partial-content 1.0.0

package/dist/gcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcs.js","sourceRoot":"","sources":["../src/gcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,GAMhB,MAAM,YAAY,CAAC;AAEpB,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC;AA4C1E,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,OAAO;QACL,aAAa,EAAE,IAAI;QAEnB,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAA+B;YAC3D,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;YAEtG,OAAO;gBACL,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,YAAY,EAAE,QAAQ,CAAC,OAAO;oBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;oBAC1C,CAAC,CAAC,SAAS;gBACb,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iBAAiB;gBACjB,GAAG,EAAE,QAAQ,CAAC,UAAU,KAAK,SAAS;oBACpC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACxB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,IAAoF;YAC/G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;YACnD,MAAM,EAAE,cAAc,EAAE,CAAC;YAEzB,kEAAkE;YAClE,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;gBAC/D,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,UAAuC,CAAC;YAC5C,IAAI,SAAiB,CAAC;YACtB,IAAI,IAAwB,CAAC;YAC7B,IAAI,YAAgC,CAAC;YAErC,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;gBAClC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;gBAC3B,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;gBACtB,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,qEAAqE;gBACrE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;gBAEtG,oEAAoE;gBACpE,sEAAsE;gBACtE,4DAA4D;gBAC5D,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC1D,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;gBAED,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBACjC,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACrB,YAAY,GAAG,QAAQ,CAAC,OAAO;oBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;oBAC1C,CAAC,CAAC,SAAS,CAAC;YAChB,CAAC;YAED,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;gBACtC,4DAA4D;gBAC5D,kEAAkE;gBAClE,sEAAsE;gBACtE,MAAM,IAAI,UAAU,CAClB,YAAY,GAAG,iBAAiB,KAAK,CAAC,KAAK,0BAA0B,SAAS,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,KAAK;gBACtB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC7B,CAAC,CAAC,SAAS,CAAC;YAEd,kEAAkE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,UAAU,GAAG,UAAU,KAAK,SAAS;gBACzC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC;gBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,UAAU,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAE3D,MAAM,aAAa,GAAG,KAAK;gBACzB,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;gBACzB,CAAC,CAAC,SAAS,CAAC;YAEd,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;YAExF,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,aAAa;gBACb,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;gBACtD,IAAI;gBACJ,YAAY;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,SAAS,YAAY,CAAC,QAAyB;IAC7C,MAAM,GAAG,GAAW;QAClB,UAAU,EAAE,QAAQ,CAAC,UAAW;QAChC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,SAAS;KACd,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC7C,YAAY,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM;YAC1C,OAAQ,MAAiB,CAAC,IAAI,KAAK,QAAQ;YAC3C,MAAM,CAAC,QAAQ,CAAE,MAAiB,CAAC,IAAI,CAAC;YACxC,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,oCAAoC;YACpC,iBAAiB,CAAE,MAAiB,CAAC,UAAU,CAAC,EAChD,CAAC;YACD,OAAO,MAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,OAAQ,GAAyB,CAAC,IAAI,KAAK,GAAG,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAA0B;IAC5C,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;CAC1B,CAAC"}

package/dist/hono.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Hono middleware adapter for partial-content.
+ *
+ * Wraps an {@link ObjectStore} into a Hono-compatible middleware that handles
+ * the full HTTP file-serving protocol (200, 206, 304, 412, 416, HEAD).
+ *
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { serveObject } from "partial-content/hono";
+ * import { s3Store } from "partial-content/s3";
+ *
+ * const store = s3Store({ client, bucket: "documents" });
+ * const app = new Hono();
+ *
+ * app.get("/files/:key", serveObject(store, {
+ *   key: (c) => c.req.param("key"),
+ *   disposition: "inline",
+ * }));
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { type ServeObjectOptions } from "./web.js";
+import type { ObjectStore } from "./index.js";
+export type { ServeObjectOptions, ServeContext } from "./web.js";
+export type { ObjectStore } from "./index.js";
+/**
+ * Minimal Hono context interface.
+ *
+ * We declare just enough of the Hono Context shape to avoid a hard
+ * dependency on the `hono` package. Users who import `partial-content/hono`
+ * will have `hono` installed (it's an optional peer dep), but we don't
+ * want to force TypeScript resolution on it at build time for the
+ * published package.
+ */
+interface HonoContext {
+    req: {
+        raw: Request;
+        param: (name: string) => string;
+        header: (name: string) => string | undefined;
+        method: string;
+    };
+}
+/** Hono handler return type. */
+type HonoResponse = Response | Promise<Response>;
+export interface HonoServeOptions extends ServeObjectOptions {
+    /**
+     * Extract the storage key from the Hono context.
+     *
+     * @example
+     * ```ts
+     * key: (c) => c.req.param("key")
+     * key: (c) => c.req.param("path")
+     * ```
+     */
+    key: (c: HonoContext) => string | Promise<string>;
+    /**
+     * Extract the MIME type from the Hono context.
+     * When omitted, defaults to "application/octet-stream".
+     */
+    mime?: (c: HonoContext) => string | undefined;
+    /**
+     * Extract the filename from the Hono context (for Content-Disposition).
+     * When omitted, no filename is set.
+     */
+    filename?: (c: HonoContext) => string | undefined;
+}
+/**
+ * Create a Hono middleware handler that serves files from an {@link ObjectStore}.
+ *
+ * Uses the standard Request/Response API under the hood, so it works on
+ * all Hono runtimes (Cloudflare Workers, Bun, Deno, Node.js).
+ *
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { serveObject } from "partial-content/hono";
+ * import { s3Store } from "partial-content/s3";
+ *
+ * const app = new Hono();
+ * const store = s3Store({ client, bucket: "media" });
+ *
+ * app.get("/media/:key", serveObject(store, {
+ *   key: (c) => c.req.param("key"),
+ *   disposition: "inline",
+ *   cacheControl: "public, max-age=31536000, immutable",
+ * }));
+ * ```
+ */
+export declare function serveObject(store: ObjectStore, opts: HonoServeOptions): (c: HonoContext) => HonoResponse;
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAiC,KAAK,kBAAkB,EAAqB,MAAM,UAAU,CAAC;AACrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI9C;;;;;;;;GAQG;AACH,UAAU,WAAW;IACnB,GAAG,EAAE;QACH,GAAG,EAAE,OAAO,CAAC;QACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;QAChC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,gCAAgC;AAChC,KAAK,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAIjD,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D;;;;;;;;OAQG;IACH,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,MAAM,GAAG,SAAS,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,MAAM,GAAG,SAAS,CAAC;CACnD;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,gBAAgB,GACrB,CAAC,CAAC,EAAE,WAAW,KAAK,YAAY,CAclC"}

package/dist/hono.js

@@ -0,0 +1,61 @@
+/**
+ * Hono middleware adapter for partial-content.
+ *
+ * Wraps an {@link ObjectStore} into a Hono-compatible middleware that handles
+ * the full HTTP file-serving protocol (200, 206, 304, 412, 416, HEAD).
+ *
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { serveObject } from "partial-content/hono";
+ * import { s3Store } from "partial-content/s3";
+ *
+ * const store = s3Store({ client, bucket: "documents" });
+ * const app = new Hono();
+ *
+ * app.get("/files/:key", serveObject(store, {
+ *   key: (c) => c.req.param("key"),
+ *   disposition: "inline",
+ * }));
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { serveObject as serveObjectWeb } from "./web.js";
+// ─── Factory ────────────────────────────────────────────────────────────────
+/**
+ * Create a Hono middleware handler that serves files from an {@link ObjectStore}.
+ *
+ * Uses the standard Request/Response API under the hood, so it works on
+ * all Hono runtimes (Cloudflare Workers, Bun, Deno, Node.js).
+ *
+ * @example
+ * ```typescript
+ * import { Hono } from "hono";
+ * import { serveObject } from "partial-content/hono";
+ * import { s3Store } from "partial-content/s3";
+ *
+ * const app = new Hono();
+ * const store = s3Store({ client, bucket: "media" });
+ *
+ * app.get("/media/:key", serveObject(store, {
+ *   key: (c) => c.req.param("key"),
+ *   disposition: "inline",
+ *   cacheControl: "public, max-age=31536000, immutable",
+ * }));
+ * ```
+ */
+export function serveObject(store, opts) {
+    const { key: keyFn, mime: mimeFn, filename: filenameFn, ...serveOpts } = opts;
+    const handler = serveObjectWeb(store, serveOpts);
+    return async function honoHandler(c) {
+        const key = await keyFn(c);
+        const ctx = {
+            key,
+            mime: mimeFn?.(c),
+            filename: filenameFn?.(c),
+        };
+        return handler(c.req.raw, ctx);
+    };
+}
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,IAAI,cAAc,EAA8C,MAAM,UAAU,CAAC;AAyDrG,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CACzB,KAAkB,EAClB,IAAsB;IAEtB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,KAAK,UAAU,WAAW,CAAC,CAAc;QAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAiB;YACxB,GAAG;YACH,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjB,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;SAC1B,CAAC;QAEF,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Generic HTTP ObjectStore adapter for partial-content.
+ *
+ * Serves from ANY range-capable HTTP origin using plain `fetch`: Supabase
+ * Storage, S3/GCS/Azure presigned URLs, CDN origins, internal file services,
+ * or another partial-content server. Zero dependencies, every runtime.
+ *
+ * Capabilities mapped straight onto HTTP semantics:
+ * - `headObject` -> `HEAD` (metadata from Content-Length / ETag / Last-Modified)
+ * - `getObject`  -> `GET` with `Range: bytes=...`
+ * - Pinned reads -> `If-Match` (origin 412 becomes {@link ObjectChangedError})
+ * - RFC 9530     -> `Repr-Digest: sha-256=:...:` response header is extracted
+ *
+ * Caveats:
+ * - The origin must send `Content-Length` (range-capable origins always do).
+ * - Presigned URLs are signed per-method: a GET-presigned URL will reject the
+ *   HEAD probe. Presign both methods in `url()` (it receives the key only;
+ *   return method-agnostic URLs, or front the origin with a service that
+ *   accepts both).
+ * - Origins that ignore `If-Match` are still safe: the web adapter's
+ *   response-side guard (actual Content-Range + GET validators) remains.
+ *
+ * @example Supabase Storage (authenticated)
+ * ```typescript
+ * import { httpStore } from "partial-content/http";
+ * import { serveObject } from "partial-content/web";
+ *
+ * const store = httpStore({
+ *   url: (key) => `${SUPABASE_URL}/storage/v1/object/documents/${key}`,
+ *   headers: { Authorization: `Bearer ${serviceRoleKey}` },
+ * });
+ *
+ * export const GET = serveObject(store, { disposition: "inline" });
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError, type ObjectStore } from "./index.js";
+export { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError };
+export interface HttpStoreOptions {
+    /** Build the absolute URL for a storage key. */
+    url: (key: string) => string | URL;
+    /**
+     * Request headers (e.g. Authorization). A static record, or a function of
+     * the key for per-object credentials.
+     */
+    headers?: Record<string, string> | ((key: string) => Record<string, string>);
+    /**
+     * Fetch implementation. Defaults to the global `fetch`.
+     * Inject for testing or to add retries/instrumentation. This is also the
+     * SSRF hook: when `url()` incorporates untrusted input, supply a fetch
+     * that validates resolved addresses (see SECURITY.md).
+     */
+    fetch?: typeof globalThis.fetch;
+    /**
+     * Redirect policy for origin requests. Defaults to `"error"`: a serving layer
+     * whose `url()` may incorporate untrusted keys must not let a compromised or
+     * misconfigured origin bounce the store to internal endpoints (cloud metadata
+     * IPs) via a 3xx. Object-storage origins answer GET/HEAD with a direct 200, so
+     * the safe default costs nothing there. Set `"follow"` explicitly for origins
+     * that legitimately redirect (some presigned-URL or CDN front-door flows);
+     * pair it with a validating `fetch` (see SECURITY.md) when keys are untrusted.
+     */
+    redirect?: "follow" | "error" | "manual";
+}
+/**
+ * Create an {@link ObjectStore} backed by any range-capable HTTP origin.
+ */
+export declare function httpStore(opts: HttpStoreOptions): ObjectStore;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EAIrB,KAAK,WAAW,EAIjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;CAC1C;AAID;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CA8K7D"}

package/dist/http.js

@@ -0,0 +1,281 @@
+/**
+ * Generic HTTP ObjectStore adapter for partial-content.
+ *
+ * Serves from ANY range-capable HTTP origin using plain `fetch`: Supabase
+ * Storage, S3/GCS/Azure presigned URLs, CDN origins, internal file services,
+ * or another partial-content server. Zero dependencies, every runtime.
+ *
+ * Capabilities mapped straight onto HTTP semantics:
+ * - `headObject` -> `HEAD` (metadata from Content-Length / ETag / Last-Modified)
+ * - `getObject`  -> `GET` with `Range: bytes=...`
+ * - Pinned reads -> `If-Match` (origin 412 becomes {@link ObjectChangedError})
+ * - RFC 9530     -> `Repr-Digest: sha-256=:...:` response header is extracted
+ *
+ * Caveats:
+ * - The origin must send `Content-Length` (range-capable origins always do).
+ * - Presigned URLs are signed per-method: a GET-presigned URL will reject the
+ *   HEAD probe. Presign both methods in `url()` (it receives the key only;
+ *   return method-agnostic URLs, or front the origin with a service that
+ *   accepts both).
+ * - Origins that ignore `If-Match` are still safe: the web adapter's
+ *   response-side guard (actual Content-Range + GET validators) remains.
+ *
+ * @example Supabase Storage (authenticated)
+ * ```typescript
+ * import { httpStore } from "partial-content/http";
+ * import { serveObject } from "partial-content/web";
+ *
+ * const store = httpStore({
+ *   url: (key) => `${SUPABASE_URL}/storage/v1/object/documents/${key}`,
+ *   headers: { Authorization: `Bearer ${serviceRoleKey}` },
+ * });
+ *
+ * export const GET = serveObject(store, { disposition: "inline" });
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError, resolveServedRange, parseRetryAfterSeconds, isOpenEndedRange, } from "./index.js";
+// Re-export for convenience
+export { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError };
+// ─── Factory ────────────────────────────────────────────────────────────────
+/**
+ * Create an {@link ObjectStore} backed by any range-capable HTTP origin.
+ */
+export function httpStore(opts) {
+    const doFetch = opts.fetch ?? globalThis.fetch;
+    const redirect = opts.redirect ?? "error";
+    function requestHeaders(key) {
+        const base = typeof opts.headers === "function"
+            ? opts.headers(key)
+            : opts.headers ?? {};
+        return {
+            ...base,
+            // Byte accounting depends on the origin NOT transparently compressing:
+            // a gzip'd body would break Content-Length/Content-Range math. Server
+            // runtimes (undici, Bun, Deno, Workers) honor this; identity is also
+            // what object-storage origins serve anyway.
+            "Accept-Encoding": "identity",
+        };
+    }
+    return {
+        supportsRange: true,
+        // 206 bounds/total are parsed from the origin's actual Content-Range
+        // (an origin ignoring Range degrades to 200): the orchestrator may skip
+        // the validating HEAD for plain range requests.
+        authoritativeRange: true,
+        async headObject(key, headOpts) {
+            const response = await doFetch(opts.url(key), {
+                method: "HEAD",
+                headers: requestHeaders(key),
+                signal: headOpts?.signal,
+                redirect,
+            });
+            // HEAD bodies are empty; no need to drain before throwing.
+            if (response.status === 404)
+                throw new ObjectNotFoundError(key);
+            if (isUnavailableStatus(response.status)) {
+                throw new StoreUnavailableError(key, { retryAfterSeconds: parseRetryAfter(response) });
+            }
+            if (!response.ok) {
+                throw new Error(`httpStore HEAD ${key} failed: ${response.status}`);
+            }
+            const headEncoding = nonIdentityEncoding(response);
+            if (headEncoding) {
+                throw new Error(`httpStore HEAD ${key}: origin returned Content-Encoding: ${headEncoding}; ` +
+                    `Content-Length would report the compressed size, so range serving requires an identity-coded body`);
+            }
+            const contentLength = parseSize(response.headers.get("content-length"));
+            if (contentLength === undefined) {
+                throw new Error(`httpStore HEAD ${key}: origin sent no Content-Length; range serving requires sized responses`);
+            }
+            return {
+                contentLength,
+                etag: response.headers.get("etag") ?? undefined,
+                lastModified: response.headers.get("last-modified") ?? undefined,
+                digest: extractSha256Digest(response.headers.get("repr-digest")),
+            };
+        },
+        async getObject(key, getOpts) {
+            const { range, signal, ifMatch } = getOpts ?? {};
+            const headers = requestHeaders(key);
+            // Open-ended fast-path ranges carry the OPEN_ENDED sentinel end; emit
+            // the bare `bytes=a-` form rather than a 16-digit last-byte-pos.
+            if (range) {
+                headers["Range"] = isOpenEndedRange(range)
+                    ? `bytes=${range.start}-`
+                    : `bytes=${range.start}-${range.end}`;
+            }
+            // Pin the read to the validated representation. Origins that honor
+            // If-Match (S3, Azure, nginx, another partial-content server) answer
+            // 412 when the object changed; origins that ignore it fall through to
+            // the caller's response-side guard. Weak validators are never sent:
+            // RFC 9110 mandates strong comparison for If-Match, so a `W/` ETag
+            // would be rejected by every compliant origin on every attempt.
+            if (ifMatch && !ifMatch.startsWith("W/")) {
+                headers["If-Match"] = ifMatch;
+            }
+            const response = await doFetch(opts.url(key), {
+                method: "GET",
+                headers,
+                signal,
+                redirect,
+            });
+            if (response.status === 404) {
+                await drain(response);
+                throw new ObjectNotFoundError(key);
+            }
+            if (response.status === 412) {
+                await drain(response);
+                throw new ObjectChangedError(key);
+            }
+            if (isUnavailableStatus(response.status)) {
+                const retryAfterSeconds = parseRetryAfter(response);
+                await drain(response);
+                throw new StoreUnavailableError(key, { retryAfterSeconds });
+            }
+            if (response.status !== 200 && response.status !== 206) {
+                await drain(response);
+                throw new Error(`httpStore GET ${key} failed: ${response.status}`);
+            }
+            // The fetch runtime transparently decodes a compressed body while
+            // Content-Length / Content-Range still describe the encoded bytes, so
+            // every byte count below would be wrong. Refuse rather than stream a
+            // body that disagrees with its own headers.
+            const getEncoding = nonIdentityEncoding(response);
+            if (getEncoding) {
+                await drain(response);
+                throw new Error(`httpStore GET ${key}: origin returned Content-Encoding: ${getEncoding}; ` +
+                    `range and length accounting require an identity-coded body`);
+            }
+            const headerLength = parseSize(response.headers.get("content-length"));
+            let served;
+            let contentLength;
+            let totalSize;
+            if (response.status === 206) {
+                // A 206 MUST carry a parseable single-range Content-Range; without
+                // one the body's bounds are unknowable and serving it as anything
+                // would silently truncate or corrupt the client's view.
+                const contentRangeHeader = response.headers.get("content-range");
+                const resolved = contentRangeHeader ? resolveServedRange(contentRangeHeader) : null;
+                if (!resolved) {
+                    await drain(response);
+                    throw new Error(`httpStore GET ${key}: origin sent 206 with ${contentRangeHeader ? `unparseable Content-Range "${contentRangeHeader}"` : "no Content-Range"}`);
+                }
+                served = resolved.served;
+                // Content-Length, or derived from the actual Content-Range when the
+                // origin streams chunked 206s.
+                contentLength = headerLength ?? (resolved.served.end - resolved.served.start + 1);
+                // A proxied origin streaming a generated/transcoded body legitimately
+                // does not know its full length and sends `bytes a-b/*` (the resolver's
+                // `undefined` total). Propagate that so the served response repeats `*`
+                // honestly instead of fabricating a total that would draw a spurious
+                // 416 on a later range past the invented end.
+                totalSize = resolved.totalSize;
+            }
+            else {
+                if (headerLength === undefined) {
+                    await drain(response);
+                    throw new Error(`httpStore GET ${key}: origin sent no Content-Length; range serving requires sized responses`);
+                }
+                contentLength = headerLength;
+                totalSize = contentLength;
+            }
+            return {
+                body: response.body ?? emptyStream(),
+                contentLength,
+                totalSize,
+                range: served,
+                etag: response.headers.get("etag") ?? undefined,
+                lastModified: response.headers.get("last-modified") ?? undefined,
+                digest: extractSha256Digest(response.headers.get("repr-digest")),
+            };
+        },
+    };
+}
+// ─── Internal Helpers ───────────────────────────────────────────────────────
+/**
+ * Return the response's `Content-Encoding` when the origin transfer-compressed
+ * the body despite our `Accept-Encoding: identity` request, or `null` when the
+ * body is identity-coded. A compressed body is transparently decoded by the
+ * fetch runtime, but `Content-Length` keeps reporting the compressed size,
+ * which breaks all downstream byte accounting.
+ */
+function nonIdentityEncoding(response) {
+    const enc = response.headers.get("content-encoding");
+    return enc && enc.trim().toLowerCase() !== "identity" ? enc : null;
+}
+/** Parse a Content-Length header into a non-negative integer, or undefined. */
+function parseSize(value) {
+    if (!value || !/^\d+$/.test(value.trim()))
+        return undefined;
+    const n = Number(value.trim());
+    return Number.isSafeInteger(n) ? n : undefined;
+}
+/**
+ * Whether an origin status means "transiently unavailable, retry" (mapped to
+ * a 503, not a 502): `503 Service Unavailable` and `429 Too Many Requests`.
+ */
+function isUnavailableStatus(status) {
+    return status === 503 || status === 429;
+}
+/**
+ * Parse this origin response's `Retry-After` (RFC 9110 Section 10.2.3) into
+ * whole seconds via the shared parser: delay-seconds directly, or an HTTP-date
+ * as the non-negative delta from now. Returns undefined when absent/unparseable.
+ */
+function parseRetryAfter(response) {
+    return parseRetryAfterSeconds(response.headers.get("retry-after"), { allowHttpDate: true });
+}
+/**
+ * Extract the raw base64 SHA-256 from an RFC 9530 Repr-Digest header
+ * (`sha-256=:BASE64:`), or undefined when absent / different algorithm.
+ */
+function extractSha256Digest(header) {
+    if (!header)
+        return undefined;
+    const match = /sha-256=:([A-Za-z0-9+/]+=*):/i.exec(header);
+    return match ? match[1] : undefined;
+}
+/**
+ * Consume up to `maxBytes` of an error/refusal body so the connection can be
+ * reused, then cancel. A bare `response.arrayBuffer()` would buffer the ENTIRE
+ * body -- and these paths include the malformed-206 and encoding-refusal
+ * branches whose body is the real (potentially whole-object) payload, plus the
+ * fetch runtime transparently INFLATES a compressed body during buffering. A
+ * hostile or misconfigured origin could then drive per-request OOM (a
+ * decompression bomb) just to make the adapter throw. Reading a small bounded
+ * prefix keeps connection reuse for genuine 404/412 error bodies while capping
+ * the cost; anything larger sacrifices one pooled connection, which is cheap.
+ */
+async function drain(response, maxBytes = 64 * 1024) {
+    const body = response.body;
+    if (!body)
+        return;
+    try {
+        const reader = body.getReader();
+        let seen = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return;
+            seen += value.byteLength;
+            if (seen > maxBytes) {
+                await reader.cancel();
+                return;
+            }
+        }
+    }
+    catch {
+        // Body already consumed or connection gone; nothing to release.
+    }
+}
+/** A closed empty stream for bodyless 200s (zero-byte objects). */
+function emptyStream() {
+    return new ReadableStream({
+        start(controller) {
+            controller.close();
+        },
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GAKjB,MAAM,YAAY,CAAC;AAEpB,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,CAAC;AA+B1E,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,SAAS,cAAc,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;YAC7C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YACnB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,IAAI;YACP,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,4CAA4C;YAC5C,iBAAiB,EAAE,UAAU;SAC9B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,qEAAqE;QACrE,wEAAwE;QACxE,gDAAgD;QAChD,kBAAkB,EAAE,IAAI;QAExB,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,QAAmC;YAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC5B,MAAM,EAAE,QAAQ,EAAE,MAAM;gBACxB,QAAQ;aACT,CAAC,CAAC;YACH,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,qBAAqB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACtE,CAAC;YAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,uCAAuC,YAAY,IAAI;oBAC5E,mGAAmG,CACpG,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACxE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,yEAAyE,CAC/F,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,aAAa;gBACb,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;gBAC/C,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;gBAChE,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,OAAyE;YAEzE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC;oBACxC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,GAAG;oBACzB,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAC1C,CAAC;YACD,mEAAmE;YACnE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;YAChC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,OAAO;gBACP,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,MAAM,iBAAiB,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,qBAAqB,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,uCAAuC,WAAW,IAAI;oBAC1E,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACvE,IAAI,MAAkD,CAAC;YACvD,IAAI,aAAqB,CAAC;YAC1B,IAAI,SAA6B,CAAC;YAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,kEAAkE;gBAClE,wDAAwD;gBACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACtB,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,0BAA0B,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,kBAAkB,GAAG,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAC9I,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,oEAAoE;gBACpE,+BAA+B;gBAC/B,aAAa,GAAG,YAAY,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClF,sEAAsE;gBACtE,wEAAwE;gBACxE,wEAAwE;gBACxE,qEAAqE;gBACrE,8CAA8C;gBAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACtB,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,yEAAyE,CAC9F,CAAC;gBACJ,CAAC;gBACD,aAAa,GAAG,YAAY,CAAC;gBAC7B,SAAS,GAAG,aAAa,CAAC;YAC5B,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,WAAW,EAAE;gBACpC,aAAa;gBACb,SAAS;gBACT,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;gBAC/C,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;gBAChE,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;aACjE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACrD,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,KAAoB;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAqB;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,KAAK,CAAC,QAAkB,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW;IAClB,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * partial-content
+ *
+ * RFC-compliant HTTP Range Requests, Conditional Requests, and
+ * Content-Disposition. Pure functions, zero dependencies, any runtime.
+ *
+ * @packageDocumentation
+ */
+export { parseRangeHeader, parseContentRange, buildRangeResponseHeaders, build416Headers, OPEN_ENDED, isOpenEndedRange, } from "./kernel.js";
+export { parseRanges, MAX_RANGES_DEFAULT, generateMultipartBoundary, buildMultipartPartHeader, multipartEpilogue, buildMultipartHeaders, } from "./kernel.js";
+export { sanitizeHeaderValue } from "./kernel.js";
+export { isConditionalFresh, isPreconditionFailure, isRangeFresh, build304Headers, build412Headers, evaluateConditionalRequest, evaluateConditionalWrite, } from "./kernel.js";
+export { clientWantsDigest } from "./kernel.js";
+export { generateETag } from "./kernel.js";
+export { fromNodeHeaders } from "./kernel.js";
+export type { ParsedRange, ParsedContentRange, RangeResponseHeaderOpts, RangeResponseHeaders, EvaluatedRequest, EvaluatedWrite, ETagSource, RangeSet, MultipartResponse, } from "./kernel.js";
+export type { CancelSignal, ObjectStore, ObjectMetadata, ObjectStream, ServedRange, ResolvedContentRange, HeadObjectOptions, GetObjectOptions, StoreErrorClassifiers, } from "./object-store.js";
+export { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError, nodeStreamToWeb, guardStreamLength, resolveServedRange, classifyStoreRead, parseRetryAfterSeconds } from "./object-store.js";
+export { buildContentDisposition } from "./content-disposition.js";
+export type { ContentDispositionOptions } from "./content-disposition.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,eAAe,EACf,UAAU,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,QAAQ,EACR,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGtM,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * partial-content
+ *
+ * RFC-compliant HTTP Range Requests, Conditional Requests, and
+ * Content-Disposition. Pure functions, zero dependencies, any runtime.
+ *
+ * @packageDocumentation
+ */
+// ─── Range Requests (RFC 7233) ──────────────────────────────────────────────
+export { parseRangeHeader, parseContentRange, buildRangeResponseHeaders, build416Headers, OPEN_ENDED, isOpenEndedRange, } from "./kernel.js";
+// ─── Multiple Ranges (multipart/byteranges) ─────────────────────────────────
+export { parseRanges, MAX_RANGES_DEFAULT, generateMultipartBoundary, buildMultipartPartHeader, multipartEpilogue, buildMultipartHeaders, } from "./kernel.js";
+// ─── Header Safety ──────────────────────────────────────────────────────────
+export { sanitizeHeaderValue } from "./kernel.js";
+// ─── Conditional Requests (RFC 9110 / RFC 7232) ─────────────────────────────
+export { isConditionalFresh, isPreconditionFailure, isRangeFresh, build304Headers, build412Headers, evaluateConditionalRequest, evaluateConditionalWrite, } from "./kernel.js";
+// ─── Digest Negotiation (RFC 9530) ──────────────────────────────────────────
+export { clientWantsDigest } from "./kernel.js";
+// ─── ETag Generation ────────────────────────────────────────────────────────
+export { generateETag } from "./kernel.js";
+// ─── Adapters ───────────────────────────────────────────────────────────────
+export { fromNodeHeaders } from "./kernel.js";
+// ─── Storage Primitives ─────────────────────────────────────────────────────
+export { ObjectNotFoundError, ObjectChangedError, StoreUnavailableError, nodeStreamToWeb, guardStreamLength, resolveServedRange, classifyStoreRead, parseRetryAfterSeconds } from "./object-store.js";
+// ─── Content-Disposition (RFC 6266 / RFC 8187) ──────────────────────────────
+export { buildContentDisposition } from "./content-disposition.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,eAAe,EACf,UAAU,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,+EAA+E;AAC/E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA4B9C,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEtM,+EAA+E;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC"}