actor-ts 0.9.1 → 0.11.0

package/dist/persistence/object-storage/Integrity.d.ts

@@ -0,0 +1,43 @@
+/**
+ * HMAC-SHA256 helpers for unencrypted body integrity (#116).
+ *
+ * Closes a gap in the wire format: AES-GCM's auth tag protects
+ * encrypted bodies against tampering, but `mode: 'none'` bodies (the
+ * default) had no integrity field.  An attacker with write access to
+ * the object-storage backend could flip JSON bytes — including the
+ * `revision` digit used by DurableState's CAS — without detection.
+ *
+ * Fix: opt-in HMAC-SHA256 over the payload bytes, truncated to 16
+ * bytes (128-bit MAC strength), appended to the body and flagged in
+ * the manifest.  Key is **separate** from the encryption master key
+ * (the threat is tampering, not confidentiality), held by the same
+ * deployment.  Verification runs at the codec boundary before the
+ * payload is returned to the store layer.
+ *
+ * Defaults to off so legacy bodies (no `FLAG_INTEGRITY_HMAC`) keep
+ * decoding cleanly.  Operators opt in by setting the new
+ * `IntegrityConfig` on a `ObjectStorageDurableStateStore` (or the
+ * `integrity` option on a single call).
+ */
+/** Length of the HMAC key, in bytes. */
+export declare const HMAC_KEY_LENGTH = 32;
+/**
+ * Length of the truncated HMAC tag appended to bodies.  Truncated
+ * SHA-256 stays well above the practical forgery threshold (128 bits =
+ * 2^128 attempts).  Keeps the storage overhead constant at 16 bytes
+ * per body regardless of payload size.
+ */
+export declare const HMAC_TAG_LENGTH = 16;
+/**
+ * Compute HMAC-SHA256 over `data` with `key`, truncated to
+ * {@link HMAC_TAG_LENGTH} bytes.
+ */
+export declare function hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+/**
+ * Constant-time comparison of two byte arrays.  Avoids leaking the
+ * position of the first mismatch via timing.  Returns `false` for
+ * length-mismatches as a fast-path (no information leak since length
+ * is part of the wire format).
+ */
+export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=Integrity.d.ts.map

package/dist/persistence/object-storage/Integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Integrity.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/Integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wCAAwC;AACxC,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAalC;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAcvF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKvE"}

package/dist/persistence/object-storage/Integrity.js

@@ -0,0 +1,66 @@
+/**
+ * HMAC-SHA256 helpers for unencrypted body integrity (#116).
+ *
+ * Closes a gap in the wire format: AES-GCM's auth tag protects
+ * encrypted bodies against tampering, but `mode: 'none'` bodies (the
+ * default) had no integrity field.  An attacker with write access to
+ * the object-storage backend could flip JSON bytes — including the
+ * `revision` digit used by DurableState's CAS — without detection.
+ *
+ * Fix: opt-in HMAC-SHA256 over the payload bytes, truncated to 16
+ * bytes (128-bit MAC strength), appended to the body and flagged in
+ * the manifest.  Key is **separate** from the encryption master key
+ * (the threat is tampering, not confidentiality), held by the same
+ * deployment.  Verification runs at the codec boundary before the
+ * payload is returned to the store layer.
+ *
+ * Defaults to off so legacy bodies (no `FLAG_INTEGRITY_HMAC`) keep
+ * decoding cleanly.  Operators opt in by setting the new
+ * `IntegrityConfig` on a `ObjectStorageDurableStateStore` (or the
+ * `integrity` option on a single call).
+ */
+/** Length of the HMAC key, in bytes. */
+export const HMAC_KEY_LENGTH = 32;
+/**
+ * Length of the truncated HMAC tag appended to bodies.  Truncated
+ * SHA-256 stays well above the practical forgery threshold (128 bits =
+ * 2^128 attempts).  Keeps the storage overhead constant at 16 bytes
+ * per body regardless of payload size.
+ */
+export const HMAC_TAG_LENGTH = 16;
+function getSubtle() {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('SubtleCrypto is not available in this runtime.  Body integrity '
+            + 'requires WebCrypto — Node 20+, Bun, or Deno.');
+    }
+    return subtle;
+}
+/**
+ * Compute HMAC-SHA256 over `data` with `key`, truncated to
+ * {@link HMAC_TAG_LENGTH} bytes.
+ */
+export async function hmacSha256(key, data) {
+    if (key.byteLength !== HMAC_KEY_LENGTH) {
+        throw new Error(`integrity key must be ${HMAC_KEY_LENGTH} bytes, got ${key.byteLength}`);
+    }
+    const subtle = getSubtle();
+    const cryptoKey = await subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await subtle.sign('HMAC', cryptoKey, data);
+    return new Uint8Array(sig).subarray(0, HMAC_TAG_LENGTH);
+}
+/**
+ * Constant-time comparison of two byte arrays.  Avoids leaking the
+ * position of the first mismatch via timing.  Returns `false` for
+ * length-mismatches as a fast-path (no information leak since length
+ * is part of the wire format).
+ */
+export function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+//# sourceMappingURL=Integrity.js.map

package/dist/persistence/object-storage/Integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Integrity.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/Integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,SAAS,SAAS;IAChB,MAAM,MAAM,GAAI,UAAU,CAAC,MAA6B,EAAE,MAAM,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iEAAiE;cAC/D,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,eAAe,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,GAA8B,EAC9B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAA+B,CAAC,CAAC;IAClF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/persistence/object-storage/ObjectStoragePlugin.d.ts

@@ -2,7 +2,7 @@ import type { PersistenceExtension } from '../PersistenceExtension.js';
 import { ObjectStorageDurableStateStore } from '../durable-state-stores/ObjectStorageDurableStateStore.js';
 import { type S3Credentials } from './S3ObjectStorageBackend.js';
 import type { ObjectStorageBackend } from './ObjectStorageBackend.js';
-import { type CompressionConfig, type CompressionResolver, type EncryptionConfig, type EncryptionResolver } from './PluginConfig.js';
+import type { ObjectStoragePluginOptions } from './ObjectStoragePluginOptions.js';
 /** Canonical plugin IDs registered by `registerObjectStoragePlugins`. */
 export declare const OBJECT_STORAGE_SNAPSHOT_PLUGIN_ID = "actor-ts.persistence.snapshot-store.object-storage";
 export declare const OBJECT_STORAGE_DURABLE_STATE_PLUGIN_ID = "actor-ts.persistence.durable-state.object-storage";
@@ -26,22 +26,6 @@ export type ObjectStorageBackendSpec = {
     readonly kind: 'custom';
     readonly backend: ObjectStorageBackend;
 };
-export interface ObjectStoragePluginOptions {
-    /** Plugin ID under which the snapshot store is registered. */
-    readonly snapshotPluginId?: string;
-    /** Plugin ID for the durable-state store. */
-    readonly durableStatePluginId?: string;
-    /** Backend definition — filesystem, S3, or custom. */
-    readonly backend: ObjectStorageBackendSpec;
-    /** Key prefix prepended to every object — e.g. `'env-prod/'`. */
-    readonly prefix?: string;
-    /** Snapshot history retention; `0` disables pruning.  Default: 3. */
-    readonly keepN?: number;
-    /** Compression config or per-pid resolver.  Default: gzip. */
-    readonly compression?: CompressionConfig | CompressionResolver;
-    /** Encryption config or per-pid resolver.  Default: none. */
-    readonly encryption?: EncryptionConfig | EncryptionResolver;
-}
 export interface ObjectStoragePluginHandles {
     /** The shared backend — both stores write through this. */
     readonly backend: ObjectStorageBackend;
@@ -49,7 +33,7 @@ export interface ObjectStoragePluginHandles {
      * The DurableState store instance.  `PersistenceExtension` doesn't
      * carry a DurableState registry today, so callers that want
      * DurableState pass this directly into `DurableStateActor`'s
-     * settings.
+     * options.
      */
     readonly durableStateStore: ObjectStorageDurableStateStore;
 }
@@ -59,7 +43,7 @@ export interface ObjectStoragePluginHandles {
  * Cassandra plugin's one-call wiring while accepting that DurableState
  * isn't extension-managed today — callers who want DurableState read
  * `handles.durableStateStore` from the return value and pass it into
- * their `DurableStateActor` settings.
+ * their `DurableStateActor` options.
  *
  * **Eager peer-dep validation (#18, #59).**  Before returning, this
  * function probes any optional peer-dependency the configured codecs
@@ -75,11 +59,11 @@ export interface ObjectStoragePluginHandles {
  * Example:
  *
  *   const ext = system.extension(PersistenceExtensionId);
- *   const { durableStateStore } = await registerObjectStoragePlugins(ext, {
- *     backend: { kind: 's3', bucket: 'my-app', region: 'eu-central-1' },
- *     compression: { algorithm: 'zstd' },
- *     encryption:  encryptionByPrefix({ default: { mode: 'sse-s3' } }),
- *   });
+ *   const { durableStateStore } = await registerObjectStoragePlugins(ext,
+ *     ObjectStoragePluginOptions.create()
+ *       .withBackend({ kind: 's3', bucket: 'my-app', region: 'eu-central-1' })
+ *       .withCompression({ algorithm: 'zstd' })
+ *       .withEncryption(encryptionByPrefix({ default: { mode: 'sse-s3' } })));
  *   // ... and to make the snapshot plugin active:
  *   //   actor-ts.persistence.snapshot-store.plugin = "actor-ts.persistence.snapshot-store.object-storage"
  */

package/dist/persistence/object-storage/ObjectStoragePlugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ObjectStoragePlugin.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePlugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAK3G,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,uDAAuD,CAAC;AACtG,eAAO,MAAM,sCAAsC,sDAAsD,CAAC;AAE1G;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;CACtC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,0BAA0B;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;IAC/D,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;CAC5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwBrC;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAiBf"}
+{"version":3,"file":"ObjectStoragePlugin.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePlugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAK3G,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAkC,MAAM,iCAAiC,CAAC;AASlH,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,uDAAuD,CAAC;AACtG,eAAO,MAAM,sCAAsC,sDAAsD,CAAC;AAE1G;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;CACtC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,0BAA0B;IACzC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;CAC5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4BrC;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/persistence/object-storage/ObjectStoragePlugin.js

@@ -14,7 +14,7 @@ export const OBJECT_STORAGE_DURABLE_STATE_PLUGIN_ID = 'actor-ts.persistence.dura
  * Cassandra plugin's one-call wiring while accepting that DurableState
  * isn't extension-managed today — callers who want DurableState read
  * `handles.durableStateStore` from the return value and pass it into
- * their `DurableStateActor` settings.
+ * their `DurableStateActor` options.
  *
  * **Eager peer-dep validation (#18, #59).**  Before returning, this
  * function probes any optional peer-dependency the configured codecs
@@ -30,30 +30,37 @@ export const OBJECT_STORAGE_DURABLE_STATE_PLUGIN_ID = 'actor-ts.persistence.dura
  * Example:
  *
  *   const ext = system.extension(PersistenceExtensionId);
- *   const { durableStateStore } = await registerObjectStoragePlugins(ext, {
- *     backend: { kind: 's3', bucket: 'my-app', region: 'eu-central-1' },
- *     compression: { algorithm: 'zstd' },
- *     encryption:  encryptionByPrefix({ default: { mode: 'sse-s3' } }),
- *   });
+ *   const { durableStateStore } = await registerObjectStoragePlugins(ext,
+ *     ObjectStoragePluginOptions.create()
+ *       .withBackend({ kind: 's3', bucket: 'my-app', region: 'eu-central-1' })
+ *       .withCompression({ algorithm: 'zstd' })
+ *       .withEncryption(encryptionByPrefix({ default: { mode: 'sse-s3' } })));
  *   // ... and to make the snapshot plugin active:
  *   //   actor-ts.persistence.snapshot-store.plugin = "actor-ts.persistence.snapshot-store.object-storage"
  */
 export async function registerObjectStoragePlugins(ext, options) {
-    await validateObjectStoragePeerDeps(options);
-    const backend = buildBackend(options.backend);
-    const snapshotId = options.snapshotPluginId ?? OBJECT_STORAGE_SNAPSHOT_PLUGIN_ID;
-    ext.registerSnapshotStore(snapshotId, (_system) => new ObjectStorageSnapshotStore({
-        backend,
-        prefix: options.prefix,
-        keepN: options.keepN,
-        compression: options.compression,
-        encryption: options.encryption,
-    }));
+    const resolvedOptions = options;
+    if (resolvedOptions.backend === undefined)
+        throw new Error('registerObjectStoragePlugins: backend is required (call withBackend()).');
+    await validateObjectStoragePeerDeps(resolvedOptions);
+    const backend = buildBackend(resolvedOptions.backend);
+    const snapshotId = resolvedOptions.snapshotPluginId ?? OBJECT_STORAGE_SNAPSHOT_PLUGIN_ID;
+    ext.registerSnapshotStore(snapshotId, (_system) => {
+        return new ObjectStorageSnapshotStore({
+            backend,
+            ...(resolvedOptions.prefix !== undefined ? { prefix: resolvedOptions.prefix } : {}),
+            ...(resolvedOptions.keepN !== undefined ? { keepN: resolvedOptions.keepN } : {}),
+            ...(resolvedOptions.compression !== undefined ? { compression: resolvedOptions.compression } : {}),
+            ...(resolvedOptions.encryption !== undefined ? { encryption: resolvedOptions.encryption } : {}),
+            ...(resolvedOptions.maxDecompressedBytes !== undefined ? { maxDecompressedBytes: resolvedOptions.maxDecompressedBytes } : {}),
+        });
+    });
     const durableStateStore = new ObjectStorageDurableStateStore({
         backend,
-        prefix: options.prefix,
-        compression: options.compression,
-        encryption: options.encryption,
+        ...(resolvedOptions.prefix !== undefined ? { prefix: resolvedOptions.prefix } : {}),
+        ...(resolvedOptions.compression !== undefined ? { compression: resolvedOptions.compression } : {}),
+        ...(resolvedOptions.encryption !== undefined ? { encryption: resolvedOptions.encryption } : {}),
+        ...(resolvedOptions.maxDecompressedBytes !== undefined ? { maxDecompressedBytes: resolvedOptions.maxDecompressedBytes } : {}),
     });
     return { backend, durableStateStore };
 }
@@ -63,9 +70,10 @@ export async function registerObjectStoragePlugins(ext, options) {
  * actually registering the plugin.
  */
 export async function validateObjectStoragePeerDeps(options) {
+    const resolvedOptions = options;
     // Compression: probe each algorithm at most once.
     const algos = new Set();
-    for (const cfg of collectCompressionConfigs(options.compression)) {
+    for (const cfg of collectCompressionConfigs(resolvedOptions.compression)) {
         algos.add(cfg.algorithm);
     }
     for (const algo of algos) {
@@ -74,7 +82,7 @@ export async function validateObjectStoragePeerDeps(options) {
     // Encryption: WebCrypto is needed for the client-aes256-gcm mode
     // (HKDF + AES-GCM go through SubtleCrypto).  The server-side modes
     // — sse-s3, sse-kms — are header pass-throughs and need nothing.
-    const encConfigs = collectEncryptionConfigs(options.encryption);
+    const encConfigs = collectEncryptionConfigs(resolvedOptions.encryption);
     if (encConfigs.some((c) => c.mode === 'client-aes256-gcm')) {
         await probeEncryptionAvailability();
     }
@@ -99,14 +107,16 @@ function collectEncryptionConfigs(e) {
 }
 function buildBackend(spec) {
     switch (spec.kind) {
-        case 'filesystem': return new FilesystemObjectStorageBackend({ dir: spec.dir });
-        case 's3': return new S3ObjectStorageBackend({
-            bucket: spec.bucket,
-            region: spec.region,
-            endpoint: spec.endpoint,
-            forcePathStyle: spec.forcePathStyle,
-            credentials: spec.credentials,
-        });
+        case 'filesystem':
+            return new FilesystemObjectStorageBackend({ dir: spec.dir });
+        case 's3':
+            return new S3ObjectStorageBackend({
+                bucket: spec.bucket,
+                region: spec.region,
+                ...(spec.endpoint !== undefined ? { endpoint: spec.endpoint } : {}),
+                ...(spec.forcePathStyle !== undefined ? { forcePathStyle: spec.forcePathStyle } : {}),
+                ...(spec.credentials !== undefined ? { credentials: spec.credentials } : {}),
+            });
         case 'custom': return spec.backend;
     }
 }

package/dist/persistence/object-storage/ObjectStoragePlugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"ObjectStoragePlugin.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePlugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAKf,MAAM,mBAAmB,CAAC;AAE3B,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,oDAAoD,CAAC;AACtG,MAAM,CAAC,MAAM,sCAAsC,GAAG,mDAAmD,CAAC;AAiD1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAyB,EACzB,OAAmC;IAEnC,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;IAEjF,GAAG,CAAC,qBAAqB,CAAC,UAAU,EAAE,CAAC,OAAoB,EAAE,EAAE,CAC7D,IAAI,0BAA0B,CAAC;QAC7B,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CACH,CAAC;IAEF,MAAM,iBAAiB,GAAG,IAAI,8BAA8B,CAAC;QAC3D,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAmC;IAEnC,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,2BAA2B,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,CAAsD;IAEtD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,sDAAsD;QACtD,gEAAgE;QAChE,qDAAqD;QACrD,OAAO,cAAc,CAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAC/B,CAAoD;IAEpD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,cAAc,CAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,CAAC,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAA8B;IAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,YAAY,CAAC,CAAC,OAAO,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,sBAAsB,CAAC;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,KAAK,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;IACrC,CAAC;AACH,CAAC"}
+{"version":3,"file":"ObjectStoragePlugin.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePlugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,cAAc,GAKf,MAAM,mBAAmB,CAAC;AAE3B,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,oDAAoD,CAAC;AACtG,MAAM,CAAC,MAAM,sCAAsC,GAAG,mDAAmD,CAAC;AAgC1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAyB,EACzB,OAAmC;IAEnC,MAAM,eAAe,GAAI,OAA0C,CAAC;IACpE,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACtI,MAAM,6BAA6B,CAAC,eAAe,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;IAEzF,GAAG,CAAC,qBAAqB,CAAC,UAAU,EAAE,CAAC,OAAoB,EAAE,EAAE;QAC7D,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,eAAe,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9H,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,8BAA8B,CAAC;QAC3D,OAAO;QACP,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,eAAe,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,eAAe,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9H,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAmC;IAEnC,MAAM,eAAe,GAAI,OAA0C,CAAC;IACpE,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,yBAAyB,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,UAAU,GAAG,wBAAwB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,2BAA2B,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,CAAsD;IAEtD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5B,sDAAsD;QACtD,gEAAgE;QAChE,qDAAqD;QACrD,OAAO,cAAc,CAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAC/B,CAAoD;IAEpD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,cAAc,CAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,CAAC,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAA8B;IAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,KAAK,IAAI;YACP,OAAO,IAAI,sBAAsB,CAAC;gBAChC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,KAAK,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/persistence/object-storage/ObjectStoragePluginOptions.d.ts

@@ -0,0 +1,72 @@
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+import type { CompressionConfig, CompressionResolver, EncryptionConfig, EncryptionResolver } from './PluginConfig.js';
+import type { ObjectStorageBackendSpec } from './ObjectStoragePlugin.js';
+export interface ObjectStoragePluginOptionsType {
+    /** Plugin ID under which the snapshot store is registered. */
+    readonly snapshotPluginId?: string;
+    /** Plugin ID for the durable-state store. */
+    readonly durableStatePluginId?: string;
+    /** Backend definition — filesystem, S3, or custom. */
+    readonly backend: ObjectStorageBackendSpec;
+    /** Key prefix prepended to every object — e.g. `'env-prod/'`. */
+    readonly prefix?: string;
+    /** Snapshot history retention; `0` disables pruning.  Default: 3. */
+    readonly keepN?: number;
+    /** Compression config or per-pid resolver.  Default: gzip. */
+    readonly compression?: CompressionConfig | CompressionResolver;
+    /** Encryption config or per-pid resolver.  Default: none. */
+    readonly encryption?: EncryptionConfig | EncryptionResolver;
+    /**
+     * Cap on the decompressed size of a stored body in bytes — the
+     * decompression-bomb guard on read (security audit #3), applied to both the
+     * snapshot and durable-state stores this plugin registers.  Default 512 MiB
+     * (`DEFAULT_MAX_DECOMPRESSED_BYTES`); `Infinity` opts out.
+     */
+    readonly maxDecompressedBytes?: number;
+}
+/**
+ * Fluent builder for {@link ObjectStoragePluginOptionsType}.  The `backend`
+ * spec is required:
+ *
+ *     registerObjectStoragePlugins(ext,
+ *       ObjectStoragePluginOptions.create()
+ *         .withBackend({ kind: 's3', bucket: 'my-app', region: 'eu-central-1' })
+ *         .withCompression({ algorithm: 'zstd' }))
+ *
+ * The `backend` spec ({@link ObjectStorageBackendSpec}) and the
+ * compression / encryption config-or-resolver unions are passed WHOLE
+ * into their respective `withX(...)` — they are polymorphic sub-configs,
+ * not further nested builders.
+ */
+export declare class ObjectStoragePluginOptionsBuilder extends OptionsBuilder<ObjectStoragePluginOptionsType> {
+    /** Start a fresh builder.  Equivalent to `new ObjectStoragePluginOptionsBuilder()`. */
+    static create(): ObjectStoragePluginOptionsBuilder;
+    /** Backend definition — filesystem, S3, or custom.  Required. */
+    withBackend(backend: ObjectStorageBackendSpec): this;
+    /** Key prefix prepended to every object — e.g. `'env-prod/'`. */
+    withPrefix(prefix: string): this;
+    /** Snapshot history retention; `0` disables pruning.  Default: 3. */
+    withKeepN(keepN: number): this;
+    /** Compression config or per-pid resolver (passed whole).  Default: gzip. */
+    withCompression(compression: CompressionConfig | CompressionResolver): this;
+    /** Encryption config or per-pid resolver (passed whole).  Default: none. */
+    withEncryption(encryption: EncryptionConfig | EncryptionResolver): this;
+    /**
+     * Cap on the decompressed body size (bytes) for both registered stores —
+     * decompression-bomb guard (#3).  Default 512 MiB; `Infinity` opts out.
+     */
+    withMaxDecompressedBytes(bytes: number): this;
+    /** Plugin ID under which the snapshot store is registered. */
+    withSnapshotPluginId(snapshotPluginId: string): this;
+    /** Plugin ID for the durable-state store. */
+    withDurableStatePluginId(durableStatePluginId: string): this;
+}
+/**
+ * Accepted input for {@link registerObjectStoragePlugins}: the fluent
+ * {@link ObjectStoragePluginOptionsBuilder} OR a plain
+ * {@link ObjectStoragePluginOptionsType} object.
+ */
+export type ObjectStoragePluginOptions = ObjectStoragePluginOptionsBuilder | Partial<ObjectStoragePluginOptionsType>;
+/** Value alias so `ObjectStoragePluginOptions.create()` / `new ObjectStoragePluginOptions()` resolve to the builder. */
+export declare const ObjectStoragePluginOptions: typeof ObjectStoragePluginOptionsBuilder;
+//# sourceMappingURL=ObjectStoragePluginOptions.d.ts.map

package/dist/persistence/object-storage/ObjectStoragePluginOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ObjectStoragePluginOptions.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,WAAW,8BAA8B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;IAC/D,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAAC;IAC5D;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iCAAkC,SAAQ,cAAc,CAAC,8BAA8B,CAAC;IACnG,uFAAuF;IACvF,MAAM,CAAC,MAAM,IAAI,iCAAiC;IAIlD,iEAAiE;IACjE,WAAW,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAIpD,iEAAiE;IACjE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIhC,qEAAqE;IACrE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI9B,6EAA6E;IAC7E,eAAe,CAAC,WAAW,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,IAAI;IAI3E,4EAA4E;IAC5E,cAAc,CAAC,UAAU,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,IAAI;IAIvE;;;OAGG;IACH,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI7C,8DAA8D;IAC9D,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI;IAIpD,6CAA6C;IAC7C,wBAAwB,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI;CAG7D;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,iCAAiC,GACjC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAC5C,wHAAwH;AACxH,eAAO,MAAM,0BAA0B,0CAAoC,CAAC"}

package/dist/persistence/object-storage/ObjectStoragePluginOptions.js

@@ -0,0 +1,59 @@
+import { OptionsBuilder } from '../../util/OptionsBuilder.js';
+/**
+ * Fluent builder for {@link ObjectStoragePluginOptionsType}.  The `backend`
+ * spec is required:
+ *
+ *     registerObjectStoragePlugins(ext,
+ *       ObjectStoragePluginOptions.create()
+ *         .withBackend({ kind: 's3', bucket: 'my-app', region: 'eu-central-1' })
+ *         .withCompression({ algorithm: 'zstd' }))
+ *
+ * The `backend` spec ({@link ObjectStorageBackendSpec}) and the
+ * compression / encryption config-or-resolver unions are passed WHOLE
+ * into their respective `withX(...)` — they are polymorphic sub-configs,
+ * not further nested builders.
+ */
+export class ObjectStoragePluginOptionsBuilder extends OptionsBuilder {
+    /** Start a fresh builder.  Equivalent to `new ObjectStoragePluginOptionsBuilder()`. */
+    static create() {
+        return new ObjectStoragePluginOptionsBuilder();
+    }
+    /** Backend definition — filesystem, S3, or custom.  Required. */
+    withBackend(backend) {
+        return this.set('backend', backend);
+    }
+    /** Key prefix prepended to every object — e.g. `'env-prod/'`. */
+    withPrefix(prefix) {
+        return this.set('prefix', prefix);
+    }
+    /** Snapshot history retention; `0` disables pruning.  Default: 3. */
+    withKeepN(keepN) {
+        return this.set('keepN', keepN);
+    }
+    /** Compression config or per-pid resolver (passed whole).  Default: gzip. */
+    withCompression(compression) {
+        return this.set('compression', compression);
+    }
+    /** Encryption config or per-pid resolver (passed whole).  Default: none. */
+    withEncryption(encryption) {
+        return this.set('encryption', encryption);
+    }
+    /**
+     * Cap on the decompressed body size (bytes) for both registered stores —
+     * decompression-bomb guard (#3).  Default 512 MiB; `Infinity` opts out.
+     */
+    withMaxDecompressedBytes(bytes) {
+        return this.set('maxDecompressedBytes', bytes);
+    }
+    /** Plugin ID under which the snapshot store is registered. */
+    withSnapshotPluginId(snapshotPluginId) {
+        return this.set('snapshotPluginId', snapshotPluginId);
+    }
+    /** Plugin ID for the durable-state store. */
+    withDurableStatePluginId(durableStatePluginId) {
+        return this.set('durableStatePluginId', durableStatePluginId);
+    }
+}
+/** Value alias so `ObjectStoragePluginOptions.create()` / `new ObjectStoragePluginOptions()` resolve to the builder. */
+export const ObjectStoragePluginOptions = ObjectStoragePluginOptionsBuilder;
+//# sourceMappingURL=ObjectStoragePluginOptions.js.map

package/dist/persistence/object-storage/ObjectStoragePluginOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ObjectStoragePluginOptions.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/ObjectStoragePluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiC9D;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iCAAkC,SAAQ,cAA8C;IACnG,uFAAuF;IACvF,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,iCAAiC,EAAE,CAAC;IACjD,CAAC;IAED,iEAAiE;IACjE,WAAW,CAAC,OAAiC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,qEAAqE;IACrE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,eAAe,CAAC,WAAoD;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,4EAA4E;IAC5E,cAAc,CAAC,UAAiD;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,wBAAwB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,8DAA8D;IAC9D,oBAAoB,CAAC,gBAAwB;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAED,6CAA6C;IAC7C,wBAAwB,CAAC,oBAA4B;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;CACF;AAUD,wHAAwH;AACxH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC"}

package/dist/persistence/object-storage/PluginConfig.d.ts

@@ -1,4 +1,4 @@
-import type { CompressionConfig, EncryptionConfig } from '../PersistenceOptions.js';
+import type { CompressionConfig, EncryptionConfig, IntegrityConfig } from '../PersistenceOptions.js';
 /**
  * Programmatic configuration for compression and encryption — used by
  * `ObjectStorageSnapshotStore` and `ObjectStorageDurableStateStore` as
@@ -18,9 +18,10 @@ import type { CompressionConfig, EncryptionConfig } from '../PersistenceOptions.
  * Convenience helpers (`compressionByPrefix`, `encryptionByPrefix`)
  * build common resolvers for the longest-prefix-match pattern.
  */
-export type { CompressionAlgo, CompressionConfig, EncryptionConfig, MasterKeyRing, MasterKeyRingEntry, } from '../PersistenceOptions.js';
+export type { CompressionAlgo, CompressionConfig, EncryptionConfig, IntegrityConfig, MasterKeyRing, MasterKeyRingEntry, } from '../PersistenceOptions.js';
 export type CompressionResolver = (persistenceId: string) => CompressionConfig | undefined;
 export type EncryptionResolver = (persistenceId: string) => EncryptionConfig | undefined;
+export type IntegrityResolver = (persistenceId: string) => IntegrityConfig | undefined;
 /**
  * Internal: a resolver function with optional introspection metadata.
  * `compressionByPrefix` / `encryptionByPrefix` attach `__knownConfigs`
@@ -47,6 +48,8 @@ export declare function knownConfigsOf<T>(resolver: ((pid: string) => T | undefi
 export declare function resolveCompression(config: CompressionConfig | CompressionResolver | undefined, pid: string, fallback: CompressionConfig): CompressionConfig;
 /** Same shape as `resolveCompression` but for encryption configs. */
 export declare function resolveEncryption(config: EncryptionConfig | EncryptionResolver | undefined, pid: string, fallback: EncryptionConfig): EncryptionConfig;
+/** Same shape as `resolveCompression` but for integrity configs (#116). */
+export declare function resolveIntegrity(config: IntegrityConfig | IntegrityResolver | undefined, pid: string, fallback: IntegrityConfig): IntegrityConfig;
 /**
  * Build a `CompressionResolver` from a longest-prefix-match map.  The
  * `default` entry is used when no other prefix matches.

package/dist/persistence/object-storage/PluginConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PluginConfig.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/PluginConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,iBAAiB,GAAG,SAAS,CAAC;AAE3F,MAAM,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAC;AAEzF;;;;;;GAMG;AACH,QAAA,MAAM,aAAa,eAA0D,CAAC;AAE9E,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,QAAQ,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,6BAA6B,QAAgB,CAAC;AAc3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC,GACzC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAE9B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,SAAS,EAC3D,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAInB;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,SAAS,EACzD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,gBAAgB,GACzB,gBAAgB,CAIlB;AAID;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACjF,mBAAmB,CAcrB;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAChC,IAAI,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/E,kBAAkB,CAYpB"}
+{"version":3,"file":"PluginConfig.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/PluginConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,iBAAiB,GAAG,SAAS,CAAC;AAE3F,MAAM,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAC;AAEzF,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;AAEvF;;;;;;GAMG;AACH,QAAA,MAAM,aAAa,eAA0D,CAAC;AAE9E,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,QAAQ,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,6BAA6B,QAAgB,CAAC;AAc3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC,GACzC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAE9B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,SAAS,EAC3D,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAInB;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,SAAS,EACzD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,gBAAgB,GACzB,gBAAgB,CAIlB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GAAG,iBAAiB,GAAG,SAAS,EACvD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GACxB,eAAe,CAIjB;AAID;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACjF,mBAAmB,CAcrB;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAChC,IAAI,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/E,kBAAkB,CAYpB"}

package/dist/persistence/object-storage/PluginConfig.js

@@ -44,6 +44,14 @@ export function resolveEncryption(config, pid, fallback) {
         return config(pid) ?? fallback;
     return config;
 }
+/** Same shape as `resolveCompression` but for integrity configs (#116). */
+export function resolveIntegrity(config, pid, fallback) {
+    if (config === undefined)
+        return fallback;
+    if (typeof config === 'function')
+        return config(pid) ?? fallback;
+    return config;
+}
 /* ------------------------- Convenience builders ------------------------- */
 /**
  * Build a `CompressionResolver` from a longest-prefix-match map.  The

package/dist/persistence/object-storage/PluginConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginConfig.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/PluginConfig.ts"],"names":[],"mappings":"AAqCA;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;AAM9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC;AAE3D,SAAS,kBAAkB,CACzB,EAAK,EAAE,OAAyB;IAEhC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE;QACvC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA0C;IAE1C,OAAQ,QAAwC,CAAC,aAAa,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA2D,EAC3D,GAAW,EACX,QAA2B;IAE3B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,MAAyD,EACzD,GAAW,EACX,QAA0B;IAE1B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkF;IAElF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,MAAM,QAAQ,GAAwB,CAAC,GAAG,EAAE,EAAE;QAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,qEAAqE;IACrE,+DAA+D;IAC/D,MAAM,GAAG,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,IAAgF;IAEhF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,MAAM,QAAQ,GAAuB,CAAC,GAAG,EAAE,EAAE;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,GAAG,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"PluginConfig.js","sourceRoot":"","sources":["../../../src/persistence/object-storage/PluginConfig.ts"],"names":[],"mappings":"AAyCA;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;AAM9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC;AAE3D,SAAS,kBAAkB,CACzB,EAAK,EAAE,OAAyB;IAEhC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE;QACvC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA0C;IAE1C,OAAQ,QAAwC,CAAC,aAAa,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA2D,EAC3D,GAAW,EACX,QAA2B;IAE3B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,MAAyD,EACzD,GAAW,EACX,QAA0B;IAE1B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAC9B,MAAuD,EACvD,GAAW,EACX,QAAyB;IAEzB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkF;IAElF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,MAAM,QAAQ,GAAwB,CAAC,GAAG,EAAE,EAAE;QAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,qEAAqE;IACrE,+DAA+D;IAC/D,MAAM,GAAG,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,IAAgF;IAEhF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,MAAM,QAAQ,GAAuB,CAAC,GAAG,EAAE,EAAE;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,GAAG,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/dist/persistence/object-storage/S3ObjectStorageBackend.d.ts

@@ -1,5 +1,6 @@
 import { type Option } from '../../util/Option.js';
 import { type ObjectFetched, type ObjectInfo, type ObjectStorageBackend, type PutOptions } from './ObjectStorageBackend.js';
+import type { S3ObjectStorageOptions } from './S3ObjectStorageOptions.js';
 /**
  * S3-compatible `ObjectStorageBackend` — wraps AWS SDK v3
  * (`@aws-sdk/client-s3`) and works against AWS S3, MinIO, Cloudflare R2,
@@ -32,36 +33,6 @@ export interface S3Credentials {
     readonly secretAccessKey: string;
     readonly sessionToken?: string;
 }
-export interface S3ObjectStorageOptions {
-    /** S3 bucket name. */
-    readonly bucket: string;
-    /** AWS region.  For Cloudflare R2 use `'auto'`. */
-    readonly region: string;
-    /**
-     * Custom endpoint URL.  Use this for MinIO (`http://localhost:9000`),
-     * Cloudflare R2 (`https://<account>.r2.cloudflarestorage.com`),
-     * Backblaze B2, DigitalOcean Spaces, Wasabi.  Omit for AWS S3.
-     */
-    readonly endpoint?: string;
-    /**
-     * Force path-style URLs (`<endpoint>/<bucket>/<key>`) instead of
-     * virtual-host style (`<bucket>.<endpoint>/<key>`).  Required for
-     * MinIO and most non-AWS S3-compatible stores.
-     */
-    readonly forcePathStyle?: boolean;
-    /**
-     * Static credentials.  Omit to fall back to the SDK's default chain
-     * (env vars `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, EC2 instance
-     * profile, IAM role for service accounts, …).
-     */
-    readonly credentials?: S3Credentials;
-    /**
-     * Allow injecting a pre-built `S3Client` — useful for tests, custom
-     * middleware, or sharing one client across multiple backends.  When
-     * provided, all other connection options are ignored.
-     */
-    readonly client?: S3ClientLike;
-}
 export declare class S3ObjectStorageBackend implements ObjectStorageBackend {
     private readonly clientLazy;
     private readonly bucket;

package/dist/persistence/object-storage/S3ObjectStorageBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"S3ObjectStorageBackend.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/S3ObjectStorageBackend.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,sBAAsB;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,qBAAa,sBAAuB,YAAW,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,EAAE,sBAAsB;IAcrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BpF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAyBhD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAoCrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAoCD,UAAU,WAAW;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;CAAE;AACxC,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB"}
+{"version":3,"file":"S3ObjectStorageBackend.d.ts","sourceRoot":"","sources":["../../../src/persistence/object-storage/S3ObjectStorageBackend.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,sBAAsB,EAA8B,MAAM,6BAA6B,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,sBAAuB,YAAW,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,EAAE,sBAAsB;IAgBrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BpF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAyBhD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAoCrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAoCD,UAAU,WAAW;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;CAAE;AACxC,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB"}