malformed stored value) propagates; the never-throw
+* guarantee lives in `@velajs/feature-flags`'s service layer.
+*
+* Placed like {@link KVCacheStore}: construct it in a wiring factory over a
+* resolved {@link KVNamespace}.
+*
+* ```ts
+* FeatureFlagsModule.forRootAsync({
+*   inject: [ENV],
+*   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),
+* });
+* ```
+*/
+var KvFlagDriver = class {
+	ns;
+	name;
+	prefix;
+	constructor(ns, options = {}) {
+		this.ns = ns;
+		this.name = options.name ?? "kv";
+		this.prefix = options.prefix ?? "";
+	}
+	getBoolean(key, fallback, _ctx) {
+		return this.read(key, fallback, (v) => typeof v === "boolean");
+	}
+	getString(key, fallback, _ctx) {
+		return this.read(key, fallback, (v) => typeof v === "string");
+	}
+	getNumber(key, fallback, _ctx) {
+		return this.read(key, fallback, (v) => typeof v === "number");
+	}
+	getObject(key, fallback, _ctx) {
+		return this.read(key, fallback, (v) => typeof v === "object" && v !== null);
+	}
+	/**
+	* Reads and JSON-parses the (prefixed) key, returning the parsed value only
+	* when `matches` accepts its type; otherwise the caller's fallback. A missing
+	* key reads as `null` → fallback. Read/parse errors are left to propagate.
+	*/
+	async read(key, fallback, matches) {
+		const value = await this.ns.get(this.prefix + key, "json");
+		if (value === null || value === void 0) return fallback;
+		return matches(value) ? value : fallback;
+	}
+};
+/** Convenience factory for {@link KvFlagDriver}. */
+function kvFlagDriver(kv, options) {
+	return new KvFlagDriver(kv, options);
+}
+//#endregion
+export { KvFlagDriver, kvFlagDriver };
+
+//# sourceMappingURL=kv-flag.driver.js.map

package/dist/services/kv-flag.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kv-flag.driver.js","names":[],"sources":["../../src/services/kv-flag.driver.ts"],"sourcesContent":["import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\nexport interface KvFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"kv\"`. */\n  name?: string;\n  /** Prefix prepended to every flag key before the KV read. Default `\"\"` (none). */\n  prefix?: string;\n}\n\n/**\n * Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON\n * values under an optional key prefix and read with `get(key, 'json')`. Reads\n * are type-checked against the requested type: a missing key or a value of the\n * wrong JSON type returns the caller's `fallback`. KV has no targeting, so the\n * evaluation context is ignored.\n *\n * The driver stays honest — it does **not** swallow errors. A KV failure (or a\n * `SyntaxError` from a malformed stored value) propagates; the never-throw\n * guarantee lives in `@velajs/feature-flags`'s service layer.\n *\n * Placed like {@link KVCacheStore}: construct it in a wiring factory over a\n * resolved {@link KVNamespace}.\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),\n * });\n * ```\n */\nexport class KvFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly prefix: string;\n\n  constructor(\n    private readonly ns: KVNamespace,\n    options: KvFlagDriverOptions = {},\n  ) {\n    this.name = options.name ?? 'kv';\n    this.prefix = options.prefix ?? '';\n  }\n\n  getBoolean(key: string, fallback: boolean, _ctx?: FlagContext): Promise<boolean> {\n    return this.read(key, fallback, (v) => typeof v === 'boolean');\n  }\n\n  getString(key: string, fallback: string, _ctx?: FlagContext): Promise<string> {\n    return this.read(key, fallback, (v) => typeof v === 'string');\n  }\n\n  getNumber(key: string, fallback: number, _ctx?: FlagContext): Promise<number> {\n    return this.read(key, fallback, (v) => typeof v === 'number');\n  }\n\n  getObject(key: string, fallback: object, _ctx?: FlagContext): Promise<unknown> {\n    return this.read(key, fallback, (v) => typeof v === 'object' && v !== null);\n  }\n\n  /**\n   * Reads and JSON-parses the (prefixed) key, returning the parsed value only\n   * when `matches` accepts its type; otherwise the caller's fallback. A missing\n   * key reads as `null` → fallback. Read/parse errors are left to propagate.\n   */\n  private async read<T>(\n    key: string,\n    fallback: T,\n    matches: (value: unknown) => value is T,\n  ): Promise<T> {\n    const value = await this.ns.get(this.prefix + key, 'json');\n    if (value === null || value === undefined) return fallback;\n    return matches(value) ? value : fallback;\n  }\n}\n\n/** Convenience factory for {@link KvFlagDriver}. */\nexport function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver {\n  return new KvFlagDriver(kv, options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,eAAb,MAAuD;CAKlC;CAJnB;CACA;CAEA,YACE,IACA,UAA+B,CAAC,GAChC;EAFiB,KAAA,KAAA;EAGjB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,SAAS,QAAQ,UAAU;CAClC;CAEA,WAAW,KAAa,UAAmB,MAAsC;EAC/E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS;CAC/D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAsC;EAC7E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;CAC5E;;;;;;CAOA,MAAc,KACZ,KACA,UACA,SACY;EACZ,MAAM,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM;EACzD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;EAClD,OAAO,QAAQ,KAAK,IAAI,QAAQ;CAClC;AACF;;AAGA,SAAgB,aAAa,IAAiB,SAA6C;CACzF,OAAO,IAAI,aAAa,IAAI,OAAO;AACrC"}

package/dist/storage/r2-storage.driver.js

@@ -0,0 +1,67 @@
+import { encodeStorageKeyClaim } from "./storage-key-claim.js";
+import { STORAGE_SIGNED_URL_PURPOSE, signUrl } from "@velajs/vela/security";
+//#region src/storage/r2-storage.driver.ts
+/** Base path of the StorageController presign-proxy route. */
+const STORAGE_ROUTE_BASE = "/storage";
+/** {@link StorageDriver} over a Cloudflare R2 bucket. */
+var R2StorageDriver = class {
+	config;
+	constructor(config) {
+		this.config = config;
+	}
+	async upload(body, path, options) {
+		await this.config.bucket.put(path, body, {
+			httpMetadata: options.mimeType ? { contentType: options.mimeType } : void 0,
+			customMetadata: options.metadata
+		});
+		return {
+			path,
+			disk: this.config.disk,
+			size: options.size,
+			mimeType: options.mimeType ?? "application/octet-stream",
+			uploadedAt: /* @__PURE__ */ new Date()
+		};
+	}
+	async download(path) {
+		const obj = await this.config.bucket.get(path);
+		if (!obj) throw new Error(`Storage object not found at "${path}".`);
+		return {
+			toStream: () => obj.body,
+			toArrayBuffer: () => obj.arrayBuffer(),
+			toText: () => obj.text(),
+			contentType: obj.httpMetadata?.contentType ?? "application/octet-stream",
+			size: obj.size,
+			metadata: obj.customMetadata
+		};
+	}
+	async delete(path) {
+		await this.config.bucket.delete(path);
+	}
+	async exists(path) {
+		return await this.config.bucket.head(path) !== null;
+	}
+	async getPresignedUrl(path, method, expiresIn) {
+		if (!this.config.secret) throw new Error("A signing secret is required for presigned URLs (set APP_SECRET).");
+		if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) throw new Error(`Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`);
+		const claim = encodeStorageKeyClaim(path);
+		const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;
+		const query = new URLSearchParams({
+			key: claim,
+			method
+		});
+		return {
+			url: await signUrl(`${routePath}?${query}`, this.config.secret, {
+				expiresIn,
+				method,
+				purpose: STORAGE_SIGNED_URL_PURPOSE
+			}),
+			method,
+			expiresIn,
+			expiresAt: new Date(Date.now() + expiresIn * 1e3)
+		};
+	}
+};
+//#endregion
+export { R2StorageDriver, STORAGE_ROUTE_BASE };
+
+//# sourceMappingURL=r2-storage.driver.js.map

package/dist/storage/r2-storage.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-storage.driver.js","names":[],"sources":["../../src/storage/r2-storage.driver.ts"],"sourcesContent":["import type {\n  DownloadResult,\n  PresignedUrlResult,\n  PresignMethod,\n  StorageBody,\n  StorageDriver,\n  UploadOptions,\n  UploadResult,\n} from '@velajs/vela/storage';\nimport { signUrl, STORAGE_SIGNED_URL_PURPOSE } from '@velajs/vela/security';\nimport { encodeStorageKeyClaim } from './storage-key-claim';\n\n/** Base path of the StorageController presign-proxy route. */\nexport const STORAGE_ROUTE_BASE = '/storage';\n\nexport interface R2StorageDriverConfig {\n  disk: string;\n  bucket: R2Bucket;\n  /** HMAC secret for presigned URLs (typically env.APP_SECRET). */\n  secret?: string;\n}\n\n/** {@link StorageDriver} over a Cloudflare R2 bucket. */\nexport class R2StorageDriver implements StorageDriver {\n  constructor(private readonly config: R2StorageDriverConfig) {}\n\n  async upload(body: StorageBody, path: string, options: UploadOptions): Promise<UploadResult> {\n    await this.config.bucket.put(\n      path,\n      body as ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob | null,\n      {\n        httpMetadata: options.mimeType ? { contentType: options.mimeType } : undefined,\n        customMetadata: options.metadata,\n      },\n    );\n    return {\n      path,\n      disk: this.config.disk,\n      size: options.size,\n      mimeType: options.mimeType ?? 'application/octet-stream',\n      uploadedAt: new Date(),\n    };\n  }\n\n  async download(path: string): Promise<DownloadResult> {\n    const obj = await this.config.bucket.get(path);\n    if (!obj) throw new Error(`Storage object not found at \"${path}\".`);\n    return {\n      toStream: () => obj.body as ReadableStream,\n      toArrayBuffer: () => obj.arrayBuffer(),\n      toText: () => obj.text(),\n      contentType: obj.httpMetadata?.contentType ?? 'application/octet-stream',\n      size: obj.size,\n      metadata: obj.customMetadata,\n    };\n  }\n\n  async delete(path: string): Promise<void> {\n    await this.config.bucket.delete(path);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    return (await this.config.bucket.head(path)) !== null;\n  }\n\n  async getPresignedUrl(\n    path: string,\n    method: PresignMethod,\n    expiresIn: number,\n  ): Promise<PresignedUrlResult> {\n    if (!this.config.secret) {\n      throw new Error('A signing secret is required for presigned URLs (set APP_SECRET).');\n    }\n    // Defend the direct-driver path too: a non-finite/non-positive expiry would\n    // make signUrl omit `expires`, yielding a never-expiring URL.\n    if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) {\n      throw new Error(\n        `Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`,\n      );\n    }\n    // The object key is an opaque signed query claim, never a URL path. This\n    // prevents WHATWG path normalization / multi-decode behavior from turning\n    // an encoded key into a different storage capability.\n    const claim = encodeStorageKeyClaim(path);\n    const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;\n    const query = new URLSearchParams({ key: claim, method });\n    const url = await signUrl(`${routePath}?${query}`, this.config.secret, {\n      expiresIn,\n      method,\n      purpose: STORAGE_SIGNED_URL_PURPOSE,\n    });\n    return { url, method, expiresIn, expiresAt: new Date(Date.now() + expiresIn * 1000) };\n  }\n}\n"],"mappings":";;;;AAaA,MAAa,qBAAqB;;AAUlC,IAAa,kBAAb,MAAsD;CACvB;CAA7B,YAAY,QAAgD;EAA/B,KAAA,SAAA;CAAgC;CAE7D,MAAM,OAAO,MAAmB,MAAc,SAA+C;EAC3F,MAAM,KAAK,OAAO,OAAO,IACvB,MACA,MACA;GACE,cAAc,QAAQ,WAAW,EAAE,aAAa,QAAQ,SAAS,IAAI,KAAA;GACrE,gBAAgB,QAAQ;EAC1B,CACF;EACA,OAAO;GACL;GACA,MAAM,KAAK,OAAO;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ,YAAY;GAC9B,4BAAY,IAAI,KAAK;EACvB;CACF;CAEA,MAAM,SAAS,MAAuC;EACpD,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,IAAI,IAAI;EAC7C,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG;EAClE,OAAO;GACL,gBAAgB,IAAI;GACpB,qBAAqB,IAAI,YAAY;GACrC,cAAc,IAAI,KAAK;GACvB,aAAa,IAAI,cAAc,eAAe;GAC9C,MAAM,IAAI;GACV,UAAU,IAAI;EAChB;CACF;CAEA,MAAM,OAAO,MAA6B;EACxC,MAAM,KAAK,OAAO,OAAO,OAAO,IAAI;CACtC;CAEA,MAAM,OAAO,MAAgC;EAC3C,OAAQ,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,MAAO;CACnD;CAEA,MAAM,gBACJ,MACA,QACA,WAC6B;EAC7B,IAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,MAAM,mEAAmE;EAIrF,IAAI,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,GACnD,MAAM,IAAI,MACR,iCAAiC,UAAU,qCAC7C;EAKF,MAAM,QAAQ,sBAAsB,IAAI;EACxC,MAAM,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,KAAK,OAAO,IAAI;EAC9E,MAAM,QAAQ,IAAI,gBAAgB;GAAE,KAAK;GAAO;EAAO,CAAC;EAMxD,OAAO;GAAE,KAAA,MALS,QAAQ,GAAG,UAAU,GAAG,SAAS,KAAK,OAAO,QAAQ;IACrE;IACA;IACA,SAAS;GACX,CAAC;GACa;GAAQ;GAAW,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;EAAE;CACtF;AACF"}

package/dist/storage/storage-key-claim.js

@@ -0,0 +1,74 @@
+//#region src/storage/storage-key-claim.ts
+/** R2-compatible object-key claim bound. Keeps decode work predictably small. */
+const MAX_STORAGE_KEY_BYTES = 1024;
+const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+const ROOT_TOKEN_PATTERNS = {
+	date: "\\d{4}-\\d{2}-\\d{2}",
+	year: "\\d{4}",
+	month: "(?:0[1-9]|1[0-2])",
+	day: "(?:0[1-9]|[12]\\d|3[01])",
+	uuid: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}"
+};
+/** Encode an object key as an opaque, canonical base64url query claim. */
+function encodeStorageKeyClaim(key) {
+	const bytes = new TextEncoder().encode(key);
+	if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */
+function decodeStorageKeyClaim(claim) {
+	try {
+		if (claim.length === 0 || claim.length > Math.ceil(MAX_STORAGE_KEY_BYTES * 4 / 3) || !BASE64URL_RE.test(claim) || claim.length % 4 === 1) return;
+		const base64 = claim.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = atob(padded);
+		const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) return void 0;
+		const decoded = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes);
+		return encodeStorageKeyClaim(decoded) === claim ? decoded : void 0;
+	} catch {
+		return;
+	}
+}
+function isDotSegment(segment) {
+	let decoded = segment;
+	for (let i = 0; i < 2; i++) {
+		if (decoded === "" || decoded === "." || decoded === "..") return true;
+		try {
+			const next = decodeURIComponent(decoded);
+			if (next === decoded) break;
+			decoded = next;
+		} catch {
+			break;
+		}
+	}
+	return decoded === "" || decoded === "." || decoded === "..";
+}
+function rootSegmentPattern(segment) {
+	let pattern = "";
+	let cursor = 0;
+	for (const match of segment.matchAll(/\{(date|year|month|day|uuid)\}/g)) {
+		pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		pattern += ROOT_TOKEN_PATTERNS[match[1]];
+		cursor = match.index + match[0].length;
+	}
+	pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return pattern;
+}
+/** Assert a canonical key is beneath a static or templated configured root. */
+function isStorageKeyWithinRoot(key, root) {
+	const segments = (root ?? "").split(/[/\\]+/).filter((segment) => !isDotSegment(segment));
+	if (segments.length === 0) return key.length > 0;
+	const rootPattern = segments.map(rootSegmentPattern).join("/");
+	return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);
+}
+//#endregion
+export { MAX_STORAGE_KEY_BYTES, decodeStorageKeyClaim, encodeStorageKeyClaim, isStorageKeyWithinRoot };
+
+//# sourceMappingURL=storage-key-claim.js.map

package/dist/storage/storage-key-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-key-claim.js","names":[],"sources":["../../src/storage/storage-key-claim.ts"],"sourcesContent":["/** R2-compatible object-key claim bound. Keeps decode work predictably small. */\nexport const MAX_STORAGE_KEY_BYTES = 1024;\n\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst ROOT_TOKEN_PATTERNS: Record<string, string> = {\n  date: '\\\\d{4}-\\\\d{2}-\\\\d{2}',\n  year: '\\\\d{4}',\n  month: '(?:0[1-9]|1[0-2])',\n  day: '(?:0[1-9]|[12]\\\\d|3[01])',\n  uuid: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}',\n};\n\n/** Encode an object key as an opaque, canonical base64url query claim. */\nexport function encodeStorageKeyClaim(key: string): string {\n  const bytes = new TextEncoder().encode(key);\n  if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) {\n    throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);\n  }\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */\nexport function decodeStorageKeyClaim(claim: string): string | undefined {\n  try {\n    if (\n      claim.length === 0 ||\n      claim.length > Math.ceil((MAX_STORAGE_KEY_BYTES * 4) / 3) ||\n      !BASE64URL_RE.test(claim) ||\n      claim.length % 4 === 1\n    ) {\n      return undefined;\n    }\n    const base64 = claim.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n    if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) return undefined;\n    const decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);\n    return encodeStorageKeyClaim(decoded) === claim ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isDotSegment(segment: string): boolean {\n  let decoded = segment;\n  for (let i = 0; i < 2; i++) {\n    if (decoded === '' || decoded === '.' || decoded === '..') return true;\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      break;\n    }\n  }\n  return decoded === '' || decoded === '.' || decoded === '..';\n}\n\nfunction rootSegmentPattern(segment: string): string {\n  let pattern = '';\n  let cursor = 0;\n  for (const match of segment.matchAll(/\\{(date|year|month|day|uuid)\\}/g)) {\n    pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n    pattern += ROOT_TOKEN_PATTERNS[match[1]!]!;\n    cursor = match.index! + match[0].length;\n  }\n  pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return pattern;\n}\n\n/** Assert a canonical key is beneath a static or templated configured root. */\nexport function isStorageKeyWithinRoot(key: string, root: string | undefined): boolean {\n  const segments = (root ?? '').split(/[/\\\\]+/).filter((segment) => !isDotSegment(segment));\n  if (segments.length === 0) return key.length > 0;\n  const rootPattern = segments.map(rootSegmentPattern).join('/');\n  return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);\n}\n"],"mappings":";;AACA,MAAa,wBAAwB;AAErC,MAAM,eAAe;AACrB,MAAM,sBAA8C;CAClD,MAAM;CACN,MAAM;CACN,OAAO;CACP,KAAK;CACL,MAAM;AACR;;AAGA,SAAgB,sBAAsB,KAAqB;CACzD,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;CAC1C,IAAI,MAAM,eAAe,KAAK,MAAM,aAAa,uBAC/C,MAAM,IAAI,MAAM,yBAAyB,sBAAsB,aAAa;CAE9E,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,SAAgB,sBAAsB,OAAmC;CACvE,IAAI;EACF,IACE,MAAM,WAAW,KACjB,MAAM,SAAS,KAAK,KAAM,wBAAwB,IAAK,CAAC,KACxD,CAAC,aAAa,KAAK,KAAK,KACxB,MAAM,SAAS,MAAM,GAErB;EAEF,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;EAChE,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,QAAQ,IAAI,WAAW,IAAI,YAAY,OAAO,MAAM,CAAC;EAC3D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;EACtE,IAAI,MAAM,eAAe,KAAK,MAAM,aAAa,uBAAuB,OAAO,KAAA;EAC/E,MAAM,UAAU,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,KAAK;EACxF,OAAO,sBAAsB,OAAO,MAAM,QAAQ,UAAU,KAAA;CAC9D,QAAQ;EACN;CACF;AACF;AAEA,SAAS,aAAa,SAA0B;CAC9C,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,IAAI,YAAY,MAAM,YAAY,OAAO,YAAY,MAAM,OAAO;EAClE,IAAI;GACF,MAAM,OAAO,mBAAmB,OAAO;GACvC,IAAI,SAAS,SAAS;GACtB,UAAU;EACZ,QAAQ;GACN;EACF;CACF;CACA,OAAO,YAAY,MAAM,YAAY,OAAO,YAAY;AAC1D;AAEA,SAAS,mBAAmB,SAAyB;CACnD,IAAI,UAAU;CACd,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ,SAAS,iCAAiC,GAAG;EACvE,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,QAAQ,uBAAuB,MAAM;EACnF,WAAW,oBAAoB,MAAM;EACrC,SAAS,MAAM,QAAS,MAAM,EAAE,CAAC;CACnC;CACA,WAAW,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,uBAAuB,MAAM;CACtE,OAAO;AACT;;AAGA,SAAgB,uBAAuB,KAAa,MAAmC;CACrF,MAAM,YAAY,QAAQ,GAAA,CAAI,MAAM,QAAQ,CAAC,CAAC,QAAQ,YAAY,CAAC,aAAa,OAAO,CAAC;CACxF,IAAI,SAAS,WAAW,GAAG,OAAO,IAAI,SAAS;CAC/C,MAAM,cAAc,SAAS,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;CAC7D,OAAO,IAAI,OAAO,OAAO,YAAY,SAAS,CAAC,CAAC,KAAK,GAAG;AAC1D"}

package/dist/storage/storage-manager.service.js

@@ -0,0 +1,38 @@
+import { STORAGE_OPTIONS } from "./storage.tokens.js";
+import { R2StorageDriver } from "./r2-storage.driver.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorateMetadata.js";
+import __decorateParam from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorateParam.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorate.js";
+import { Inject, Injectable } from "@velajs/vela";
+//#region src/storage/storage-manager.service.ts
+let StorageManagerService = class StorageManagerService {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	hasDisk(disk) {
+		return this.options.disks.some((d) => d.disk === disk);
+	}
+	getDiskConfig(disk) {
+		const config = this.options.disks.find((d) => d.disk === disk);
+		if (!config) throw new Error(`Storage disk "${disk}" is not configured.`);
+		return config;
+	}
+	getDriver(disk) {
+		const config = this.getDiskConfig(disk);
+		return new R2StorageDriver({
+			disk,
+			bucket: config.bucket,
+			secret: this.options.secret
+		});
+	}
+};
+StorageManagerService = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(STORAGE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [Object])
+], StorageManagerService);
+//#endregion
+export { StorageManagerService };
+
+//# sourceMappingURL=storage-manager.service.js.map

package/dist/storage/storage-manager.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-manager.service.js","names":[],"sources":["../../src/storage/storage-manager.service.ts"],"sourcesContent":["import { Inject, Injectable } from '@velajs/vela';\nimport { R2StorageDriver } from './r2-storage.driver';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { DiskConfig, StorageModuleOptions } from './storage.types';\n\n@Injectable()\nexport class StorageManagerService {\n  constructor(@Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions) {}\n\n  hasDisk(disk: string): boolean {\n    return this.options.disks.some((d) => d.disk === disk);\n  }\n\n  getDiskConfig(disk: string): DiskConfig {\n    const config = this.options.disks.find((d) => d.disk === disk);\n    if (!config) throw new Error(`Storage disk \"${disk}\" is not configured.`);\n    return config;\n  }\n\n  getDriver(disk: string): R2StorageDriver {\n    const config = this.getDiskConfig(disk);\n    return new R2StorageDriver({ disk, bucket: config.bucket, secret: this.options.secret });\n  }\n}\n"],"mappings":";;;;;;;AAMO,IAAM,wBAAN,MAAM,sBAAsB;CACqB;CAAtD,YAAY,SAAyE;EAA/B,KAAA,UAAA;CAAgC;CAEtF,QAAQ,MAAuB;EAC7B,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;CACvD;CAEA,cAAc,MAA0B;EACtC,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;EAC7D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EACxE,OAAO;CACT;CAEA,UAAU,MAA+B;EACvC,MAAM,SAAS,KAAK,cAAc,IAAI;EACtC,OAAO,IAAI,gBAAgB;GAAE;GAAM,QAAQ,OAAO;GAAQ,QAAQ,KAAK,QAAQ;EAAO,CAAC;CACzF;AACF;;CAlBC,WAAW;CAEG,gBAAA,GAAA,OAAO,eAAe,CAAA"}

package/dist/storage/storage.controller.js

@@ -0,0 +1,64 @@
+import { STORAGE_OPTIONS } from "./storage.tokens.js";
+import { decodeStorageKeyClaim, isStorageKeyWithinRoot } from "./storage-key-claim.js";
+import __decorateMetadata from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorateMetadata.js";
+import __decorateParam from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorateParam.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorate.js";
+import { StorageManagerService } from "./storage-manager.service.js";
+import { Controller, Get, Inject, Req } from "@velajs/vela";
+import { joinStoragePath } from "@velajs/vela/storage";
+import { STORAGE_SIGNED_URL_PURPOSE, verifySignedUrl } from "@velajs/vela/security";
+//#region src/storage/storage.controller.ts
+let StorageController = class StorageController {
+	manager;
+	options;
+	constructor(manager, options) {
+		this.manager = manager;
+		this.options = options;
+	}
+	async download(c) {
+		const secret = this.options.secret;
+		if (!secret) return new Response("Storage signing is not configured", { status: 500 });
+		if (!await verifySignedUrl(c.req.url, secret, {
+			method: c.req.method,
+			purpose: STORAGE_SIGNED_URL_PURPOSE
+		})) return new Response("Invalid or expired URL", { status: 403 });
+		const url = new URL(c.req.url);
+		if (url.searchParams.get("method") !== "GET") return new Response("URL is not scoped for reads", { status: 403 });
+		const disk = c.req.param("disk");
+		if (!disk || !this.manager.hasDisk(disk)) return new Response("Unknown disk", { status: 404 });
+		const claim = url.searchParams.get("key");
+		const decoded = claim ? decodeStorageKeyClaim(claim) : void 0;
+		if (!decoded) return new Response("Malformed storage key claim", { status: 400 });
+		const fullPath = joinStoragePath(void 0, decoded);
+		if (fullPath !== decoded) return new Response("Invalid storage key", { status: 403 });
+		if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) return new Response("Storage key is outside the configured root", { status: 403 });
+		try {
+			const result = await this.manager.getDriver(disk).download(fullPath);
+			const filename = fullPath.split("/").at(-1) || "download";
+			return new Response(result.toStream(), { headers: {
+				"content-type": result.contentType || "application/octet-stream",
+				"content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,
+				"x-content-type-options": "nosniff"
+			} });
+		} catch {
+			return new Response("Not found", { status: 404 });
+		}
+	}
+};
+__decorate([
+	Get("/:disk"),
+	__decorateParam(0, Req()),
+	__decorateMetadata("design:type", Function),
+	__decorateMetadata("design:paramtypes", [Object]),
+	__decorateMetadata("design:returntype", Promise)
+], StorageController.prototype, "download", null);
+StorageController = __decorate([
+	Controller("storage"),
+	__decorateParam(0, Inject(StorageManagerService)),
+	__decorateParam(1, Inject(STORAGE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof StorageManagerService === "undefined" ? Object : StorageManagerService, Object])
+], StorageController);
+//#endregion
+export { StorageController };
+
+//# sourceMappingURL=storage.controller.js.map

package/dist/storage/storage.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.controller.js","names":[],"sources":["../../src/storage/storage.controller.ts"],"sourcesContent":["import { Controller, Get, Inject, Req } from '@velajs/vela';\nimport { joinStoragePath } from '@velajs/vela/storage';\nimport { STORAGE_SIGNED_URL_PURPOSE, verifySignedUrl } from '@velajs/vela/security';\nimport type { Context } from 'hono';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\nimport { StorageManagerService } from './storage-manager.service';\nimport { decodeStorageKeyClaim, isStorageKeyWithinRoot } from './storage-key-claim';\n\n/**\n * Presign-proxy: serves objects for HMAC-signed URLs produced by\n * `StorageService.url()`. R2 has no native presign, so a signed URL points here;\n * this route verifies the signature (+expiry) before streaming the object.\n * The FULL object key (root already applied at sign time) is carried as an\n * opaque base64url query claim. The signature is verified before the claim is\n * decoded exactly once and checked against the configured disk root.\n */\n@Controller('storage')\nexport class StorageController {\n  constructor(\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n  ) {}\n\n  @Get('/:disk')\n  async download(@Req() c: Context): Promise<Response> {\n    const secret = this.options.secret;\n    if (!secret) return new Response('Storage signing is not configured', { status: 500 });\n\n    // Verify the complete path/query capability before inspecting the disk or\n    // decoding attacker-controlled claims.\n    if (\n      !(await verifySignedUrl(c.req.url, secret, {\n        method: c.req.method,\n        purpose: STORAGE_SIGNED_URL_PURPOSE,\n      }))\n    ) {\n      return new Response('Invalid or expired URL', { status: 403 });\n    }\n\n    // Enforce the signed `method` scope: this proxy only serves reads, so a URL\n    // scoped to PUT/DELETE/HEAD must NOT be honored as a GET (it would over-grant\n    // read access relative to the token's intended scope). The param is part of\n    // the signed payload, so it is trustworthy once the signature verifies.\n    const url = new URL(c.req.url);\n    if (url.searchParams.get('method') !== 'GET') {\n      return new Response('URL is not scoped for reads', { status: 403 });\n    }\n\n    const disk = c.req.param('disk');\n    if (!disk || !this.manager.hasDisk(disk)) return new Response('Unknown disk', { status: 404 });\n\n    const claim = url.searchParams.get('key');\n    const decoded = claim ? decodeStorageKeyClaim(claim) : undefined;\n    if (!decoded) return new Response('Malformed storage key claim', { status: 400 });\n\n    // Canonicalize after the one decode. Signed direct-driver callers cannot\n    // smuggle dot segments or non-canonical aliases into the proxy contract.\n    const fullPath = joinStoragePath(undefined, decoded);\n    if (fullPath !== decoded) return new Response('Invalid storage key', { status: 403 });\n\n    if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) {\n      return new Response('Storage key is outside the configured root', { status: 403 });\n    }\n\n    try {\n      const result = await this.manager.getDriver(disk).download(fullPath);\n      const filename = fullPath.split('/').at(-1) || 'download';\n      return new Response(result.toStream(), {\n        headers: {\n          'content-type': result.contentType || 'application/octet-stream',\n          // Objects are untrusted user content.  The authenticated API origin\n          // never renders them inline (especially HTML/SVG), even when the\n          // stored Content-Type is attacker controlled.\n          'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    } catch {\n      return new Response('Not found', { status: 404 });\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAkBO,IAAM,oBAAN,MAAM,kBAAkB;CAEqB;CACN;CAF5C,YACE,SACA,SACA;EAFgD,KAAA,UAAA;EACN,KAAA,UAAA;CACzC;CAEH,MACM,SAAS,GAAsC;EACnD,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,CAAC,QAAQ,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;EAIrF,IACE,CAAE,MAAM,gBAAgB,EAAE,IAAI,KAAK,QAAQ;GACzC,QAAQ,EAAE,IAAI;GACd,SAAS;EACX,CAAC,GAED,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;EAO/D,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;EAC7B,IAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,OACrC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAGpE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;EAE7F,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;EACxC,MAAM,UAAU,QAAQ,sBAAsB,KAAK,IAAI,KAAA;EACvD,IAAI,CAAC,SAAS,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAIhF,MAAM,WAAW,gBAAgB,KAAA,GAAW,OAAO;EACnD,IAAI,aAAa,SAAS,OAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;EAEpF,IAAI,CAAC,uBAAuB,UAAU,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,IAAI,GACzE,OAAO,IAAI,SAAS,8CAA8C,EAAE,QAAQ,IAAI,CAAC;EAGnF,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,QAAQ;GACnE,MAAM,WAAW,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;GAC/C,OAAO,IAAI,SAAS,OAAO,SAAS,GAAG,EACrC,SAAS;IACP,gBAAgB,OAAO,eAAe;IAItC,uBAAuB,gCAAgC,mBAAmB,QAAQ;IAClF,0BAA0B;GAC5B,EACF,CAAC;EACH,QAAQ;GACN,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EAClD;CACF;AACF;;CA1DG,IAAI,QAAQ;CACG,gBAAA,GAAA,IAAI,CAAA;;;;;;CARrB,WAAW,SAAS;CAGhB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;CAC5B,gBAAA,GAAA,OAAO,eAAe,CAAA"}

package/dist/storage/storage.module.js

@@ -0,0 +1,25 @@
+import { STORAGE_OPTIONS } from "./storage.tokens.js";
+import __decorate from "../_virtual/_@oxc-project_runtime@0.150.0/helpers/esm/decorate.js";
+import { StorageManagerService } from "./storage-manager.service.js";
+import { StorageController } from "./storage.controller.js";
+import { StorageService } from "./storage.service.js";
+import { ConfigurableModuleBuilder, Module } from "@velajs/vela";
+//#region src/storage/storage.module.ts
+const { ConfigurableModuleClass } = new ConfigurableModuleBuilder({
+	moduleName: "Storage",
+	optionsInjectionToken: STORAGE_OPTIONS
+}).build();
+let StorageModule = class StorageModule extends ConfigurableModuleClass {};
+StorageModule = __decorate([Module({
+	providers: [StorageManagerService, StorageService],
+	controllers: [StorageController],
+	exports: [
+		StorageService,
+		StorageManagerService,
+		STORAGE_OPTIONS
+	]
+})], StorageModule);
+//#endregion
+export { StorageModule };
+
+//# sourceMappingURL=storage.module.js.map

package/dist/storage/storage.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.module.js","names":[],"sources":["../../src/storage/storage.module.ts"],"sourcesContent":["import { ConfigurableModuleBuilder, Module } from '@velajs/vela';\nimport { StorageController } from './storage.controller';\nimport { StorageManagerService } from './storage-manager.service';\nimport { StorageService } from './storage.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst { ConfigurableModuleClass } = new ConfigurableModuleBuilder<StorageModuleOptions>({\n  moduleName: 'Storage',\n  optionsInjectionToken: STORAGE_OPTIONS,\n}).build();\n\n@Module({\n  providers: [StorageManagerService, StorageService],\n  controllers: [StorageController],\n  exports: [StorageService, StorageManagerService, STORAGE_OPTIONS],\n})\nexport class StorageModule extends ConfigurableModuleClass {}\n"],"mappings":";;;;;;;AAOA,MAAM,EAAE,4BAA4B,IAAI,0BAAgD;CACtF,YAAY;CACZ,uBAAuB;AACzB,CAAC,CAAC,CAAC,MAAM;AAOF,IAAM,gBAAN,MAAM,sBAAsB,wBAAwB,CAAC;AAL3D,gBAAA,WAAA,CAAA,OAAO;CACN,WAAW,CAAC,uBAAuB,cAAc;CACjD,aAAa,CAAC,iBAAiB;CAC/B,SAAS;EAAC;EAAgB;EAAuB;CAAe;AAClE,CAAC,CAAA,GAAA,aAAA"}