@velajs/storage 0.3.1 → 0.3.2

package/package.json

@@ -1,8 +1,37 @@
 {
   "name": "@velajs/storage",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Edge-first, driver-based object/file storage for the Vela framework",
+  "keywords": [
+    "cloudflare-workers",
+    "edge",
+    "framework",
+    "multipart",
+    "object-storage",
+    "presigned-url",
+    "r2",
+    "s3",
+    "storage",
+    "vela"
+  ],
+  "homepage": "https://github.com/velajs/storage#readme",
+  "bugs": {
+    "url": "https://github.com/velajs/storage/issues"
+  },
+  "license": "MIT",
+  "author": "ksh",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/velajs/storage.git"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -43,68 +72,53 @@
       "import": "./dist/testing/index.js"
     }
   },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
-  ],
-  "sideEffects": false,
-  "keywords": [
-    "vela",
-    "storage",
-    "object-storage",
-    "s3",
-    "r2",
-    "presigned-url",
-    "multipart",
-    "edge",
-    "cloudflare-workers",
-    "framework"
-  ],
-  "author": "ksh",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/velajs/storage.git"
-  },
-  "homepage": "https://github.com/velajs/storage#readme",
-  "bugs": {
-    "url": "https://github.com/velajs/storage/issues"
-  },
-  "engines": {
-    "node": ">=20"
-  },
   "dependencies": {
     "aws4fetch": "^1.0.20"
   },
-  "peerDependencies": {
-    "@velajs/vela": ">=1.11.0",
-    "hono": ">=4",
-    "@cloudflare/workers-types": ">=4"
-  },
-  "peerDependenciesMeta": {
-    "@cloudflare/workers-types": {
-      "optional": true
-    }
-  },
   "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@changesets/cli": "^2.31.0",
     "@cloudflare/vitest-pool-workers": "^0.16.18",
     "@cloudflare/workers-types": "^4.20260624.1",
-    "@swc/cli": "^0.8.1",
     "@swc/core": "^1.15.43",
     "@velajs/testing": "^0.4.0",
     "@velajs/vela": "^1.12.0",
     "aws4fetch": "^1.0.20",
     "hono": "^4.12.27",
-    "typescript": "^6.0.3",
+    "oxfmt": "^0.58.0",
+    "oxlint": "^1.73.0",
+    "publint": "^0.3.21",
+    "tsdown": "^0.22.4",
+    "typescript": "^7.0.2",
     "unplugin-swc": "^1.5.9",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-types": ">=4",
+    "@velajs/vela": ">=1.11.0",
+    "hono": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/workers-types": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24"
   },
   "scripts": {
-    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
+    "build": "tsdown",
     "test": "vitest run",
     "test:workers": "vitest run --config vitest.config.workers.ts",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
+    "publint": "publint",
+    "attw": "attw --pack . --profile esm-only",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release": "pnpm build && changeset publish",
+    "verify": "pnpm lint && pnpm format:check && pnpm build && pnpm typecheck && pnpm test && pnpm test:workers && pnpm publint && pnpm attw"
   }
 }

package/dist/base64.d.ts

@@ -1,8 +0,0 @@
-/** Encode bytes to standard base64. */
-export declare function bytesToBase64(bytes: Uint8Array): string;
-/** Decode standard base64 to bytes. */
-export declare function base64ToBytes(b64: string): Uint8Array;
-/** Encode a UTF-8 string to base64 (unicode-safe, unlike raw `btoa`). */
-export declare function utf8ToBase64(text: string): string;
-/** URL-safe base64 (base64url) without padding — used by SigV4 / policies. */
-export declare function bytesToBase64Url(bytes: Uint8Array): string;

package/dist/base64.js

@@ -1,25 +0,0 @@
-// Edge-safe base64 — NO `Buffer` (banned by the edge-runtime audit).
-// Uses `btoa`/`atob` over chunked `String.fromCharCode`, present on every
-// target runtime (Workers, Deno, Bun, Node 20+, browsers).
-// Chunk stays <= 0x8000 so the spread into String.fromCharCode never exceeds
-// the engine argument limit.
-const CHUNK = 0x8000;
-/** Encode bytes to standard base64. */ export function bytesToBase64(bytes) {
-    let binary = '';
-    for(let i = 0; i < bytes.length; i += CHUNK){
-        binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-    }
-    return btoa(binary);
-}
-/** Decode standard base64 to bytes. */ export function base64ToBytes(b64) {
-    const binary = atob(b64);
-    const out = new Uint8Array(binary.length);
-    for(let i = 0; i < binary.length; i++)out[i] = binary.charCodeAt(i);
-    return out;
-}
-/** Encode a UTF-8 string to base64 (unicode-safe, unlike raw `btoa`). */ export function utf8ToBase64(text) {
-    return bytesToBase64(new TextEncoder().encode(text));
-}
-/** URL-safe base64 (base64url) without padding — used by SigV4 / policies. */ export function bytesToBase64Url(bytes) {
-    return bytesToBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}

package/dist/decorators/inject-storage.decorator.d.ts

@@ -1,17 +0,0 @@
-/**
- * Inject the {@link StorageService} for a named bucket.
- *
- * ```ts
- * class UploadService {
- *   constructor(
- *     @InjectStorage() private readonly uploads: StorageService,          // default bucket
- *     @InjectStorage('backups') private readonly backups: StorageService, // named bucket
- *   ) {}
- * }
- * ```
- *
- * The default bucket resolves the `StorageService` class token directly (so
- * plain `@Inject(StorageService)` and `Test.overrideProvider(StorageService)`
- * keep working); named buckets resolve their per-name token.
- */
-export declare function InjectStorage(name?: string): ParameterDecorator;

package/dist/decorators/inject-storage.decorator.js

@@ -1,21 +0,0 @@
-import { Inject } from "@velajs/vela";
-import { StorageService } from "../storage.service.js";
-import { DEFAULT_STORAGE_NAME, storageToken } from "../storage.tokens.js";
-/**
- * Inject the {@link StorageService} for a named bucket.
- *
- * ```ts
- * class UploadService {
- *   constructor(
- *     @InjectStorage() private readonly uploads: StorageService,          // default bucket
- *     @InjectStorage('backups') private readonly backups: StorageService, // named bucket
- *   ) {}
- * }
- * ```
- *
- * The default bucket resolves the `StorageService` class token directly (so
- * plain `@Inject(StorageService)` and `Test.overrideProvider(StorageService)`
- * keep working); named buckets resolve their per-name token.
- */ export function InjectStorage(name = DEFAULT_STORAGE_NAME) {
-    return Inject(name === DEFAULT_STORAGE_NAME ? StorageService : storageToken(name));
-}

package/dist/drivers/r2/r2.types.d.ts

@@ -1,67 +0,0 @@
-export type R2PutValue = ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob | null;
-export interface R2HttpMetadataLike {
-    contentType?: string;
-    cacheControl?: string;
-}
-export interface R2PutOptionsLike {
-    httpMetadata?: R2HttpMetadataLike;
-    customMetadata?: Record<string, string>;
-}
-export interface R2GetOptionsLike {
-    range?: {
-        offset?: number;
-        length?: number;
-        suffix?: number;
-    };
-}
-export interface R2ListOptionsLike {
-    prefix?: string;
-    cursor?: string;
-    limit?: number;
-    delimiter?: string;
-}
-export interface R2ObjectLike {
-    key: string;
-    size: number;
-    etag: string;
-    uploaded: Date;
-    httpMetadata?: R2HttpMetadataLike;
-    customMetadata?: Record<string, string>;
-}
-export interface R2ObjectBodyLike extends R2ObjectLike {
-    body: ReadableStream;
-    arrayBuffer(): Promise<ArrayBuffer>;
-}
-export interface R2ListResultLike {
-    objects: R2ObjectLike[];
-    truncated: boolean;
-    cursor?: string;
-    delimitedPrefixes: string[];
-}
-export interface R2UploadedPartLike {
-    partNumber: number;
-    etag: string;
-}
-export interface R2MultipartUploadLike {
-    readonly uploadId: string;
-    uploadPart(partNumber: number, value: R2PutValue): Promise<R2UploadedPartLike>;
-    complete(parts: R2UploadedPartLike[]): Promise<R2ObjectLike>;
-    abort(): Promise<void>;
-}
-export interface R2BucketLike {
-    put(key: string, value: R2PutValue, options?: R2PutOptionsLike): Promise<R2ObjectLike | null>;
-    get(key: string, options?: R2GetOptionsLike): Promise<R2ObjectBodyLike | null>;
-    head(key: string): Promise<R2ObjectLike | null>;
-    delete(keys: string | string[]): Promise<void>;
-    list(options?: R2ListOptionsLike): Promise<R2ListResultLike>;
-    createMultipartUpload(key: string, options?: R2PutOptionsLike): Promise<R2MultipartUploadLike>;
-    resumeMultipartUpload?(key: string, uploadId: string): R2MultipartUploadLike;
-}
-export interface R2DriverOptions {
-    /** The Workers `R2Bucket` binding (e.g. `env.MY_BUCKET` or `R2Service.bucket`). */
-    bucket: R2BucketLike;
-    /** Public origin (r2.dev subdomain / custom domain) so `url()` can return a link. */
-    publicBaseUrl?: string;
-    /** Friendly driver name (defaults to `r2`). */
-    name?: string;
-}

package/dist/drivers/r2/r2.types.js

@@ -1,5 +0,0 @@
-// Structural subset of the Cloudflare `R2Bucket` binding — only the members we
-// call. Declaring it structurally (instead of importing @cloudflare/workers-types)
-// keeps workers-types an optional peer; a real `R2Bucket` (and
-// `@velajs/cloudflare`'s `R2Service.bucket`) is structurally assignable.
-export { };

package/dist/drivers/s3/s3-client.d.ts

@@ -1,33 +0,0 @@
-import type { S3DriverOptions } from './s3.types';
-export interface PostPolicyOptions {
-    expiresIn: number;
-    contentType?: string;
-    maxSize?: number;
-    minSize?: number;
-}
-/**
- * Thin wrapper over aws4fetch: builds addressed URLs, sends SigV4-signed
- * requests, and mints presigned GET/PUT URLs + presigned-POST policies.
- * The single place S3 signing happens.
- */
-export declare class S3Client {
-    #private;
-    constructor(cfg: S3DriverOptions);
-    get bucket(): string;
-    objectUrl(key: string, query?: Record<string, string>): URL;
-    /** The bucket-root URL used as the presigned-POST target. */
-    postUrl(): string;
-    /** Send a SigV4-signed request. */
-    send(url: URL, init: RequestInit): Promise<Response>;
-    /** Presign a GET or PUT URL via query signing (unsigned payload). */
-    presign(key: string, method: 'GET' | 'PUT', expiresIn: number, query?: Record<string, string>): Promise<string>;
-    /**
-     * Presigned POST policy — enforces `content-length-range` server-side.
-     * aws4fetch only signs requests, so the policy HMAC chain is hand-rolled
-     * on Web Crypto (edge-safe).
-     */
-    signPostPolicy(key: string, opts: PostPolicyOptions): Promise<{
-        url: string;
-        fields: Record<string, string>;
-    }>;
-}

package/dist/drivers/s3/s3-client.js

@@ -1,154 +0,0 @@
-import { AwsClient } from "aws4fetch";
-import { utf8ToBase64 } from "../../base64.js";
-// --- Web-Crypto SigV4 helpers (used only for the POST-policy path; the
-// request-signing path is aws4fetch). No node:crypto, no Buffer. ---
-const encoder = new TextEncoder();
-async function hmac(key, data) {
-    const cryptoKey = await crypto.subtle.importKey('raw', key, {
-        name: 'HMAC',
-        hash: 'SHA-256'
-    }, false, [
-        'sign'
-    ]);
-    const sig = await crypto.subtle.sign('HMAC', cryptoKey, encoder.encode(data));
-    return new Uint8Array(sig);
-}
-function hex(bytes) {
-    let out = '';
-    for (const b of bytes)out += b.toString(16).padStart(2, '0');
-    return out;
-}
-async function sigV4SigningKey(secret, dateStamp, region, service = 's3') {
-    const kDate = await hmac(encoder.encode(`AWS4${secret}`), dateStamp);
-    const kRegion = await hmac(kDate, region);
-    const kService = await hmac(kRegion, service);
-    return hmac(kService, 'aws4_request');
-}
-function amzDates() {
-    const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '');
-    return {
-        amzDate,
-        dateStamp: amzDate.slice(0, 8)
-    };
-}
-/**
- * Thin wrapper over aws4fetch: builds addressed URLs, sends SigV4-signed
- * requests, and mints presigned GET/PUT URLs + presigned-POST policies.
- * The single place S3 signing happens.
- */ export class S3Client {
-    #aws;
-    #cfg;
-    #fetch;
-    constructor(cfg){
-        this.#cfg = cfg;
-        this.#fetch = cfg.fetch ?? fetch;
-        this.#aws = new AwsClient({
-            accessKeyId: cfg.credentials.accessKeyId,
-            secretAccessKey: cfg.credentials.secretAccessKey,
-            sessionToken: cfg.credentials.sessionToken,
-            region: cfg.region,
-            service: 's3'
-        });
-    }
-    get bucket() {
-        return this.#cfg.bucket;
-    }
-    /** Encode each key segment but keep `/` separators. */ #encodeKey(key) {
-        return key.split('/').map(encodeURIComponent).join('/');
-    }
-    objectUrl(key, query) {
-        const enc = this.#encodeKey(key);
-        const u = new URL(this.#cfg.endpoint);
-        if (this.#cfg.forcePathStyle) {
-            u.pathname = `/${this.#cfg.bucket}${enc ? `/${enc}` : ''}`;
-        } else {
-            u.hostname = `${this.#cfg.bucket}.${u.hostname}`;
-            u.pathname = `/${enc}`;
-        }
-        if (query) for (const [k, v] of Object.entries(query))u.searchParams.set(k, v);
-        return u;
-    }
-    /** The bucket-root URL used as the presigned-POST target. */ postUrl() {
-        const u = new URL(this.#cfg.endpoint);
-        if (this.#cfg.forcePathStyle) u.pathname = `/${this.#cfg.bucket}`;
-        else u.hostname = `${this.#cfg.bucket}.${u.hostname}`;
-        return u.toString();
-    }
-    /** Send a SigV4-signed request. */ async send(url, init) {
-        const signed = await this.#aws.sign(url.toString(), init);
-        return this.#fetch(signed);
-    }
-    /** Presign a GET or PUT URL via query signing (unsigned payload). */ async presign(key, method, expiresIn, query) {
-        const url = this.objectUrl(key, {
-            ...query,
-            'X-Amz-Expires': String(expiresIn)
-        });
-        const signed = await this.#aws.sign(url.toString(), {
-            method,
-            aws: {
-                signQuery: true
-            }
-        });
-        return signed.url;
-    }
-    /**
-   * Presigned POST policy — enforces `content-length-range` server-side.
-   * aws4fetch only signs requests, so the policy HMAC chain is hand-rolled
-   * on Web Crypto (edge-safe).
-   */ async signPostPolicy(key, opts) {
-        const { amzDate, dateStamp } = amzDates();
-        const { accessKeyId, secretAccessKey, sessionToken } = this.#cfg.credentials;
-        const credential = `${accessKeyId}/${dateStamp}/${this.#cfg.region}/s3/aws4_request`;
-        const expiration = new Date(Date.now() + opts.expiresIn * 1000).toISOString();
-        const conditions = [
-            {
-                bucket: this.#cfg.bucket
-            },
-            {
-                key
-            },
-            {
-                'x-amz-algorithm': 'AWS4-HMAC-SHA256'
-            },
-            {
-                'x-amz-credential': credential
-            },
-            {
-                'x-amz-date': amzDate
-            }
-        ];
-        if (sessionToken) conditions.push({
-            'x-amz-security-token': sessionToken
-        });
-        if (opts.contentType) conditions.push({
-            'content-type': opts.contentType
-        });
-        if (opts.maxSize != null || opts.minSize != null) {
-            conditions.push([
-                'content-length-range',
-                opts.minSize ?? 0,
-                opts.maxSize ?? opts.minSize ?? 0
-            ]);
-        }
-        const policyB64 = utf8ToBase64(JSON.stringify({
-            expiration,
-            conditions
-        }));
-        const signingKey = await sigV4SigningKey(secretAccessKey, dateStamp, this.#cfg.region);
-        const signature = hex(await hmac(signingKey, policyB64));
-        const fields = {
-            key,
-            'x-amz-algorithm': 'AWS4-HMAC-SHA256',
-            'x-amz-credential': credential,
-            'x-amz-date': amzDate,
-            policy: policyB64,
-            'x-amz-signature': signature
-        };
-        if (sessionToken) fields['x-amz-security-token'] = sessionToken;
-        if (opts.contentType) fields['content-type'] = opts.contentType;
-        return {
-            url: this.postUrl(),
-            fields
-        };
-    }
-}

package/dist/drivers/s3/s3.driver.d.ts

@@ -1,4 +0,0 @@
-import type { StorageDriver } from '../../storage.types';
-import type { S3DriverOptions } from './s3.types';
-/** S3 / S3-compatible driver signed with aws4fetch (edge-safe). */
-export declare function s3Driver(options: S3DriverOptions): StorageDriver;