cursedbelt 2.7.0 → 3.0.0

package/src/server/storage/mountMediaRoutes.ts

@@ -1,231 +0,0 @@
-import type { Context, Hono } from 'hono';
-import type { SourceRegistry } from './sources';
-import { serveRange } from './streamRange';
-import type { StreamGrant, StreamTokenService } from './streamToken';
-import {
-  fsDisplayKey,
-  fsHlsFileKey,
-  fsMp4Key,
-  fsPosterKey,
-  fsSourceKey,
-  fsSpriteKey,
-  fsVttKey,
-  type MediaCtx,
-  type MediaStore,
-} from './types';
-
-// Mounts the byte-serving media routes. These live OUTSIDE an app's guarded API (a <video>/
-// hls.js request can't send the platform Bearer) and authorize each request with a path-embedded
-// stream token instead. Optionally hooks decryption for private (pfs/…) bytes (private-media).
-//
-// `basePath` is the on-server MOUNT path (always path-only, e.g. '/_media'). It is separate from
-// the PUBLIC url base passed to `createMediaUrls` (which may be an absolute API-origin URL for a
-// split-origin deploy); the two only need to share this trailing path. When media is served
-// cross-origin (assets on Cloudflare Pages, API+media on an EC2 subdomain), the browser's media
-// element makes CORS requests — pass `cors` so responses carry the right ACAO and EXPOSE the
-// range headers (Content-Range/Accept-Ranges) a seeking <video> needs cross-origin.
-
-/** Resolves the Access-Control-Allow-Origin for a request origin: a fixed origin, an allowlist
- * (echoes the request origin when allowed), or a custom resolver (return null to deny). */
-export type CorsResolver =
-  | string
-  | string[]
-  | ((requestOrigin: string | undefined) => string | null | undefined);
-
-export type MountMediaOptions = {
-  /** Byte backend shared by this mount (keys carry the owner). */
-  store: MediaStore;
-  /** Verifies the path token → owner/source/video grant. */
-  token: StreamTokenService;
-  /** On-server route mount path (path-only; must share its trailing path with the createMediaUrls
-   * baseUrl). Default '/_media'. */
-  basePath?: string;
-  /** Sources, for upload ingest. */
-  registry?: SourceRegistry;
-  /** Cross-origin access for split-origin deploys (media on a different origin than the SPA).
-   * Omit for same-origin. */
-  cors?: CorsResolver;
-  /** Authorizes an upload request (it CAN send the Bearer, unlike a media element). Return a
-   * MediaCtx to allow, or null to reject. Omit ⇒ uploads are disabled on this mount. */
-  authorizeUpload?: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
-  /** Optional hook to decrypt bytes for the private (pfs/…) keyspace before serving. Wired by
-   * the private-media layer; omitted ⇒ all bytes served as stored. */
-  decryptStream?: (
-    stream: ReadableStream<Uint8Array>,
-    grant: StreamGrant,
-  ) => ReadableStream<Uint8Array>;
-};
-
-const EXPOSE_HEADERS = 'Content-Range, Content-Length, Accept-Ranges';
-
-function resolveAcao(cors: CorsResolver | undefined, reqOrigin: string | undefined): string | null {
-  if (!cors) return null;
-  if (typeof cors === 'string') return cors;
-  if (Array.isArray(cors)) return reqOrigin && cors.includes(reqOrigin) ? reqOrigin : null;
-  return cors(reqOrigin) ?? null;
-}
-
-export function mountMediaRoutes(app: Hono, opts: MountMediaOptions): void {
-  const base = opts.basePath ?? '/_media';
-  const { store, token } = opts;
-
-  // Stamp CORS headers on a media response (and expose the range headers a cross-origin seeking
-  // <video> needs). A no-op when `cors` is unset (same-origin).
-  const cors = (c: Context, res: Response): Response => {
-    const acao = resolveAcao(opts.cors, c.req.header('origin'));
-    if (acao) {
-      res.headers.set('Access-Control-Allow-Origin', acao);
-      res.headers.set('Access-Control-Expose-Headers', EXPOSE_HEADERS);
-      res.headers.append('Vary', 'Origin');
-    }
-    return res;
-  };
-
-  // Preflight for cross-origin media/upload requests.
-  if (opts.cors) {
-    app.options(`${base}/*`, (c) => {
-      const acao = resolveAcao(opts.cors, c.req.header('origin'));
-      const headers: Record<string, string> = {
-        'Access-Control-Allow-Methods': 'GET, PUT, OPTIONS',
-        'Access-Control-Allow-Headers': 'Range, Content-Type, X-Filename, Authorization',
-        'Access-Control-Max-Age': '86400',
-      };
-      if (acao) {
-        headers['Access-Control-Allow-Origin'] = acao;
-        headers.Vary = 'Origin';
-      }
-      return c.body(null, 204, headers);
-    });
-  }
-
-  // Resolve + validate the token a serve route carries, and confirm it matches the source/video
-  // in the path (so a token minted for video A can't fetch video B).
-  const grantFor = async (
-    c: Context,
-    expectSource: string,
-    expectVideo: string,
-  ): Promise<StreamGrant | null> => {
-    const raw = c.req.param('token');
-    if (!raw) return null;
-    const grant = await token.verify(raw);
-    if (!grant) return null;
-    if (grant.sourceId !== expectSource || grant.videoId !== expectVideo) return null;
-    return grant;
-  };
-
-  // GET progressive MP4 (Range). Prefers the faststart derivative; falls back to the raw source
-  // when the pipeline hasn't produced one (ffmpeg absent / still processing).
-  app.get(`${base}/s/:token/media/:source/:video`, async (c) => {
-    const grant = await grantFor(c, c.req.param('source'), c.req.param('video'));
-    if (!grant) return c.body(null, 401);
-    const mp4 = fsMp4Key(grant.owner, grant.videoId);
-    const key = (await store.stat(mp4)) ? mp4 : fsSourceKey(grant.owner, grant.videoId);
-    if (store.redirectUrl) {
-      const url = await store.redirectUrl(key, { mime: 'video/mp4' });
-      if (url) return cors(c, c.redirect(url, 303));
-    }
-    return cors(
-      c,
-      await serveRange(store, key, 'video/mp4', c.req.header('range'), {
-        contentDisposition: 'inline',
-      }),
-    );
-  });
-
-  // GET an HLS file (master.m3u8 / <height>/playlist.m3u8 / <height>/seg_*.ts). Relative URIs
-  // inside the playlists resolve under this same /s/:token/hls/:source/:video/ prefix.
-  app.get(`${base}/s/:token/hls/:source/:video/*`, async (c) => {
-    const grant = await grantFor(c, c.req.param('source'), c.req.param('video'));
-    if (!grant) return c.body(null, 401);
-    const prefix = `${base}/s/${c.req.param('token')}/hls/${grant.sourceId}/${grant.videoId}/`;
-    const rel = c.req.path.slice(prefix.length);
-    if (!rel || rel.includes('..')) return c.body(null, 400);
-    const mime = rel.endsWith('.m3u8') ? 'application/vnd.apple.mpegurl' : 'video/mp2t';
-    return cors(
-      c,
-      await serveRange(
-        store,
-        fsHlsFileKey(grant.owner, grant.videoId, rel),
-        mime,
-        c.req.header('range'),
-      ),
-    );
-  });
-
-  app.get(`${base}/s/:token/poster/:source/:video`, async (c) => {
-    const grant = await grantFor(c, c.req.param('source'), c.req.param('video'));
-    if (!grant) return c.body(null, 401);
-    return cors(
-      c,
-      await serveRange(
-        store,
-        fsPosterKey(grant.owner, grant.videoId),
-        'image/jpeg',
-        c.req.header('range'),
-      ),
-    );
-  });
-
-  // Full-size browser-safe JPEG for images the browser can't render natively (HEIC/HEIF). Serves
-  // the display derivative; falls back to the small poster if it isn't built yet (the boot backfill
-  // produces it, so the fallback is momentary) — never a raw HEIC the browser would fail on.
-  app.get(`${base}/s/:token/display/:source/:video`, async (c) => {
-    const grant = await grantFor(c, c.req.param('source'), c.req.param('video'));
-    if (!grant) return c.body(null, 401);
-    const displayKey = fsDisplayKey(grant.owner, grant.videoId);
-    const key = (await store.stat(displayKey))
-      ? displayKey
-      : fsPosterKey(grant.owner, grant.videoId);
-    return cors(c, await serveRange(store, key, 'image/jpeg', c.req.header('range')));
-  });
-
-  // Sprite sheet + its WebVTT track, served as siblings so the VTT's relative 'sprites.jpg' cue
-  // targets resolve to the jpg route.
-  app.get(`${base}/s/:token/sprite/:source/:video/:file`, async (c) => {
-    const grant = await grantFor(c, c.req.param('source'), c.req.param('video'));
-    if (!grant) return c.body(null, 401);
-    const file = c.req.param('file');
-    if (file === 'sprites.vtt') {
-      return cors(
-        c,
-        await serveRange(
-          store,
-          fsVttKey(grant.owner, grant.videoId),
-          'text/vtt',
-          c.req.header('range'),
-        ),
-      );
-    }
-    if (file === 'sprites.jpg') {
-      return cors(
-        c,
-        await serveRange(
-          store,
-          fsSpriteKey(grant.owner, grant.videoId),
-          'image/jpeg',
-          c.req.header('range'),
-        ),
-      );
-    }
-    return c.body(null, 404);
-  });
-
-  // PUT upload → ingest. Guarded by the app-supplied authorizer (a fetch CAN send the Bearer).
-  const { authorizeUpload, registry } = opts;
-  if (authorizeUpload && registry) {
-    app.put(`${base}/upload/:source`, async (c) => {
-      const ctx = await authorizeUpload(c);
-      if (!ctx) return c.json({ error: 'unauthorized' }, 401);
-      const source = registry.get(c.req.param('source'));
-      if (!source?.ingest) return c.json({ error: 'source not found' }, 404);
-      const body = c.req.raw.body;
-      if (!body) return c.json({ error: 'empty body' }, 400);
-      const video = await source.ingest(ctx, {
-        name: c.req.header('x-filename') ?? 'upload',
-        mime: c.req.header('content-type') ?? 'application/octet-stream',
-        body,
-      });
-      return c.json({ video });
-    });
-  }
-}

package/src/server/storage/objectStore.spec.ts

@@ -1,272 +0,0 @@
-/**
- * `object-store-contract` — ONE suite, both implementations (08 §1 "Gates").
- *
- * The point of running the identical assertions against `createFsObjectStore`
- * (local, over a temp dir) and `createS3ObjectStore` (saas, over an in-process
- * fake bucket implementing the S3 subset) is that `AssetService` and the asset
- * mixin are written against the interface alone. If the two stores disagree on
- * a key, on what "missing" looks like, or on whether a failed upload is
- * visible, then a profile switch is a behavior change — and behavior changes
- * that only appear in production are exactly what a seam is supposed to
- * prevent.
- *
- * The S3 fake is deliberately strict where correctness lives: a multipart
- * upload is only visible after `end()` with NO error, and `end(error)` discards
- * the parts. That is the property that keeps a torn upload from both serving
- * corrupt bytes and accruing invisible storage cost.
- */
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createFsObjectStore } from 'cwip/storage';
-import type { ObjectStore } from 'cwip/storage';
-import { createS3ObjectStore, type S3ClientLike, type S3ObjectHandle } from './s3ObjectStore';
-
-const streamOf = (text: string): ReadableStream<Uint8Array> =>
-  new Response(text).body as ReadableStream<Uint8Array>;
-
-const textOf = async (body: ReadableStream<Uint8Array> | null): Promise<string | null> =>
-  body === null ? null : await new Response(body).text();
-
-const tornStream = (): ReadableStream<Uint8Array> =>
-  new ReadableStream<Uint8Array>({
-    start(controller) {
-      controller.enqueue(new TextEncoder().encode('PARTIAL'));
-      controller.error(new Error('client hung up'));
-    },
-  });
-
-/* ------------------------------------------------------- the S3 test double */
-
-interface FakeBucket extends S3ClientLike {
-  objects: Map<string, { body: string; type?: string }>;
-  /** Lifetimes (seconds) handed to `presign`, newest last. */
-  presigned: number[];
-  /** Keys whose multipart upload was aborted rather than completed. */
-  aborted: string[];
-}
-
-const createFakeBucket = (): FakeBucket => {
-  const objects = new Map<string, { body: string; type?: string }>();
-  const presigned: number[] = [];
-  const aborted: string[] = [];
-
-  const file = (key: string, options?: { type?: string }): S3ObjectHandle => ({
-    stream() {
-      const found = objects.get(key);
-      if (!found) throw Object.assign(new Error('NoSuchKey'), { code: 'NoSuchKey' });
-      return streamOf(found.body);
-    },
-    writer() {
-      // Parts accumulate OFF the bucket; only a clean `end()` publishes them.
-      const parts: string[] = [];
-      let settled = false;
-      return {
-        write(chunk: Uint8Array) {
-          if (settled) throw new Error('write after end');
-          parts.push(new TextDecoder().decode(chunk));
-          return chunk.byteLength;
-        },
-        end(error?: Error) {
-          settled = true;
-          if (error) {
-            aborted.push(key);
-            return 0;
-          }
-          const body = parts.join('');
-          objects.set(key, { body, type: options?.type });
-          return body.length;
-        },
-      };
-    },
-    async exists() {
-      return objects.has(key);
-    },
-    async stat() {
-      const found = objects.get(key);
-      if (!found) throw Object.assign(new Error('NoSuchKey'), { code: 'NoSuchKey' });
-      return { size: found.body.length, type: found.type, lastModified: new Date(0) };
-    },
-    async delete() {
-      if (!objects.delete(key)) throw Object.assign(new Error('NoSuchKey'), { code: 'NoSuchKey' });
-    },
-    presign(options?: { expiresIn?: number }) {
-      presigned.push(options?.expiresIn ?? 0);
-      return `https://bucket.example/${key}?X-Amz-Expires=${options?.expiresIn ?? 0}`;
-    },
-  });
-
-  return { file, objects, presigned, aborted };
-};
-
-/* ------------------------------------------------------------- the contract */
-
-interface StoreUnderTest {
-  name: string;
-  /** Fresh store per test. `lifetimeOf` reads back the expiry a signed URL carries, in seconds. */
-  create(): Promise<{ store: ObjectStore; lifetimeOf(url: string): number }>;
-  cleanup(): Promise<void>;
-}
-
-const runObjectStoreContract = (subject: StoreUnderTest): void => {
-  describe(`ObjectStore contract — ${subject.name}`, () => {
-    let store: ObjectStore;
-    let lifetimeOf: (url: string) => number;
-
-    beforeEach(async () => {
-      ({ store, lifetimeOf } = await subject.create());
-    });
-    afterEach(async () => {
-      await subject.cleanup();
-    });
-
-    it('round-trips bytes, size and content type', async () => {
-      const stat = await store.put('t_1/file_a', streamOf('HELLO'), { contentType: 'text/plain' });
-      expect(stat).toMatchObject({ key: 't_1/file_a', size: 5, contentType: 'text/plain' });
-
-      await expect(textOf(await store.get('t_1/file_a'))).resolves.toBe('HELLO');
-      await expect(store.stat('t_1/file_a')).resolves.toMatchObject({ size: 5, contentType: 'text/plain' });
-    });
-
-    it('reports a missing object as null on BOTH read paths', async () => {
-      await expect(store.get('t_1/absent')).resolves.toBeNull();
-      await expect(store.stat('t_1/absent')).resolves.toBeNull();
-    });
-
-    it('refuses the same illegal keys on both profiles', async () => {
-      for (const key of ['t_1/../escape', '/absolute', 't_1/.hidden', 't_1//empty', 't_1/sp ace']) {
-        await expect(store.put(key, streamOf('x'))).rejects.toMatchObject({ code: 'OBJECT_KEY_INVALID' });
-      }
-    });
-
-    it('never publishes a torn upload', async () => {
-      await expect(store.put('t_1/file_torn', tornStream())).rejects.toThrow('client hung up');
-      await expect(store.get('t_1/file_torn')).resolves.toBeNull();
-      await expect(store.stat('t_1/file_torn')).resolves.toBeNull();
-    });
-
-    it('overwrites cleanly rather than appending', async () => {
-      await store.put('t_1/file_a', streamOf('FIRST'), { contentType: 'text/plain' });
-      const second = await store.put('t_1/file_a', streamOf('SECOND-AND-LONGER'), { contentType: 'text/plain' });
-      expect(second.size).toBe('SECOND-AND-LONGER'.length);
-      await expect(textOf(await store.get('t_1/file_a'))).resolves.toBe('SECOND-AND-LONGER');
-    });
-
-    it('delete is idempotent and reports whether anything was removed', async () => {
-      await store.put('t_1/file_a', streamOf('x'));
-      await expect(store.delete('t_1/file_a')).resolves.toBe(true);
-      await expect(store.delete('t_1/file_a')).resolves.toBe(false);
-      await expect(store.get('t_1/file_a')).resolves.toBeNull();
-    });
-
-    it('streams a multi-chunk body without reassembling it upstream', async () => {
-      const chunks = ['alpha', 'beta', 'gamma'];
-      const body = new ReadableStream<Uint8Array>({
-        start(controller) {
-          for (const chunk of chunks) controller.enqueue(new TextEncoder().encode(chunk));
-          controller.close();
-        },
-      });
-      const stat = await store.put('t_1/file_multi', body);
-      expect(stat.size).toBe('alphabetagamma'.length);
-      await expect(textOf(await store.get('t_1/file_multi'))).resolves.toBe('alphabetagamma');
-    });
-
-    it('issues a signed URL with an expiry, and caps a caller asking for a year', async () => {
-      await store.put('t_1/file_a', streamOf('x'));
-
-      const shortLived = await store.signedUrl('t_1/file_a', { expiresInSeconds: 60 });
-      expect(shortLived).toContain('t_1/file_a');
-      expect(lifetimeOf(shortLived)).toBe(60);
-
-      const capped = await store.signedUrl('t_1/file_a', { expiresInSeconds: 31_536_000 });
-      expect(lifetimeOf(capped)).toBe(86_400);
-
-      const defaulted = await store.signedUrl('t_1/file_a');
-      expect(lifetimeOf(defaulted)).toBe(300);
-    });
-
-    it('refuses a nonsensical signed-url lifetime instead of minting a permanent URL', async () => {
-      await expect(store.signedUrl('t_1/file_a', { expiresInSeconds: 0 })).rejects.toMatchObject({
-        code: 'OBJECT_KEY_INVALID',
-      });
-      await expect(store.signedUrl('t_1/file_a', { expiresInSeconds: -1 })).rejects.toBeDefined();
-    });
-  });
-};
-
-/* ------------------------------------------------------------ both subjects */
-
-let fsRoot: string | null = null;
-
-runObjectStoreContract({
-  name: 'createFsObjectStore (local)',
-  async create() {
-    fsRoot = await mkdtemp(join(tmpdir(), 'cc-object-store-contract-'));
-    const store = createFsObjectStore({ root: fsRoot, signingKey: 'contract-key', now: () => 1_000_000 });
-    return {
-      store,
-      lifetimeOf: (url) => Number(new URL(url, 'http://local').searchParams.get('exp')) - 1_000_000,
-    };
-  },
-  async cleanup() {
-    if (fsRoot) await rm(fsRoot, { recursive: true, force: true });
-    fsRoot = null;
-  },
-});
-
-let bucket: FakeBucket | null = null;
-
-runObjectStoreContract({
-  name: 'createS3ObjectStore (saas)',
-  async create() {
-    bucket = createFakeBucket();
-    const store = createS3ObjectStore({ client: bucket });
-    return { store, lifetimeOf: (url) => Number(new URL(url).searchParams.get('X-Amz-Expires')) };
-  },
-  async cleanup() {
-    bucket = null;
-  },
-});
-
-/* --------------------------------------------------- saas-only expectations */
-
-describe('createS3ObjectStore specifics', () => {
-  it('aborts the multipart upload on failure rather than completing it', async () => {
-    const fake = createFakeBucket();
-    const store = createS3ObjectStore({ client: fake });
-
-    await expect(store.put('t_1/file_torn', tornStream())).rejects.toThrow('client hung up');
-    // Abort, not complete: an abandoned multipart bills for parts nobody can list.
-    expect(fake.aborted).toEqual(['t_1/file_torn']);
-    expect(fake.objects.has('t_1/file_torn')).toBe(false);
-  });
-
-  it('namespaces every physical key under keyPrefix while the logical key is unchanged', async () => {
-    const fake = createFakeBucket();
-    const store = createS3ObjectStore({ client: fake, keyPrefix: '/apps/demo/' });
-
-    await store.put('t_1/file_a', streamOf('HELLO'), { contentType: 'text/plain' });
-    expect([...fake.objects.keys()]).toEqual(['apps/demo/t_1/file_a']);
-    // The caller still speaks the tenant-scoped logical key — the prefix is
-    // deployment topology, invisible above the store.
-    await expect(textOf(await store.get('t_1/file_a'))).resolves.toBe('HELLO');
-    await expect(store.stat('t_1/file_a')).resolves.toMatchObject({ key: 't_1/file_a', size: 5 });
-    await expect(store.delete('t_1/file_a')).resolves.toBe(true);
-  });
-
-  it('presigns a GET, so the bytes leave via the CDN rather than this process', async () => {
-    const fake = createFakeBucket();
-    const store = createS3ObjectStore({ client: fake });
-    await store.put('t_1/file_a', streamOf('x'));
-
-    const url = await store.signedUrl('t_1/file_a');
-    expect(url.startsWith('https://')).toBe(true);
-    expect(fake.presigned.at(-1)).toBe(300);
-  });
-
-  it('refuses to construct without a client or a bucket', () => {
-    expect(() => createS3ObjectStore({})).toThrow(/client.*bucket|bucket/i);
-  });
-});

package/src/server/storage/objectStoreMediaStore.ts

@@ -1,63 +0,0 @@
-// Bridge the framework's stream-based `ObjectStore` (cwip/storage) to the
-// byte/stream `MediaStore` the proven `processVideo` pipeline drives (§2d).
-//
-// `processVideo` predates the engine `ObjectStore`: it speaks `MediaStore`
-// (put(bytes)/putStream/get(bytes)/stat/localPath). The engine wires an
-// `ObjectStore` (put(stream)/get(stream)/stat/delete/signedUrl). Rather than
-// fork the whole transcode orchestrator onto a second store type, the asset
-// `transcode` handler wraps its `ObjectStore` in this adapter and reuses the
-// pipeline unchanged. There is deliberately NO `localPath`, so `processVideo`
-// materialises the source by download — correct for a stream store where the
-// bytes may live off-box (S3/R2).
-
-import type { ObjectStore } from 'cwip/storage';
-import type { MediaStore } from './types';
-
-const streamToBytes = async (stream: ReadableStream<Uint8Array>): Promise<Uint8Array> =>
-  new Uint8Array(await new Response(stream).arrayBuffer());
-
-const bytesToStream = (bytes: Uint8Array): ReadableStream<Uint8Array> =>
-  new ReadableStream<Uint8Array>({
-    start(controller) {
-      controller.enqueue(bytes);
-      controller.close();
-    },
-  });
-
-/** Adapt an {@link ObjectStore} to the {@link MediaStore} contract `processVideo` expects. */
-export function objectStoreAsMediaStore(objects: ObjectStore): MediaStore {
-  return {
-    async put(key, bytes, mime) {
-      await objects.put(key, bytesToStream(bytes), { contentType: mime });
-    },
-    async putStream(key, body, mime) {
-      await objects.put(key, body, { contentType: mime });
-    },
-    async get(key) {
-      const stream = await objects.get(key);
-      return stream ? await streamToBytes(stream) : null;
-    },
-    async remove(key) {
-      await objects.delete(key);
-    },
-    async removePrefix() {
-      // The `ObjectStore` contract has no prefix delete, and `processVideo` never
-      // calls this — surface misuse loudly rather than silently no-op.
-      throw new Error('objectStoreAsMediaStore.removePrefix is not supported over an ObjectStore.');
-    },
-    async stat(key) {
-      const stat = await objects.stat(key);
-      return stat ? { size: stat.size } : null;
-    },
-    async getRange(key, range) {
-      const stream = await objects.get(key);
-      if (!stream) return null;
-      if (!range) return { stream };
-      // Whole-object read then slice: unused by `processVideo`, present only to
-      // satisfy the interface. A hot Range-serving path uses the real store.
-      const bytes = await streamToBytes(stream);
-      return { stream: bytesToStream(bytes.subarray(range.start, range.end + 1)) };
-    },
-    // No `localPath`: force `processVideo` down its download path (stream store).
-  };
-}