@visulima/storage 1.0.0-alpha.8 → 1.0.0

package/dist/storage/azure/index.d.ts

@@ -1,4 +1,236 @@
-export { default as AzureFile } from "./azure-file.d.ts";
-export { default as AzureSMetaStorage } from "./azure-meta-storage.d.ts";
-export { default as AzureStorage } from "./azure-storage.d.ts";
-export type { AzureMetaStorageOptions, AzureStorageOptions } from "./types.d.ts";
+import { F as File, k as MetaStorageOptions, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, R as RetryConfig, d as FileInit, O as OperationOptions, f as FileQuery, o as BatchOperationResponse, e as FilePart, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-CEM1upWM.js";
+import 'node:stream';
+import { TokenCredential } from '@azure/core-auth';
+import { BlobServiceClient } from '@azure/storage-blob';
+import 'node:crypto';
+import 'node:http';
+import 'lru-cache';
+declare class AzureFile extends File {
+  requestId?: string;
+  uri?: string;
+}
+interface ClientConfig {
+  /**
+  * Azure account key. Resolved from `AZURE_STORAGE_ACCOUNT_KEY` when omitted.
+  */
+  accountKey?: string;
+  /**
+  * Azure account name. Resolved from `AZURE_STORAGE_ACCOUNT` when omitted.
+  */
+  accountName?: string;
+  /**
+  * Azure container name.
+  */
+  containerName: string;
+  /**
+  * Microsoft Entra credential for Azure AD / Managed Identity workloads
+  * (e.g. `DefaultAzureCredential` from `@azure/identity`). When supplied
+  * without a shared key, SDK operations use token auth and signed URLs are
+  * minted via User Delegation SAS.
+  *
+  * The principal must be allowed to access blob data and to call
+  * `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
+  * (for example via Storage Blob Data Contributor + Storage Blob Delegator).
+  */
+  credential?: TokenCredential;
+  /**
+  * Azure endpoint.
+  */
+  endpoint?: string;
+  /**
+  * Azure root path.
+  */
+  root?: string;
+  /**
+  * Pre-issued SAS token (with or without a leading `?`). Resolved from
+  * `AZURE_STORAGE_SAS_TOKEN` when omitted. SAS-token adapters can use their
+  * configured access but cannot mint fresh signed URLs.
+  */
+  sasToken?: string;
+  /**
+  * Controls whether a `credential`-backed adapter mints User Delegation SAS
+  * URLs. Defaults to `true` when `credential` is supplied; set `false` for
+  * token-authenticated SDK operations without signed-URL support.
+  */
+  useUserDelegationSas?: boolean;
+}
+interface ClientConfig {
+  connectionString?: string;
+  /**
+  * Azure container name.
+  */
+  containerName: string;
+  /**
+  * Azure root path.
+  */
+  root?: string;
+}
+interface AzureMetaStorageOptions extends ClientConfig, MetaStorageOptions {
+  client?: BlobServiceClient;
+}
+interface AzureStorageOptions extends BaseStorageOptions, ClientConfig {
+  /**
+  * Configure metafiles storage
+  * @example
+  * ```ts
+  * Using local metafiles
+  * const storage = new AzureStorage({
+  *   bucket: 'upload',
+  *   metaStorageConfig: { directory: '/tmp/upload-metafiles' }
+  * })
+  * ```
+  * Using a separate bucket for metafiles
+  * ```ts
+  * const storage = new AzureStorage({
+  *   bucket: 'upload',
+  *   metaStorageConfig: { bucket: 'upload-metafiles' }
+  * })
+  * ```
+  */
+  metaStorageConfig?: AzureMetaStorageOptions | LocalMetaStorageOptions;
+}
+declare class AzureMetaStorage<T extends File = File> extends MetaStorage<T> {
+  config: AzureMetaStorageOptions;
+  private client;
+  private containerClient;
+  constructor(config: AzureMetaStorageOptions);
+  override get(id: string): Promise<T>;
+  override touch(id: string, file: T): Promise<T>;
+  override delete(id: string): Promise<void>;
+  override save(id: string, file: T): Promise<T>;
+  list(): Promise<T[]>;
+}
+/**
+* Azure Blob Storage implementation.
+* @remarks
+* ## Supported Operations
+* - ✅ create, write, delete, get, list, update, copy, move
+* - ✅ Batch operations: deleteBatch (native Blob Batch API, 256/request), copyBatch + moveBatch (inherited from BaseStorage)
+* - ✅ exists: Implemented (checks metadata and Azure blob)
+* - ❌ getStream: Not implemented (use get() for file retrieval)
+* - ✅ getReadUrl / getUploadUrl: service SAS (shared key / connection string) or User Delegation SAS (Microsoft Entra credential). SAS-token adapters append the pre-issued token. Anonymous (public-container) adapters serve unsigned read URLs only — uploads are rejected.
+*
+* ## Authentication
+* Precedence: connection string, then account key + name, then Microsoft Entra `credential` (Azure AD / Managed Identity), then a pre-issued `sasToken`, then anonymous (public-container) access.
+*/
+declare class AzureStorage extends BaseStorage {
+  static override readonly name: string;
+  override checksumTypes: string[];
+  override get raw(): BlobServiceClient;
+  protected meta: MetaStorage;
+  private client;
+  private readonly containerClient;
+  private readonly root;
+  private readonly resolvedRetryConfig;
+  private readonly signer?;
+  /** Pre-issued SAS token (leading `?` stripped) when in SAS-token mode. */
+  private readonly sasToken?;
+  /** True only for genuine anonymous (public-container) access. */
+  private readonly anonymous?;
+  constructor(config: AzureStorageOptions);
+  protected override getRetryConfig(): RetryConfig;
+  create(config: FileInit, options?: OperationOptions): Promise<AzureFile>;
+  /**
+  * Deletes an upload and its metadata.
+  * @param query File query containing the file ID to delete.
+  * @param query.id File ID to delete.
+  * @returns Promise resolving to the deleted file object with status: "deleted".
+  * @throws {UploadError} If the file metadata cannot be found.
+  */
+  delete({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<AzureFile>;
+  /**
+  * Deletes many blobs in one round-trip using Azure's native
+  * [Blob Batch API](https://learn.microsoft.com/rest/api/storageservices/blob-batch)
+  * (up to 256 sub-requests per request) instead of issuing one DELETE per key.
+  *
+  * Sidecar metadata removal and the {@link onDelete} hook are still applied per
+  * successfully-deleted id; a 404 sub-response is treated as success to match the
+  * `deleteIfExists` semantics of the single-key {@link delete}. If the batch endpoint
+  * is unavailable (e.g. an Azurite build without batch support) the call transparently
+  * falls back to the per-key base implementation.
+  * @param ids File ids/keys to delete.
+  * @param options Optional per-call signal/timeout/retries.
+  */
+  override deleteBatch(ids: string[], options?: OperationOptions): Promise<BatchOperationResponse<AzureFile>>;
+  /**
+  * Moves an upload file to a new location.
+  * @param name Source file name/ID.
+  * @param destination Destination file name/ID.
+  * @returns Promise resolving to the moved file object.
+  * @throws {UploadError} If the source file cannot be found.
+  */
+  move(name: string, destination: string, options?: OperationOptions): Promise<AzureFile>;
+  write(part: FilePart | FileQuery | AzureFile, options?: OperationOptions): Promise<AzureFile>;
+  get({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
+  /**
+  * Checks if a file exists by verifying both metadata and the actual Azure blob.
+  * Returns true only if both the metadata and the blob exist.
+  * @param query File query containing the file ID to check.
+  * @returns Promise resolving to true if both metadata and blob exist, false otherwise.
+  */
+  override exists({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<boolean>;
+  /**
+  * Copies an upload file to a new location.
+  * @param name Source file name/ID.
+  * @param destination Destination file name/ID.
+  * @returns Promise resolving to the copied file object.
+  * @throws {UploadError} If the source file cannot be found.
+  */
+  copy(name: string, destination: string, options?: OperationOptions & {
+    storageClass?: string;
+  }): Promise<AzureFile>;
+  override list(limit?: number, options?: OperationOptions): Promise<AzureFile[]>;
+  /**
+  * Returns a download URL for the blob at `key`.
+  *
+  * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
+  * SAS. SAS-token adapters append the pre-issued token. Genuine anonymous
+  * (public-container) adapters return the unsigned blob URL.
+  * @param key Storage key.
+  * @param options Optional expiry and response content overrides. Response
+  * content overrides only apply when the adapter mints a fresh SAS; they are
+  * rejected on the pre-issued `sasToken` and anonymous paths, which have no
+  * signature in which to bind them.
+  * @throws {UploadError} When the adapter has no way to authorise reads, or
+  * when a response content override is supplied on a non-signing path.
+  */
+  override getReadUrl(key: string, options?: {
+    expiresIn?: number;
+    responseContentDisposition?: string;
+    responseContentType?: string;
+  }): Promise<string>;
+  /**
+  * Returns an upload URL (HTTP PUT, `x-ms-blob-type: BlockBlob`) for `key`.
+  *
+  * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
+  * SAS. SAS-token adapters append the pre-issued token. Anonymous adapters
+  * cannot upload. The caller must send the desired `x-ms-blob-content-type`
+  * header on the PUT — a SAS cannot pin the stored content type.
+  * @param key Storage key.
+  * @param options Optional expiry. `contentLength` and `contentType` are
+  * rejected: an Azure SAS does not bind the request `Content-Type` into the
+  * signature and has no server-enforced size limit, so accepting them would
+  * hand the caller a guarantee that does not hold.
+  * @throws {UploadError} When the adapter cannot authorise writes, or when an
+  * unenforceable `contentType`/`contentLength` override is supplied.
+  */
+  override getUploadUrl(key: string, options?: {
+    contentLength?: number;
+    contentType?: string;
+    expiresIn?: number;
+  }): Promise<string>;
+  /**
+  * Prefixes the given filePath with the storage root location (assetFolder if configured).
+  * @param filePath Relative file path to prefix.
+  * @returns Full path with asset folder prefix if configured, otherwise returns original path.
+  */
+  private getFullPath;
+  private accessCheck;
+}
+export { AzureFile, type AzureMetaStorageOptions, AzureMetaStorage as AzureSMetaStorage, AzureStorage, type AzureStorageOptions };

package/dist/storage/azure/index.js

@@ -1,3 +1 @@
-export { default as AzureFile } from '../../packem_shared/AzureFile-CesgFzps.js';
-export { default as AzureSMetaStorage } from '../../packem_shared/AzureSMetaStorage-CFs-OYJT.js';
-export { default as AzureStorage } from '../../packem_shared/AzureStorage-B0v048hG.js';
+import{default as a}from"../../packem_shared/AzureFile-DFSaVe25.js";import{c as t}from"../../packem_shared/azure-meta-storage-ClbEsfI4.js";import{default as u}from"../../packem_shared/AzureStorage-BFsD4qbF.js";export{a as AzureFile,t as AzureSMetaStorage,u as AzureStorage};

package/dist/storage/box/index.d.ts

@@ -0,0 +1,189 @@
+import { F as File, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, d as FileInit, O as OperationOptions, e as FilePart, f as FileQuery, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-CEM1upWM.js";
+import 'node:stream';
+import { L as LocalMetaStorage } from "../../packem_shared/local-meta-storage.d-D9PBfkn6.js";
+import { BoxClient } from 'box-typescript-sdk-gen';
+import 'node:crypto';
+import 'node:http';
+import 'lru-cache';
+declare class BoxFile extends File {
+  boxFileId?: string;
+  eTag?: string;
+  publicUrl?: string;
+}
+declare class BoxMetaStorage extends LocalMetaStorage<BoxFile> {
+  constructor(config?: LocalMetaStorageOptions);
+}
+interface BoxOAuthOptions {
+  /**
+  * Box application client ID.
+  */
+  clientId: string;
+  /**
+  * Box application client secret.
+  */
+  clientSecret: string;
+  /**
+  * Long-lived refresh token previously obtained via Box's authorization
+  * code flow. The adapter seeds the SDK's in-memory token storage with
+  * this value; the SDK exchanges it for a fresh access token on first
+  * use and re-refreshes when the access token expires.
+  */
+  refreshToken: string;
+}
+interface BoxCcgOptions {
+  /**
+  * Box application client ID.
+  */
+  clientId: string;
+  /**
+  * Box application client secret.
+  */
+  clientSecret: string;
+  /**
+  * Pass `enterpriseId` to authenticate as the service account, or `userId`
+  * to authenticate as a managed/app user. At least one is required.
+  */
+  enterpriseId?: string;
+  /**
+  * Pass `userId` to authenticate as a managed/app user.
+  */
+  userId?: string;
+}
+type BoxJwtOptions = {
+  configFilePath: string;
+} | {
+  configJsonString: string;
+};
+interface BoxStorageOptions extends BaseStorageOptions {
+  /**
+  * Server-side Client Credentials Grant. Mutually exclusive with
+  * `developerToken`, `oauth`, and `jwt`.
+  */
+  ccg?: BoxCcgOptions;
+  /**
+  * Pre-built `BoxClient`. Escape hatch for callers that already wire
+  * auth themselves (e.g. with a custom `NetworkSession`, proxy config,
+  * or downscoped tokens).
+  */
+  client?: BoxClient;
+  /**
+  * Default expiry, in seconds, advertised to callers of `getReadUrl()`.
+  * Box does not document a hard maximum for download URLs (they are
+  * short-lived by API design); this value is forwarded as documentation
+  * only — the actual lifetime is decided by Box. Defaults to 3600.
+  */
+  defaultUrlExpiresIn?: number;
+  /**
+  * Static developer token from the Box developer console. Useful for
+  * scripts and trying the adapter; production apps should use OAuth,
+  * CCG, or JWT instead. Mutually exclusive with `oauth`, `ccg`, `jwt`.
+  */
+  developerToken?: string;
+  /**
+  * JWT Server Authentication, configured via the JSON blob from Box's
+  * developer console. Mutually exclusive with the other auth modes.
+  */
+  jwt?: BoxJwtOptions;
+  /**
+  * Configure metafiles storage. Defaults to local tmp directory.
+  */
+  metaStorageConfig?: LocalMetaStorageOptions;
+  /**
+  * OAuth2 user-app flow seeded with a refresh token. Mutually exclusive
+  * with `developerToken`, `ccg`, and `jwt`.
+  */
+  oauth?: BoxOAuthOptions;
+  /**
+  * When `true`, `getReadUrl` creates (or reuses) an `open`-access shared
+  * link instead of a short-lived signed download URL. Public shared links
+  * may be restricted on Box Business or Enterprise plans; the adapter
+  * surfaces Box's `access_denied_insufficient_permissions` error
+  * unmodified in that case.
+  */
+  publicByDefault?: boolean;
+  /**
+  * Logical "bucket root" — virtual keys live under this Box folder ID.
+  * Use `"0"` (the default) to anchor at the user's root folder. The
+  * folder must already exist; intermediate subfolders are auto-created
+  * on upload.
+  */
+  rootFolderId?: string;
+}
+/**
+* Box storage backend.
+*
+* Routes virtual keys onto Box folder/file IDs under `rootFolderId`. Uploads
+* use `uploads.uploadFile` / `uploads.uploadFileVersion` up to 50 MB and
+* switch to the chunked-upload session API above that threshold. Subfolders
+* along a key's path are auto-created on first write.
+*
+* **Auth precedence**:
+* 1. `client` (pre-built `BoxClient`)
+* 2. `developerToken` (static, from Box developer console)
+* 3. `oauth` (refresh-token seeded — `clientId` + `clientSecret` + `refreshToken`)
+* 4. `ccg` (Client Credentials Grant — `clientId` + `clientSecret` + `enterpriseId` or `userId`)
+* 5. `jwt` (JWT Server Auth — `configJsonString` or `configFilePath`)
+* 6. Env fallback: `BOX_DEVELOPER_TOKEN`
+*
+* **Limitations**:
+* - `metadata` is not supported on the unified API — Box exposes file metadata
+*   via classifications and metadata templates. Use `storage.raw.fileMetadata.*`
+*   directly if you need them.
+* - `cacheControl` is not supported (Box does not expose HTTP cache headers
+*   on file content).
+* - `getUploadUrl` is not supported — Box uploads require a multipart `POST`
+*   with both an `attributes` JSON part and the file bytes part, which doesn't
+*   fit the PUT-with-raw-body presigned-URL contract.
+* - `responseContentDisposition` is not supported on signed download URLs.
+* - `write()` buffers the full part body in memory before choosing between
+*   the simple-upload and chunked-upload paths. Each request handler runs
+*   independently, so concurrent multi-GB writes are bounded by the host's
+*   available memory.
+* - ⚠️ Per-operation `signal`/`timeout` are best-effort: the underlying SDK does not support request cancellation, so an in-flight call may complete server-side even after abort. `retries` is honored.
+*/
+declare class BoxStorage extends BaseStorage<BoxFile> {
+  static override readonly name: string;
+  override checksumTypes: string[];
+  protected meta: MetaStorage<BoxFile>;
+  private readonly authHandle;
+  private readonly client;
+  private readonly fileIdCache;
+  private readonly folderIdCache;
+  private readonly publicByDefault;
+  private readonly rootFolderId;
+  constructor(config: BoxStorageOptions);
+  override get raw(): BoxClient;
+  create(config: FileInit, _options?: OperationOptions): Promise<BoxFile>;
+  write(part: FilePart | FileQuery | BoxFile, options?: OperationOptions): Promise<BoxFile>;
+  delete({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<BoxFile>;
+  get({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
+  copy(name: string, destination: string, options?: OperationOptions & {
+    storageClass?: string;
+  }): Promise<BoxFile>;
+  move(name: string, destination: string, options?: OperationOptions): Promise<BoxFile>;
+  override list(limit?: number, options?: OperationOptions): Promise<BoxFile[]>;
+  override getReadUrl(key: string, options?: {
+    expiresIn?: number;
+    responseContentDisposition?: string;
+    responseContentType?: string;
+  }): Promise<string>;
+  override getUploadUrl(_key: string, _options?: {
+    contentLength?: number;
+    contentType?: string;
+    expiresIn?: number;
+  }): Promise<string>;
+  private findChildByName;
+  private folderCacheKey;
+  private resolveFolderId;
+  private resolveFileId;
+  private resolveExistingFileForUpload;
+  private performUpload;
+  private ensureSharedLink;
+  private fetchSharedLinkUrl;
+  private internalOnComplete;
+}
+export { type BoxCcgOptions, BoxFile, type BoxJwtOptions, BoxMetaStorage, type BoxOAuthOptions, BoxStorage, type BoxStorageOptions };

package/dist/storage/box/index.js

@@ -0,0 +1 @@
+import{default as a}from"../../packem_shared/BoxFile-CseIoPW1.js";import{default as r}from"../../packem_shared/BoxMetaStorage-DFwhEI9C.js";import{default as x}from"../../packem_shared/BoxStorage-B_t-OVzf.js";export{a as BoxFile,r as BoxMetaStorage,x as BoxStorage};

package/dist/storage/bun-s3/index.d.ts

@@ -0,0 +1,200 @@
+import { F as File, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, d as FileInit, O as OperationOptions, e as FilePart, f as FileQuery, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-CEM1upWM.js";
+import { Readable } from 'node:stream';
+import { L as LocalMetaStorage } from "../../packem_shared/local-meta-storage.d-D9PBfkn6.js";
+import 'node:crypto';
+import 'node:http';
+import 'lru-cache';
+declare class BunS3File extends File {
+  /**
+  * ETag reported by the S3-compatible backend (when present on the
+  * stored object).
+  */
+  bunS3ETag?: string;
+  /**
+  * Object key within the bucket.
+  */
+  bunS3Key?: string;
+}
+declare class BunS3MetaStorage extends LocalMetaStorage<BunS3File> {
+  constructor(config?: LocalMetaStorageOptions);
+}
+/**
+* Object metadata returned by `Bun.S3Client.stat` / `S3File.stat`.
+*/
+interface BunS3Stat {
+  etag?: string;
+  lastModified?: Date;
+  size: number;
+  type?: string;
+}
+/**
+* Options accepted by `S3File.presign` / `S3Client.presign`.
+*/
+interface BunS3PresignOptions {
+  acl?: string;
+  contentDisposition?: string;
+  expiresIn?: number;
+  method?: "DELETE" | "GET" | "HEAD" | "POST" | "PUT";
+  type?: string;
+}
+/**
+* Acceptable upload bodies for `Bun.S3Client.write` / `S3File.write`.
+*/
+type BunS3WriteData = ArrayBuffer | Blob | ReadableStream | Response | string | Uint8Array;
+/**
+* Structural view of a Bun `S3File` reference. Declared locally so the
+* adapter type-checks under Node (where the `Bun` global is absent) while
+* still binding to the real runtime object.
+*/
+interface BunS3FileRef {
+  arrayBuffer: () => Promise<ArrayBuffer>;
+  delete: () => Promise<void>;
+  exists: () => Promise<boolean>;
+  presign: (options?: BunS3PresignOptions) => string;
+  slice: (start: number, end?: number) => BunS3FileRef;
+  stat: () => Promise<BunS3Stat>;
+  stream: () => ReadableStream<Uint8Array>;
+  write: (data: BunS3WriteData, options?: {
+    type?: string;
+  }) => Promise<number>;
+}
+/**
+* One entry of a `Bun.S3Client.list` response.
+*/
+interface BunS3ListEntry {
+  eTag?: string;
+  key?: string;
+  lastModified?: Date | string;
+  size?: number;
+}
+/**
+* Structural view of `Bun.S3Client`. Either pass a real instance via
+* `client`, or run under Bun and let the adapter construct one.
+*/
+interface BunS3ClientLike {
+  delete: (key: string) => Promise<void>;
+  exists: (key: string) => Promise<boolean>;
+  file: (key: string) => BunS3FileRef;
+  list: (input?: {
+    continuationToken?: string;
+    maxKeys?: number;
+    prefix?: string;
+    startAfter?: string;
+  }) => Promise<{
+    contents?: BunS3ListEntry[];
+    isTruncated?: boolean;
+    nextContinuationToken?: string;
+  }>;
+  presign: (key: string, options?: BunS3PresignOptions) => string;
+  stat: (key: string) => Promise<BunS3Stat>;
+  write: (key: string, data: BunS3WriteData, options?: {
+    type?: string;
+  }) => Promise<number>;
+}
+interface BunS3StorageOptions extends BaseStorageOptions {
+  /**
+  * S3 access key ID. Falls back to Bun's own env resolution
+  * (`S3_ACCESS_KEY_ID`, then `AWS_ACCESS_KEY_ID`). Ignored when `client`
+  * is supplied.
+  */
+  accessKeyId?: string;
+  /**
+  * Canned ACL applied to uploads (e.g. `"public-read"`). Passed through
+  * to Bun's S3 client.
+  */
+  acl?: string;
+  /**
+  * S3 bucket name. Falls back to Bun's env resolution (`S3_BUCKET`, then
+  * `AWS_BUCKET`). Ignored when `client` is supplied.
+  */
+  bucket?: string;
+  /**
+  * Pre-built `Bun.S3Client` (or `Bun.s3` singleton). Use this to share an
+  * instance or inject a test stub. Mutually exclusive with the inline
+  * credential options.
+  */
+  client?: BunS3ClientLike;
+  /**
+  * Custom S3-compatible endpoint. Falls back to Bun's env resolution
+  * (`S3_ENDPOINT`, then `AWS_ENDPOINT`). Ignored when `client` is
+  * supplied.
+  */
+  endpoint?: string;
+  /**
+  * Configure metafiles storage for resumable-upload bookkeeping.
+  */
+  metaStorageConfig?: LocalMetaStorageOptions;
+  /**
+  * S3 region. Falls back to Bun's env resolution (`S3_REGION`, then
+  * `AWS_REGION`). Ignored when `client` is supplied.
+  */
+  region?: string;
+  /**
+  * S3 secret access key. Falls back to Bun's env resolution
+  * (`S3_SECRET_ACCESS_KEY`, then `AWS_SECRET_ACCESS_KEY`). Ignored when
+  * `client` is supplied.
+  */
+  secretAccessKey?: string;
+  /**
+  * Temporary session token for STS credentials. Ignored when `client` is
+  * supplied.
+  */
+  sessionToken?: string;
+  /**
+  * Use virtual-hosted-style addressing (`https://&lt;bucket>.&lt;host>/...`).
+  * Ignored when `client` is supplied.
+  */
+  virtualHostedStyle?: boolean;
+}
+/**
+* Bun-native S3 storage backend, backed by `Bun.S3Client` instead of the AWS
+* SDK. Use this when you are already running on Bun and want to skip the AWS
+* SDK dependency.
+*
+* Limitations (inherent to `Bun.S3Client`, which exposes no low-level
+* multipart or server-side copy primitives):
+*
+* - No resumable / TUS multipart protocol. Each `write` uploads the supplied body in one shot (Bun handles large-object chunking internally). For resumable uploads use the `aws` or `aws-light` provider.
+* - `copy` / `move` are client-side read-then-write — Bun has no server-side `CopyObject`.
+* - `getUploadUrl` returns a presigned `PUT`; a `contentLength` cap cannot be enforced (Bun presign has no max-size policy) and is ignored.
+* - ⚠️ Per-operation `signal`/`timeout` are best-effort: the underlying SDK does not support request cancellation, so an in-flight call may complete server-side even after abort. `retries` is honored.
+*/
+declare class BunS3Storage extends BaseStorage<BunS3File> {
+  static override readonly name: string;
+  protected meta: MetaStorage<BunS3File>;
+  private readonly client;
+  constructor(config: BunS3StorageOptions);
+  override get raw(): BunS3ClientLike;
+  create(config: FileInit, _options?: OperationOptions): Promise<BunS3File>;
+  write(part: BunS3File | FilePart | FileQuery, options?: OperationOptions): Promise<BunS3File>;
+  delete({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<BunS3File>;
+  get({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
+  override getStream({
+    id
+  }: FileQuery, options?: OperationOptions): Promise<{
+    headers?: Record<string, string>;
+    size?: number;
+    stream: Readable;
+  }>;
+  copy(name: string, destination: string, options?: OperationOptions & {
+    storageClass?: string;
+  }): Promise<BunS3File>;
+  move(name: string, destination: string, options?: OperationOptions): Promise<BunS3File>;
+  override list(limit?: number, options?: OperationOptions): Promise<BunS3File[]>;
+  override getReadUrl(key: string, options?: {
+    expiresIn?: number;
+    responseContentDisposition?: string;
+    responseContentType?: string;
+  }): Promise<string>;
+  override getUploadUrl(key: string, options?: {
+    contentLength?: number;
+    contentType?: string;
+    expiresIn?: number;
+  }): Promise<string>;
+  private internalOnComplete;
+}
+export { type BunS3ClientLike, BunS3File, BunS3MetaStorage, BunS3Storage, type BunS3StorageOptions };

package/dist/storage/bun-s3/index.js

@@ -0,0 +1 @@
+import{default as t}from"../../packem_shared/BunS3File-BcYmsz1n.js";import{default as r}from"../../packem_shared/BunS3MetaStorage-DFwhEI9C.js";import{default as u}from"../../packem_shared/BunS3Storage-CB_pZWlV.js";export{t as BunS3File,r as BunS3MetaStorage,u as BunS3Storage};