@venizia/ignis-helpers 0.2.0-9 → 0.2.0

package/dist/cjs/modules/storage/bun-s3/utility.js

@@ -1,33 +1,71 @@
 "use strict";
 // Minimal AWS Signature V4 helpers for bucket-management operations (object ops use Bun's S3Client natively).
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTaggingXml = exports.buildTaggingHeader = exports.buildTaggingXml = void 0;
 exports.buildSignedRequest = buildSignedRequest;
-async function hmacSHA256(key, data) {
+exports.buildPostPolicy = buildPostPolicy;
+exports.buildPresignedUrl = buildPresignedUrl;
+const error_1 = require("../../error");
+const hmacSHA256 = async (opts) => {
+    const { key, data } = opts;
     const rawKey = typeof key === 'string' ? new TextEncoder().encode(key) : key;
-    const k = await crypto.subtle.importKey('raw', rawKey, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const sig = await crypto.subtle.sign('HMAC', k, new TextEncoder().encode(data));
-    return new Uint8Array(sig);
-}
-function toHex(buf) {
-    return Array.from(buf)
-        .map(b => b.toString(16).padStart(2, '0'))
-        .join('');
-}
-async function sha256Hex(data) {
-    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(data));
-    return toHex(new Uint8Array(digest));
-}
-async function buildSignedRequest(opts) {
-    const { method, endpoint, path, accessKey, secretKey, region, sessionToken, body = '' } = opts;
-    const now = new Date();
-    const amzDate = now
+    const cryptoKey = await crypto.subtle.importKey('raw', rawKey, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(data));
+    return new Uint8Array(signature);
+};
+const toHex = (opts) => Array.from(opts.bytes)
+    .map(byte => byte.toString(16).padStart(2, '0'))
+    .join('');
+const sha256Hex = async (opts) => {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(opts.data));
+    return toHex({ bytes: new Uint8Array(digest) });
+};
+/** SigV4 canonical form needs every reserved character `encodeURIComponent` leaves untouched also percent-encoded. */
+const encodeSigV4Component = (opts) => encodeURIComponent(opts.value).replace(/[!'()*]/g, char => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+/** Signing the raw path answers 403 SignatureDoesNotMatch, because `fetch` encodes it on the wire. Separators stay literal. */
+const encodeSigV4Path = (opts) => opts.path
+    .split('/')
+    .map(segment => encodeSigV4Component({ value: segment }))
+    .join('/');
+/** Empty or absent query must sign identically to today - callers of getBuckets/createBucket/removeBucket depend on it. */
+const buildCanonicalQueryString = (query) => {
+    if (!query) {
+        return '';
+    }
+    const keys = Object.keys(query);
+    if (keys.length === 0) {
+        return '';
+    }
+    return keys
+        .sort()
+        .map(key => `${encodeSigV4Component({ value: key })}=${encodeSigV4Component({ value: query[key] })}`)
+        .join('&');
+};
+/** The SigV4 four-step chain. Each step keys the next, so the final key is bound to date, region and service. */
+const deriveSigningKey = async (opts) => {
+    const { secretKey, dateStamp, region } = opts;
+    const dateKey = await hmacSHA256({ key: `AWS4${secretKey}`, data: dateStamp });
+    const regionKey = await hmacSHA256({ key: dateKey, data: region });
+    const serviceKey = await hmacSHA256({ key: regionKey, data: 's3' });
+    return hmacSHA256({ key: serviceKey, data: 'aws4_request' });
+};
+/** `20130524T000000Z` and its `20130524` prefix - the two forms every signature needs. */
+const toAmzDate = (opts) => {
+    const amzDate = opts.now
         .toISOString()
         .replace(/[-:]/g, '')
         .replace(/\.\d{3}Z$/, 'Z');
-    const dateStamp = amzDate.slice(0, 8);
-    const url = `${endpoint.replace(/\/$/, '')}${path}`;
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+};
+async function buildSignedRequest(opts) {
+    const { method, endpoint, path, accessKey, secretKey, region, sessionToken, body = '', query, headers: extraHeaders, } = opts;
+    const { amzDate, dateStamp } = toAmzDate({ now: new Date() });
+    const canonicalQueryString = buildCanonicalQueryString(query);
+    const canonicalPath = encodeSigV4Path({ path });
+    const baseUrl = `${endpoint.replace(/\/$/, '')}${canonicalPath}`;
+    const url = canonicalQueryString ? `${baseUrl}?${canonicalQueryString}` : baseUrl;
     const host = new URL(endpoint).host;
-    const payloadHash = await sha256Hex(body);
+    const payloadHash = await sha256Hex({ data: body });
     const canonicalHeadersMap = {
         host,
         'x-amz-content-sha256': payloadHash,
@@ -36,22 +74,30 @@ async function buildSignedRequest(opts) {
     if (sessionToken) {
         canonicalHeadersMap['x-amz-security-token'] = sessionToken;
     }
+    const extraHeadersEntries = Object.entries(extraHeaders ?? {});
+    for (const [key, value] of extraHeadersEntries) {
+        canonicalHeadersMap[key.toLowerCase()] = value;
+    }
     const sortedKeys = Object.keys(canonicalHeadersMap).sort();
     const canonicalHeaders = sortedKeys.map(k => `${k}:${canonicalHeadersMap[k]}\n`).join('');
     const signedHeaders = sortedKeys.join(';');
-    const canonicalRequest = [method, path, '', canonicalHeaders, signedHeaders, payloadHash].join('\n');
+    const canonicalRequest = [
+        method,
+        canonicalPath,
+        canonicalQueryString,
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join('\n');
     const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
     const stringToSign = [
         'AWS4-HMAC-SHA256',
         amzDate,
         credentialScope,
-        await sha256Hex(canonicalRequest),
+        await sha256Hex({ data: canonicalRequest }),
     ].join('\n');
-    const kDate = await hmacSHA256(`AWS4${secretKey}`, dateStamp);
-    const kRegion = await hmacSHA256(kDate, region);
-    const kService = await hmacSHA256(kRegion, 's3');
-    const kSigning = await hmacSHA256(kService, 'aws4_request');
-    const signature = toHex(await hmacSHA256(kSigning, stringToSign));
+    const signingKey = await deriveSigningKey({ secretKey, dateStamp, region });
+    const signature = toHex({ bytes: await hmacSHA256({ key: signingKey, data: stringToSign }) });
     const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
     const contentLength = String(new TextEncoder().encode(body).length);
     return {
@@ -63,4 +109,148 @@ async function buildSignedRequest(opts) {
         },
     };
 }
+const escapeXmlText = (opts) => opts.value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+/** `&amp;` decodes LAST - a literal `&lt;` in the source text must not turn into `<` through the `&amp;` step. */
+const unescapeXmlText = (opts) => opts.value
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, '&');
+/** S3's PUT tagging body - no XML dependency, so this is hand-built rather than templated by a library. */
+const buildTaggingXml = (opts) => {
+    const tagEntries = Object.entries(opts.tags)
+        .map(([key, value]) => `<Tag><Key>${escapeXmlText({ value: key })}</Key><Value>${escapeXmlText({ value })}</Value></Tag>`)
+        .join('');
+    return `<Tagging><TagSet>${tagEntries}</TagSet></Tagging>`;
+};
+exports.buildTaggingXml = buildTaggingXml;
+/** S3's GET tagging response - hand-parsed rather than a full XML parser; throws rather than returning a half-parsed object. */
+/** The `x-amz-tagging` header: a URL-encoded query string, unlike the XML the tagging API takes. */
+const buildTaggingHeader = (opts) => Object.entries(opts.tags)
+    .map(([key, value]) => `${encodeSigV4Component({ value: key })}=${encodeSigV4Component({ value })}`)
+    .join('&');
+exports.buildTaggingHeader = buildTaggingHeader;
+const parseTaggingXml = (opts) => {
+    const { xml } = opts;
+    const trimmed = xml.trim();
+    if (/<TagSet\s*\/>/.test(trimmed) || /<TagSet>\s*<\/TagSet>/.test(trimmed)) {
+        return {};
+    }
+    const tagSetMatch = trimmed.match(/<TagSet>([\s\S]*?)<\/TagSet>/);
+    if (!tagSetMatch) {
+        throw (0, error_1.getError)({ message: `[parseTaggingXml] Malformed tagging response | body: ${xml}` });
+    }
+    const tags = {};
+    const tagMatches = tagSetMatch[1].matchAll(/<Tag>([\s\S]*?)<\/Tag>/g);
+    for (const tagMatch of tagMatches) {
+        const keyMatch = tagMatch[1].match(/<Key>([\s\S]*?)<\/Key>/);
+        const valueMatch = tagMatch[1].match(/<Value>([\s\S]*?)<\/Value>/);
+        if (!keyMatch || !valueMatch) {
+            throw (0, error_1.getError)({ message: `[parseTaggingXml] Malformed tag entry | body: ${xml}` });
+        }
+        const key = unescapeXmlText({ value: keyMatch[1].trim() });
+        const value = unescapeXmlText({ value: valueMatch[1].trim() });
+        tags[key] = value;
+    }
+    return tags;
+};
+exports.parseTaggingXml = parseTaggingXml;
+/**
+ * A signed POST policy: the form a browser posts straight to S3.
+ *
+ * This is not a presigned PUT and the difference is the point. A signed PUT binds each header to an
+ * EXACT value, so `content-length` names one byte count and never a ceiling - every retry or
+ * re-encode becomes an opaque 403. A policy carries `content-length-range`, so "at most N bytes" is
+ * expressible at all.
+ */
+async function buildPostPolicy(opts) {
+    const { bucket, keyPrefix, maxBytes, expiresInSeconds, accessKey, secretKey, region, sessionToken, contentType, } = opts;
+    const now = new Date();
+    const { amzDate, dateStamp } = toAmzDate({ now });
+    const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
+    const credential = `${accessKey}/${credentialScope}`;
+    const expiresAt = new Date(now.getTime() + expiresInSeconds * 1000).toISOString();
+    // Every field the browser posts must ALSO be a condition, or S3 refuses the form it just signed.
+    const fields = {
+        'x-amz-algorithm': 'AWS4-HMAC-SHA256',
+        'x-amz-credential': credential,
+        'x-amz-date': amzDate,
+        ...(sessionToken ? { 'x-amz-security-token': sessionToken } : {}),
+    };
+    const conditions = [
+        { bucket },
+        ['starts-with', '$key', keyPrefix],
+        ['content-length-range', 0, maxBytes],
+        ...Object.entries(fields).map(([key, value]) => ({ [key]: value })),
+        ...(contentType ? [{ 'Content-Type': contentType }] : []),
+    ];
+    const policy = Buffer.from(JSON.stringify({ expiration: expiresAt, conditions })).toString('base64');
+    const signingKey = await deriveSigningKey({ secretKey, dateStamp, region });
+    return {
+        formData: {
+            ...fields,
+            ...(contentType ? { 'Content-Type': contentType } : {}),
+            policy,
+            'x-amz-signature': toHex({ bytes: await hmacSHA256({ key: signingKey, data: policy }) }),
+        },
+        expiresAt,
+    };
+}
+/**
+ * A presigned URL: the credential travels in the QUERY, so a browser needs no `Authorization` header.
+ *
+ * `headers` is what `S3Client.presign` cannot do. Anything named there is inside the signature and
+ * listed in `X-Amz-SignedHeaders`, so the client must send it back byte for byte. A signature
+ * expresses equality and nothing else, so a pinned `content-length` rejects every retry at another
+ * size; for a ceiling, use {@link buildPostPolicy}.
+ */
+async function buildPresignedUrl(opts) {
+    const { method, endpoint, path, accessKey, secretKey, region, sessionToken, expiresInSeconds, headers, now = new Date(), } = opts;
+    const { amzDate, dateStamp } = toAmzDate({ now });
+    const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
+    const canonicalPath = encodeSigV4Path({ path });
+    const origin = endpoint.replace(/\/$/, '');
+    // SigV4 compares header values after trimming, so signing an untrimmed one answers 403.
+    const canonicalHeadersMap = { host: new URL(origin).host };
+    const signedEntries = Object.entries(headers ?? {});
+    for (const [key, value] of signedEntries) {
+        canonicalHeadersMap[key.toLowerCase()] = String(value).trim();
+    }
+    const sortedKeys = Object.keys(canonicalHeadersMap).sort();
+    const signedHeaders = sortedKeys.join(';');
+    // `X-Amz-SignedHeaders` is itself signed, so the header list has to be settled before the query.
+    const queryParameters = {
+        'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
+        'X-Amz-Credential': `${accessKey}/${credentialScope}`,
+        'X-Amz-Date': amzDate,
+        'X-Amz-Expires': String(expiresInSeconds),
+        'X-Amz-SignedHeaders': signedHeaders,
+        ...(sessionToken ? { 'X-Amz-Security-Token': sessionToken } : {}),
+    };
+    const canonicalQueryString = buildCanonicalQueryString(queryParameters);
+    // A presigned URL is signed before its body exists, so the payload is excluded by name.
+    const canonicalRequest = [
+        method,
+        canonicalPath,
+        canonicalQueryString,
+        sortedKeys.map(key => `${key}:${canonicalHeadersMap[key]}\n`).join(''),
+        signedHeaders,
+        'UNSIGNED-PAYLOAD',
+    ].join('\n');
+    const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        amzDate,
+        credentialScope,
+        await sha256Hex({ data: canonicalRequest }),
+    ].join('\n');
+    const signingKey = await deriveSigningKey({ secretKey, dateStamp, region });
+    const signature = toHex({ bytes: await hmacSHA256({ key: signingKey, data: stringToSign }) });
+    return `${origin}${canonicalPath}?${canonicalQueryString}&X-Amz-Signature=${signature}`;
+}
 //# sourceMappingURL=utility.js.map

package/dist/cjs/modules/storage/bun-s3/utility.js.map

@@ -1 +1 @@
-{"version":3,"file":"utility.js","sourceRoot":"","sources":["../../../../../src/modules/storage/bun-s3/utility.ts"],"names":[],"mappings":";AAAA,8GAA8G;;AA0B9G,gDAiEC;AAzFD,KAAK,UAAU,UAAU,CAAC,GAAwB,EAAE,IAAY;IAC9D,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,MAAiC,EACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,GAAe;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,IASxC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAE/F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,mBAAmB,GAA2B;QAClD,IAAI;QACJ,sBAAsB,EAAE,WAAW;QACnC,YAAY,EAAE,OAAO;KACtB,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,mBAAmB,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,IAAI,CAC5F,IAAI,CACL,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC;IACjE,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,MAAM,SAAS,CAAC,gBAAgB,CAAC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,+BAA+B,SAAS,IAAI,eAAe,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IACzI,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpE,OAAO;QACL,GAAG;QACH,OAAO,EAAE;YACP,GAAG,mBAAmB;YACtB,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,aAAa;SAChC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"utility.js","sourceRoot":"","sources":["../../../../../src/modules/storage/bun-s3/utility.ts"],"names":[],"mappings":";AAAA,8GAA8G;;;AAwF9G,gDAoFC;AAiFD,0CA4DC;AAUD,8CA0EC;AA3YD,2CAA2C;AAE3C,MAAM,UAAU,GAAG,KAAK,EAAE,IAGzB,EAAoC,EAAE;IACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,MAAM,EACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,IAA2B,EAAU,EAAE,CACpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;KACnB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;KAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;AAEd,MAAM,SAAS,GAAG,KAAK,EAAE,IAAsB,EAAmB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,sHAAsH;AACtH,MAAM,oBAAoB,GAAG,CAAC,IAAuB,EAAU,EAAE,CAC/D,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CACpC,UAAU,EACV,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5D,CAAC;AAEJ,+HAA+H;AAC/H,MAAM,eAAe,GAAG,CAAC,IAAsB,EAAU,EAAE,CACzD,IAAI,CAAC,IAAI;KACN,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;KACxD,IAAI,CAAC,GAAG,CAAC,CAAC;AAEf,2HAA2H;AAC3H,MAAM,yBAAyB,GAAG,CAAC,KAA8B,EAAU,EAAE;IAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI;SACR,IAAI,EAAE;SACN,GAAG,CACF,GAAG,CAAC,EAAE,CACJ,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAC3F;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,iHAAiH;AACjH,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAI/B,EAAoC,EAAE;IACrC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,0FAA0F;AAC1F,MAAM,SAAS,GAAG,CAAC,IAAmB,EAA0C,EAAE;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;SACrB,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAE7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC,CAAC;AAEK,KAAK,UAAU,kBAAkB,CAAC,IAYxC;IACC,MAAM,EACJ,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,SAAS,EACT,MAAM,EACN,YAAY,EACZ,IAAI,GAAG,EAAE,EACT,KAAK,EACL,OAAO,EAAE,YAAY,GACtB,GAAG,IAAI,CAAC;IAET,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE9D,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,mBAAmB,GAA2B;QAClD,IAAI;QACJ,sBAAsB,EAAE,WAAW;QACnC,YAAY,EAAE,OAAO;KACtB,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,mBAAmB,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;IAC7D,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC;QAC/C,mBAAmB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,aAAa;QACb,oBAAoB;QACpB,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC;IACjE,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IAE9F,MAAM,UAAU,GAAG,+BAA+B,SAAS,IAAI,eAAe,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IACzI,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpE,OAAO;QACL,GAAG;QACH,OAAO,EAAE;YACP,GAAG,mBAAmB;YACtB,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,aAAa;SAChC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAU,EAAE,CACxD,IAAI,CAAC,KAAK;KACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE7B,kHAAkH;AAClH,MAAM,eAAe,GAAG,CAAC,IAAuB,EAAU,EAAE,CAC1D,IAAI,CAAC,KAAK;KACP,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;KACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;KACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAE5B,2GAA2G;AACpG,MAAM,eAAe,GAAG,CAAC,IAAsC,EAAU,EAAE;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,aAAa,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,gBAAgB,CACrG;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,oBAAoB,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEF,gIAAgI;AAChI,oGAAoG;AAC7F,MAAM,kBAAkB,GAAG,CAAC,IAAsC,EAAU,EAAE,CACnF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;KACtB,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAC/E;KACA,IAAI,CAAC,GAAG,CAAC,CAAC;AANF,QAAA,kBAAkB,sBAMhB;AAER,MAAM,eAAe,GAAG,CAAC,IAAqB,EAA0B,EAAE;IAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,wDAAwD,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAEtE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAEnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,iDAAiD,GAAG,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AA9BW,QAAA,eAAe,mBA8B1B;AAEF;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CAAC,IAUrC;IACC,MAAM,EACJ,MAAM,EACN,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,MAAM,EACN,YAAY,EACZ,WAAW,GACZ,GAAG,IAAI,CAAC;IAET,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC;IACjE,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAElF,iGAAiG;IACjG,MAAM,MAAM,GAA2B;QACrC,iBAAiB,EAAE,kBAAkB;QACrC,kBAAkB,EAAE,UAAU;QAC9B,YAAY,EAAE,OAAO;QACrB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IAEF,MAAM,UAAU,GAAc;QAC5B,EAAE,MAAM,EAAE;QACV,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC;QAClC,CAAC,sBAAsB,EAAE,CAAC,EAAE,QAAQ,CAAC;QACrC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CACxF,QAAQ,CACT,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5E,OAAO;QACL,QAAQ,EAAE;YACR,GAAG,MAAM;YACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM;YACN,iBAAiB,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;SACzF;QACD,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CAAC,IAavC;IACC,MAAM,EACJ,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,SAAS,EACT,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,OAAO,EACP,GAAG,GAAG,IAAI,IAAI,EAAE,GACjB,GAAG,IAAI,CAAC;IAET,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC;IACjE,MAAM,aAAa,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3C,wFAAwF;IACxF,MAAM,mBAAmB,GAA2B,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QACzC,mBAAmB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,iGAAiG;IACjG,MAAM,eAAe,GAA2B;QAC9C,iBAAiB,EAAE,kBAAkB;QACrC,kBAAkB,EAAE,GAAG,SAAS,IAAI,eAAe,EAAE;QACrD,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACzC,qBAAqB,EAAE,aAAa;QACpC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAExE,wFAAwF;IACxF,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,aAAa;QACb,oBAAoB;QACpB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,aAAa;QACb,kBAAkB;KACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IAE9F,OAAO,GAAG,MAAM,GAAG,aAAa,IAAI,oBAAoB,oBAAoB,SAAS,EAAE,CAAC;AAC1F,CAAC"}

package/dist/cjs/modules/storage/common/constants.d.ts

@@ -0,0 +1,27 @@
+import { IDuration, TConstValue } from '../../../common';
+/** Presign expiry defaults - a PUT or a POST form carries a file and needs more time; a GET is a redirect. */
+export declare class StoragePresignDefaults {
+    static readonly PUT_EXPIRES_IN: IDuration;
+    static readonly GET_EXPIRES_IN: IDuration;
+    /** A browser upload form: the user has to pick the file and the bytes have to travel. */
+    static readonly POST_EXPIRES_IN: IDuration;
+}
+/** SigV4 refuses a presigned URL valid for longer than 7 days. */
+export declare class StoragePresignLimits {
+    static readonly MAX_EXPIRES_IN_SECONDS: number;
+}
+/** Concurrent object operations. Unbounded exhausts sockets and gets rate limited. */
+export declare class StorageConcurrency {
+    static readonly DEFAULT_LIMIT = 16;
+}
+/** Which host a signed artifact names. `host` is inside every SigV4 signature, so this is decided at signing time and cannot be patched afterwards. */
+export declare class S3Audiences {
+    /** The host THIS process talks to: every bucket operation, copy and tagging call. */
+    static readonly SERVER = "server";
+    /** The host a BROWSER is handed: presigned URLs and POST policies. */
+    static readonly BROWSER = "browser";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(audience: string): boolean;
+}
+export type TS3Audience = TConstValue<typeof S3Audiences>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/cjs/modules/storage/common/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/modules/storage/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,SAAS,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEjE,8GAA8G;AAC9G,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAA6C;IACtF,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAA4C;IAErF,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAA6C;CACxF;AAED,kEAAkE;AAClE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,sBAAsB,SAAoB;CAC3D;AAED,sFAAsF;AACtF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,aAAa,MAAM;CACpC;AAED,uJAAuJ;AACvJ,qBAAa,WAAW;IACtB,qFAAqF;IACrF,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,sEAAsE;IACtE,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAG1C;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/cjs/modules/storage/common/constants.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3Audiences = exports.StorageConcurrency = exports.StoragePresignLimits = exports.StoragePresignDefaults = void 0;
+const common_1 = require("../../../common");
+/** Presign expiry defaults - a PUT or a POST form carries a file and needs more time; a GET is a redirect. */
+class StoragePresignDefaults {
+    static { this.PUT_EXPIRES_IN = { unit: common_1.DurationUnits.MINUTE, value: 10 }; }
+    static { this.GET_EXPIRES_IN = { unit: common_1.DurationUnits.MINUTE, value: 1 }; }
+    /** A browser upload form: the user has to pick the file and the bytes have to travel. */
+    static { this.POST_EXPIRES_IN = { unit: common_1.DurationUnits.MINUTE, value: 15 }; }
+}
+exports.StoragePresignDefaults = StoragePresignDefaults;
+/** SigV4 refuses a presigned URL valid for longer than 7 days. */
+class StoragePresignLimits {
+    static { this.MAX_EXPIRES_IN_SECONDS = 7 * 24 * 60 * 60; }
+}
+exports.StoragePresignLimits = StoragePresignLimits;
+/** Concurrent object operations. Unbounded exhausts sockets and gets rate limited. */
+class StorageConcurrency {
+    static { this.DEFAULT_LIMIT = 16; }
+}
+exports.StorageConcurrency = StorageConcurrency;
+/** Which host a signed artifact names. `host` is inside every SigV4 signature, so this is decided at signing time and cannot be patched afterwards. */
+class S3Audiences {
+    /** The host THIS process talks to: every bucket operation, copy and tagging call. */
+    static { this.SERVER = 'server'; }
+    /** The host a BROWSER is handed: presigned URLs and POST policies. */
+    static { this.BROWSER = 'browser'; }
+    static { this.SCHEME_SET = new Set([this.SERVER, this.BROWSER]); }
+    static isValid(audience) {
+        return this.SCHEME_SET.has(audience);
+    }
+}
+exports.S3Audiences = S3Audiences;
+//# sourceMappingURL=constants.js.map

package/dist/cjs/modules/storage/common/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../src/modules/storage/common/constants.ts"],"names":[],"mappings":";;;AAAA,qCAAiE;AAEjE,8GAA8G;AAC9G,MAAa,sBAAsB;aACjB,mBAAc,GAAc,EAAE,IAAI,EAAE,sBAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;aACtE,mBAAc,GAAc,EAAE,IAAI,EAAE,sBAAa,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAErF,yFAAyF;aACzE,oBAAe,GAAc,EAAE,IAAI,EAAE,sBAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;;AALzF,wDAMC;AAED,kEAAkE;AAClE,MAAa,oBAAoB;aACf,2BAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;;AAD5D,oDAEC;AAED,sFAAsF;AACtF,MAAa,kBAAkB;aACb,kBAAa,GAAG,EAAE,CAAC;;AADrC,gDAEC;AAED,uJAAuJ;AACvJ,MAAa,WAAW;IACtB,qFAAqF;aACrE,WAAM,GAAG,QAAQ,CAAC;IAElC,sEAAsE;aACtD,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;;AAXH,kCAYC"}

package/dist/cjs/modules/storage/common/errors.d.ts

@@ -0,0 +1,22 @@
+import type { TRegisterErrors } from '@venizia/ignis-inversion';
+/** Codes a caller branches on for a storage failure that is the request's fault, not the backend's. */
+export declare const StorageErrors: {
+    readonly OBJECT_NOT_FOUND: {
+        readonly message: {
+            readonly text: "Object not found";
+            readonly code: "core.storage.object_not_found";
+        };
+        readonly statusCode: 404;
+        readonly category: "business";
+    };
+};
+/** Augments inversion, not helpers: TS only treats this as an augmentation when the file imports that module. */
+declare module '@venizia/ignis-inversion' {
+    interface IErrorKeyRegistry extends TRegisterErrors<typeof StorageErrors> {
+    }
+}
+/** "Not there", across SDKs. Both minio and Bun report `S3Error` in `name`, so `code` and status decide. */
+export declare const isNotFoundError: (opts: {
+    error: unknown;
+}) => boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/cjs/modules/storage/common/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../src/modules/storage/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIlF,uGAAuG;AACvG,eAAO,MAAM,aAAa;;;;;;;;;CAM2B,CAAC;AAEtD,iHAAiH;AACjH,OAAO,QAAQ,0BAA0B,CAAC;IACxC,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,aAAa,CAAC;KAAG;CAC7E;AAED,4GAA4G;AAC5G,eAAO,MAAM,eAAe,GAAI,MAAM;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,KAAG,OAW1D,CAAC"}

package/dist/cjs/modules/storage/common/errors.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNotFoundError = exports.StorageErrors = void 0;
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const constants_1 = require("../../../common/constants");
+/** Codes a caller branches on for a storage failure that is the request's fault, not the backend's. */
+exports.StorageErrors = {
+    OBJECT_NOT_FOUND: {
+        message: { text: 'Object not found', code: 'core.storage.object_not_found' },
+        statusCode: constants_1.HTTP.ResultCodes.RS_4.NotFound,
+        category: ignis_inversion_1.ErrorScopes.BUSINESS,
+    },
+};
+/** "Not there", across SDKs. Both minio and Bun report `S3Error` in `name`, so `code` and status decide. */
+const isNotFoundError = (opts) => {
+    const { error } = opts;
+    const source = error;
+    if (source?.statusCode === constants_1.HTTP.ResultCodes.RS_4.NotFound || source?.status === 404) {
+        return true;
+    }
+    const marker = `${source?.code ?? ''} ${source?.name ?? ''}`.toLowerCase();
+    return ['nosuchkey', 'nosuchbucket', 'notfound'].some(needle => marker.includes(needle));
+};
+exports.isNotFoundError = isNotFoundError;
+//# sourceMappingURL=errors.js.map

package/dist/cjs/modules/storage/common/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../src/modules/storage/common/errors.ts"],"names":[],"mappings":";;;AACA,8DAAuD;AACvD,kDAA0C;AAE1C,uGAAuG;AAC1F,QAAA,aAAa,GAAG;IAC3B,gBAAgB,EAAE;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,+BAA+B,EAAE;QAC5E,UAAU,EAAE,gBAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ;QAC1C,QAAQ,EAAE,6BAAW,CAAC,QAAQ;KAC/B;CACkD,CAAC;AAOtD,4GAA4G;AACrG,MAAM,eAAe,GAAG,CAAC,IAAwB,EAAW,EAAE;IACnE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,KAA+E,CAAC;IAE/F,IAAI,MAAM,EAAE,UAAU,KAAK,gBAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3E,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC;AAXW,QAAA,eAAe,mBAW1B"}

package/dist/cjs/modules/storage/common/index.d.ts

@@ -1,2 +1,5 @@
+export * from './constants';
+export * from './errors';
 export * from './types';
+export * from './utility';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/modules/storage/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/modules/storage/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/modules/storage/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC"}

package/dist/cjs/modules/storage/common/index.js

@@ -14,5 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants"), exports);
+__exportStar(require("./errors"), exports);
 __exportStar(require("./types"), exports);
+__exportStar(require("./utility"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/modules/storage/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/storage/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/storage/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,2CAAyB;AACzB,0CAAwB;AACxB,4CAA0B"}