pmtiles-swarm 0.90.0 → 0.91.0

package/CHANGELOG.md

@@ -7,6 +7,62 @@
 ### 🐞 Bug fixes
 - _...Add new stuff here..._
 
+## 0.91.0
+### ✨ Features and improvements
+- **A source at a URL can be added by hand, not only imported.** **Add source → an address you
+  type…** in the stack editor, writing the same source the importer does. The card asks for the
+  address and for the zoom range the archive holds — a catalog archive states its range in its own
+  header and this has no header anybody has read, so leaving it empty means every tile asks it.
+  Anything published as a plain HTTPS download works, an S3 object or presigned URL included, and so
+  does `s3://bucket/key.pmtiles` for a private bucket — see below.
+
+- **A stack's source list folds up past five sources.** An imported list is several hundred rows,
+  which buried every other stack on the page under one of them. The fold says how many there are and
+  names the base; a stack of a base and a layer or two stays open, since folding that hides nothing
+  worth a click.
+
+
+- **A stack source may be an object in a private S3 bucket.**
+  `s3://bucket/terrain.pmtiles`, read with a signed request per byte range. Only for a bucket that is
+  not public — a public object or a presigned URL is an ordinary HTTPS address and always worked.
+  `endpoint` is what makes it S3-compatible rather than S3: MinIO, Ceph, Garage, R2, Wasabi and B2
+  all answer the same protocol at their own address, and path-style addressing is the default because
+  it is what they speak. Credentials go under **Settings → Feeds → S3 buckets**, per bucket or once
+  for an account; with none configured the standard `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`,
+  `AWS_REGION` and `AWS_S3_ENDPOINT` variables are read, so a machine already set up to reach a
+  bucket needs nothing typed in.
+
+  Signed here rather than by an SDK: SigV4 for a GET is a hash, four HMACs and a string, all of which
+  `node:crypto` has. An AWS client would be a large dependency for one signature, and an optional one
+  would make reading a bucket work on some installs and not on others for no reason the operator
+  could see — so it is neither optional nor a dependency. The signer is checked against AWS's own
+  published test vectors rather than against itself.
+
+
+### 🐞 Bug fixes
+- **A stack of remote sources could be served but not exported.** The bake refused any stack whose
+  sources resolved to no archive on this node, which is every stack read from URLs — refusing exactly
+  the export worth having, since baking is how terrain that lives somewhere else becomes something
+  this node holds and can seed. It also had no way to walk a remote archive's directories, which is
+  how a bake finds which tiles exist at all.
+
+- **An archive whose deepest tiles repeat said it stopped a zoom short.** Identical tiles collapse
+  into one directory entry covering a range of ids, so the last entry's own id can sit at a shallower
+  zoom than the tiles it addresses — and the header was read off that id. A client asks for nothing
+  past a header's `maxZoom`, so the deepest zoom of such an archive was unreachable. Found baking a
+  stack over flat terrain, where every tile of the last zoom was the same tile.
+
+- **A stack used as a source of another stack was reported as unresolved.** It resolves to a recipe
+  rather than to bytes, and the console's reader looked only for a catalog entry or an address — so a
+  working nested stack showed "does not resolve", with no zoom range and no box, and put a "sources
+  missing" badge on the stack above it. It now says what it stands for and how deep it reaches,
+  worked out from the sources that stack would serve.
+
+- **A stack's advertised box ignored any source that stated none.** The union was taken over
+  whichever sources had a box, so a stack of a global base plus regional patches — an imported list,
+  exactly — advertised the patches as its extent and left the base out of it. A source with no box
+  is not one covering nothing, so it is now every box or none, and none means the world.
+
 ## 0.90.0
 ### ✨ Features and improvements
 - **A stack source may name a URL instead of a category, archive or stack.** `{ "url": "https://…" }`,

package/docs/configuration.md

@@ -20,6 +20,7 @@ Some settings only take effect on restart. Those are marked **restart**.
 - [Scheduled sources](#scheduled-sources)
 - [Subscriptions](#subscriptions)
 - [Serving tiles](#serving-tiles)
+- [S3 buckets](#s3-buckets)
 - [Mutable publishing](#mutable-publishing)
 - [Authentication](#authentication)
 - [Statistics](#statistics)
@@ -776,6 +777,96 @@ connection, a piece already in flight. Ten attempts later it is one piece at the
 far end of an archive nobody has finished, and asking every fifteen seconds
 achieves nothing but log lines.
 
+## S3 buckets
+
+A stack source may be an address rather than an archive this node holds, and
+that address may name an object in a bucket:
+
+```json
+{
+  "sources": [{ "url": "s3://terrain/planet.pmtiles", "encoding": "terrarium" }]
+}
+```
+
+Only for a bucket that is **not public**. A public object, or a presigned URL,
+is an ordinary HTTPS address: write it as one and none of this applies.
+
+```json
+{
+  "s3": [
+    {
+      "bucket": "terrain",
+      "endpoint": "https://minio.lan:9000",
+      "region": "us-east-1",
+      "accessKeyId": "…",
+      "secretAccessKey": "…"
+    }
+  ]
+}
+```
+
+| field             | default            |                                                      |
+| ----------------- | ------------------ | ---------------------------------------------------- |
+| `bucket`          | any                | which bucket this row is for; unset matches all      |
+| `endpoint`        | AWS for the region | what makes it S3-compatible rather than S3           |
+| `region`          | `us-east-1`        | signed into every request, whether or not it is used |
+| `accessKeyId`     | —                  |                                                      |
+| `secretAccessKey` | —                  |                                                      |
+| `sessionToken`    | unset              | for temporary credentials                            |
+| `pathStyle`       | path, unless AWS   | `false` puts the bucket in the hostname              |
+
+A source is read through the row naming its bucket, or through whichever row
+names none: one set of credentials for a whole account is the ordinary case,
+and writing the same keys once per bucket is busywork with a copy-paste
+mistake in it.
+
+### The endpoint is the whole point
+
+MinIO, Ceph, Garage, Cloudflare R2, Wasabi and Backblaze B2 all answer the
+same protocol at their own address, so naming that address is the difference
+between "S3" and "S3-compatible". Path-style addressing is what they speak and
+is the default here; AWS withdrew it for buckets made after September 2020, so
+an `amazonaws.com` endpoint puts the bucket in the hostname instead. Set
+`pathStyle` only for a server that insists on the other one.
+
+### Credentials from the environment
+
+With no rows configured at all, the standard variables are read — the same
+ones the AWS CLI, rclone, go-pmtiles and tileserver-gl use, so a machine
+already set up to reach a bucket needs nothing written here:
+
+| variable                                     |                                 |
+| -------------------------------------------- | ------------------------------- |
+| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | required for any of it to apply |
+| `AWS_SESSION_TOKEN`                          | temporary credentials           |
+| `AWS_REGION`, `AWS_DEFAULT_REGION`           | region                          |
+| `AWS_S3_ENDPOINT`, `AWS_ENDPOINT_URL_S3`     | endpoint                        |
+| `AWS_S3_FORCE_PATH_STYLE`                    | addressing                      |
+
+### Signed here, not by an SDK
+
+SigV4 for a GET is a hash, four HMACs and a string, all of which `node:crypto`
+already has. An AWS client would be a large dependency for one signature, and
+an optional one would make reading a bucket work on some installs and not on
+others for no reason the operator could see — so it is neither optional nor a
+dependency. The signer is checked against AWS's own published test vectors
+rather than against itself.
+
+Every request is signed as it goes out, including the range: the header, each
+directory and each tile. Nothing is presigned and nothing is cached but the
+bytes, so revoking a key stops reads at the next request rather than at the
+next restart. Changing the settings drops the open readers for the same
+reason.
+
+### What a bucket source is, and is not
+
+It is a URL source in every other respect — see
+[tile-stacks.md](tile-stacks.md), "A source read straight from a URL". It
+carries its own `minzoom`, `maxzoom` and `bounds`, it is never seeded or
+retired, and it can be baked: a stack over private buckets exports to an
+ordinary archive with an infohash, which is the path from "terrain we hold in
+a bucket" to "terrain we publish".
+
 ## Mutable publishing
 
 Announcing the current build of each category over the DHT (BEP 46).

package/docs/tile-stacks.md

@@ -1681,6 +1681,22 @@ archive — Mapterhorn's own base stops at z12 — is upscaled for a deeper
 request exactly as GEBCO is, through the same code, because reading one is now
 a question of which store method answers and nothing else.
 
+### Adding one by hand
+
+**Add source → an address you type…** in the stack editor, which is the same
+source the importer writes and edits the same way. The card asks for two
+things nothing else can know: the address, and the zoom range the archive
+holds. A catalog archive states its range in its own header and a URL source
+has no header this node has read, so an unstated range means every tile asks
+it — correct, and the thing worth avoiding once there are several.
+
+Anything published as a plain HTTPS download works, which includes an S3
+bucket that serves range requests: an object URL, or a presigned one, is an
+address like any other, and this asks for byte ranges the way any PMTiles
+reader does. What it cannot do is a private bucket named `s3://…`, which is
+not a URL a browser or a fetch can follow — that needs a signed request and
+somewhere to keep the credentials, and neither exists here yet.
+
 ### Cheap to have hundreds of
 
 The one thing that makes hundreds of these practical rather than merely
@@ -1830,6 +1846,14 @@ that is a map changing at 4am with nothing to say why. A hand-written source
 carries no `importedFrom`, is never replaced, and is the place for anything the
 index could not have told us.
 
+### Seeing them in the console
+
+A stack's source list collapses behind a summary once there are more than
+five, with the count and the base named on the fold. A stack imported from a
+provider's list is several hundred rows and drawing them flat buries every
+other stack on the page under one of them; a stack of a base and a layer or
+two stays open, since folding that hides nothing worth a click.
+
 ## Finding a stack
 
 A stack has no infohash and appears in no feed, so nothing about it is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmtiles-swarm",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "description": "BitTorrent distribution for PMTiles map archives: create torrents, watch folders, publish and subscribe to RSS feeds, and seed through qBittorrent or an embedded client",
   "type": "module",
   "main": "src/index.js",

package/src/api.js

@@ -3400,45 +3400,64 @@ export function createApp({
           // The order the recipe lists them: lowest priority first, last
           // wins. The console shows this order as it stands rather than
           // inverting it, so the screen and the file never disagree.
-          sources: resolved.sources.map((source) => ({
-            index: source.index,
-            name: source.name,
-            pinned: source.pinned,
-            required: source.required,
-            // What kind of source this is, said outright rather than left to
-            // be inferred from which fields happen to be null. A URL source
-            // has no infohash and no catalog entry, so a reader guessing from
-            // those calls it an unresolved category -- which is two wrong
-            // things about a source that is working perfectly well.
-            kind: source.remote
-              ? 'url'
-              : source.nested
-                ? 'stack'
-                : source.pinned
-                  ? 'archive'
-                  : 'category',
-            // A URL source resolves by definition: there is nothing to look
-            // up, the address is the answer. Whether it can actually be read
-            // is a question for the first tile, the same as for an archive
-            // this node holds but cannot open.
-            resolved: Boolean(source.entry) || Boolean(source.remote),
-            url: source.remote ?? null,
-            infohash: source.entry?.infoHash ?? null,
-            archiveName: source.entry?.name ?? null,
-            // The recipe's own, where it states them. For a URL source that is
-            // the only place they are known without opening the file, and it
-            // is what the merge itself uses to decide whether to.
-            minzoom:
-              source.entry?.pmtiles?.minZoom ?? source.source?.minzoom ?? null,
-            maxzoom:
-              source.entry?.pmtiles?.maxZoom ?? source.source?.maxzoom ?? null,
-            bounds:
-              source.entry?.pmtiles?.bounds ??
-              (Array.isArray(source.source?.bounds)
-                ? source.source.bounds
-                : null),
-            format: source.entry?.pmtiles?.format ?? null,
-          })),
+          sources: resolved.sources.map((source) => {
+            // A nested stack answers for the ground its own sources cover,
+            // and knows it without opening anything -- so the row can say
+            // what it reaches rather than a dash.
+            const inner = source.nested ? stackCoverage(source.nested) : null;
+            return {
+              index: source.index,
+              name: source.name,
+              pinned: source.pinned,
+              required: source.required,
+              // What kind of source this is, said outright rather than left to
+              // be inferred from which fields happen to be null. A URL source
+              // has no infohash and no catalog entry, so a reader guessing from
+              // those calls it an unresolved category -- which is two wrong
+              // things about a source that is working perfectly well.
+              kind: source.remote
+                ? 'url'
+                : source.nested
+                  ? 'stack'
+                  : source.pinned
+                    ? 'archive'
+                    : 'category',
+              // A URL source resolves by definition: there is nothing to look
+              // up, the address is the answer. Whether it can actually be read
+              // is a question for the first tile, the same as for an archive
+              // this node holds but cannot open.
+              resolved:
+                Boolean(source.entry) ||
+                Boolean(source.remote) ||
+                Boolean(source.nested),
+              // How many sources the nested recipe has, which is the only
+              // useful thing to say in a column that names an archive file for
+              // every other kind: a stack resolves to a recipe, not to bytes.
+              nested: source.nested ? source.nested.sources.length : null,
+              url: source.remote ?? null,
+              infohash: source.entry?.infoHash ?? null,
+              archiveName: source.entry?.name ?? null,
+              // The recipe's own, where it states them. For a URL source that is
+              // the only place they are known without opening the file, and it
+              // is what the merge itself uses to decide whether to.
+              minzoom:
+                source.entry?.pmtiles?.minZoom ??
+                source.source?.minzoom ??
+                inner?.minzoom ??
+                null,
+              maxzoom:
+                source.entry?.pmtiles?.maxZoom ??
+                source.source?.maxzoom ??
+                inner?.maxzoom ??
+                null,
+              bounds:
+                source.entry?.pmtiles?.bounds ??
+                (Array.isArray(source.source?.bounds)
+                  ? source.source.bounds
+                  : (inner?.bounds ?? null)),
+              format: source.entry?.pmtiles?.format ?? null,
+            };
+          }),
         };
       });
       // Reported so the console can say "install sharp" beside the stacks

package/src/bake-jobs.js

@@ -411,12 +411,18 @@ export class BakeManager {
     // presses the button rather than an hour in.
     assertBakeable(resolved, codec);
 
+    // A source this node can read: an archive it holds, a recipe it can
+    // evaluate, or an address it can fetch. The last was missing, which
+    // refused exactly the bake worth having -- a stack of remote sources
+    // exported to an archive is how terrain that lives somewhere else, in a
+    // provider's file list or a private bucket, becomes something this node
+    // holds and can seed.
     const unresolved = resolved.sources.filter(
-      (source) => !source.entry && !source.nested,
+      (source) => !source.entry && !source.nested && !source.remote,
     );
     if (unresolved.length === resolved.sources.length) {
       const error = new Error(
-        "none of this stack's sources resolved to an archive on this node",
+        "none of this stack's sources resolved to anything this node can read",
       );
       error.status = 409;
       throw error;
@@ -594,15 +600,22 @@ export class BakeManager {
     // source is scanned the same way it is served: its directories come out of
     // the swarm, and the store holds them to its own byte budget.
     const sources = resolved.sources
-      .filter((source) => source.entry)
+      .filter((source) => source.entry || source.remote)
       .map((source) => ({
         getBytes: async (offset, length) => {
-          const bytes = await this.#tiles.readRange(
-            source.entry.infoHash,
-            offset,
-            length,
-            { signal: job.controller.signal },
-          );
+          // The one difference between a source this node holds and one it
+          // reads over the network, here as everywhere else: which method of
+          // the store answers. What is done with the bytes is identical.
+          const bytes = source.remote
+            ? await this.#tiles.readRemoteRange(source.remote, offset, length, {
+                signal: job.controller.signal,
+              })
+            : await this.#tiles.readRange(
+                source.entry.infoHash,
+                offset,
+                length,
+                { signal: job.controller.signal },
+              );
           // Sliced by offset and length rather than handed `.buffer` outright.
           // A Buffer is a view, and where it is a view *into* something larger
           // -- which is what Buffer.allocUnsafe hands back -- `.buffer` is the

package/src/config.js

@@ -459,6 +459,25 @@ const DEFAULTS = {
    * See docs/tile-stacks.md -- "Syncing a stack to another node".
    */
   stackFeeds: [],
+  /**
+   * S3-compatible buckets a stack source may be read from.
+   *
+   * `[{ bucket, endpoint, region, accessKeyId, secretAccessKey, sessionToken,
+   * pathStyle }]`. A source whose URL is `s3://bucket/key.pmtiles` is read
+   * through the row naming that bucket, or through whichever row names none.
+   * A row is needed only for a bucket that is not public: a presigned or
+   * public HTTPS address is read as any other URL and knows nothing of this.
+   *
+   * `endpoint` is what makes it S3-compatible rather than S3: MinIO, Ceph,
+   * Garage, R2, Wasabi and B2 all answer the same protocol at their own
+   * address. Left unset it is AWS's own for the region.
+   *
+   * With nothing here at all the standard `AWS_ACCESS_KEY_ID`,
+   * `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` and `AWS_S3_ENDPOINT` variables are
+   * read, so a machine already set up to reach a bucket needs no settings.
+   * See docs/configuration.md -- "S3 buckets".
+   */
+  s3: [],
   /**
    * How often to re-check whether the sources archives were built from have
    * changed, in seconds. Zero disables it.
@@ -861,6 +880,10 @@ export const RELOADABLE = new Map([
   ['sourceCheckIntervalHours', 'sources'],
   ['subscriptions', 'subscriptions'],
   ['stackFeeds', 'stackFeeds'],
+  // Read when a bucket-backed source is first opened, and the open handles are
+  // keyed by address rather than by credentials -- so a corrected key applies
+  // to the next archive opened rather than needing a restart.
+  ['s3', 's3'],
   ['subscriptionIntervalSeconds', 'subscriptions'],
   ['subscriptionsEnabled', 'subscriptions'],
   ['seeding', 'seeding'],

package/src/index.js

@@ -586,6 +586,10 @@ PMTILES_SWARM_PUBLIC_URL
       stackFeeds.stop();
       stackFeeds.start();
     },
+    // Nothing to restart: the next archive opened from a bucket reads the new
+    // settings. What has to go is the readers already open, which are holding
+    // the keys they were opened with.
+    s3: () => tiles.forgetRemote(),
     seeding: () => {
       seeding.stop();
       seeding.start();

package/src/pmtiles-write.js

@@ -459,9 +459,14 @@ export class PMTilesWriter {
       // client asks for, and a header disagreeing with the directory sends it
       // looking for tiles that are not there.
       minZoom: header.minZoom ?? zoomOf(this.#entries[0].tileId),
-      maxZoom:
-        header.maxZoom ??
-        zoomOf(this.#entries[this.#entries.length - 1].tileId),
+      // The last id written, not the last entry's own. Identical tiles
+      // collapse into one entry covering a range, so an archive whose deepest
+      // tiles repeat -- open ocean, a masked-out region, anything flat --
+      // ends with an entry whose id sits at a shallower zoom than the tiles
+      // it addresses. Read as the entry's id, the header said the archive
+      // stopped short of the zoom it reaches, and a client asks for nothing
+      // past a header's maxZoom.
+      maxZoom: header.maxZoom ?? zoomOf(this.#lastId),
     };
 
     const out = await fs.open(destination, 'w');

package/src/s3-source.js

@@ -0,0 +1,302 @@
+import crypto from 'node:crypto';
+
+/**
+ * Reading a PMTiles archive out of an S3-compatible bucket.
+ *
+ * A public or presigned URL needs nothing from this file: it is an address,
+ * `FetchSource` asks it for byte ranges and the bucket answers. What needs
+ * signing is the ordinary private object, and that is the case worth having --
+ * it is the difference between terrain somebody published and terrain this
+ * node holds, and it is what lets a stack read a bucket and bake the result
+ * into an archive without the bucket ever being public.
+ *
+ * Signed here rather than through an SDK. SigV4 for a GET is a hash, four
+ * HMACs and a string, all of which `node:crypto` already has; the AWS client
+ * that would do it instead is a large dependency for one signature, and an
+ * optional one would make reading a bucket work on some installs and not on
+ * others for no reason the operator could see.
+ *
+ * See docs/configuration.md -- "S3 buckets".
+ */
+
+/** What SigV4 calls an empty body, which every GET has. */
+const EMPTY_SHA256 = crypto.createHash('sha256').update('').digest('hex');
+
+/**
+ * HMAC-SHA256, the only primitive the signature needs.
+ * @param {Buffer|string} key - The key.
+ * @param {string} data - What to sign.
+ * @returns {Buffer} - The digest.
+ */
+const hmac = (key, data) =>
+  crypto.createHmac('sha256', key).update(data, 'utf8').digest();
+
+/**
+ * Query parameters in the order and encoding SigV4 asks for.
+ * @param {URL} url - The address being signed.
+ * @returns {string} - The canonical query string.
+ */
+const canonicalQuery = (url) => {
+  const pairs = [...url.searchParams.entries()].map(([name, value]) => [
+    encodeURIComponent(name),
+    encodeURIComponent(value),
+  ]);
+  pairs.sort((one, two) =>
+    one[0] === two[0] ? one[1].localeCompare(two[1]) : one[0] < two[0] ? -1 : 1,
+  );
+  return pairs.map(([name, value]) => `${name}=${value}`).join('&');
+};
+
+/**
+ * The `Authorization` header for one request.
+ *
+ * Signs exactly the headers it is given, which is what makes it checkable
+ * against AWS's own published test vectors rather than only against itself.
+ * @param {object} request - `method`, `url`, `headers`, `payloadHash`.
+ * @param {object} credentials - `accessKeyId`, `secretAccessKey`, `region`,
+ *   `service` and `amzDate`, which is `YYYYMMDDTHHMMSSZ`.
+ * @returns {string} - The header value.
+ */
+export function authorization(request, credentials) {
+  const url = new URL(request.url);
+  const { amzDate } = credentials;
+  const day = amzDate.slice(0, 8);
+  const service = credentials.service ?? 's3';
+  const scope = `${day}/${credentials.region}/${service}/aws4_request`;
+
+  const named = Object.entries(request.headers ?? {})
+    .map(([name, value]) => [name.toLowerCase(), String(value).trim()])
+    .sort((one, two) => (one[0] < two[0] ? -1 : 1));
+  const signed = named.map(([name]) => name).join(';');
+  const canonicalHeaders = named
+    .map(([name, value]) => `${name}:${value}\n`)
+    .join('');
+
+  // The path as it appears on the wire rather than a normalised form of it:
+  // S3 signs what it is sent, so a key holding a literal per-cent sign signs
+  // with that sign encoded, and re-encoding here would sign something else.
+  const canonical = [
+    request.method ?? 'GET',
+    url.pathname || '/',
+    canonicalQuery(url),
+    canonicalHeaders,
+    signed,
+    request.payloadHash ?? EMPTY_SHA256,
+  ].join('\n');
+
+  const toSign = [
+    'AWS4-HMAC-SHA256',
+    amzDate,
+    scope,
+    crypto.createHash('sha256').update(canonical).digest('hex'),
+  ].join('\n');
+
+  const key = ['aws4_request', service, credentials.region, day].reduceRight(
+    (acc, part) => hmac(acc, part),
+    `AWS4${credentials.secretAccessKey}`,
+  );
+  const signature = hmac(key, toSign).toString('hex');
+
+  return (
+    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +
+    `SignedHeaders=${signed}, Signature=${signature}`
+  );
+}
+
+/**
+ * Whether an address names an object in a bucket rather than a web server.
+ * @param {string} value - The address.
+ * @returns {boolean} - True for `s3://bucket/key`.
+ */
+export const isS3Url = (value) =>
+  typeof value === 'string' && /^s3:\/\/[^/]+\/.+/i.test(value);
+
+/**
+ * The bucket and key an `s3://` address names.
+ * @param {string} value - The address.
+ * @returns {object} - `{bucket, key}`.
+ */
+export function splitS3Url(value) {
+  const rest = String(value).slice('s3://'.length);
+  const at = rest.indexOf('/');
+  return { bucket: rest.slice(0, at), key: rest.slice(at + 1) };
+}
+
+/**
+ * Credentials from the environment, in the names every S3 tool already uses.
+ *
+ * The same variables the AWS CLI, rclone, go-pmtiles and tileserver-gl read,
+ * so a machine already set up to reach a bucket needs nothing written into
+ * this node's settings -- and a container gets its keys the way a container
+ * gets its keys, rather than through a config file baked into an image.
+ *
+ * `AWS_S3_ENDPOINT` and `AWS_ENDPOINT_URL_S3` are both read: the first is
+ * what tileserver-gl documents, the second what the current AWS SDKs do.
+ * @param {object} [env] - The environment.
+ * @returns {object|null} - A row like `config.s3` holds, or null.
+ */
+export function bucketFromEnv(env = process.env) {
+  if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) return null;
+  const forced = String(
+    env.AWS_S3_FORCE_PATH_STYLE ?? env.AWS_ENDPOINT_FORCE_PATH_STYLE ?? '',
+  ).toLowerCase();
+  return {
+    from: 'the environment',
+    endpoint: env.AWS_S3_ENDPOINT || env.AWS_ENDPOINT_URL_S3 || undefined,
+    region: env.AWS_REGION || env.AWS_DEFAULT_REGION || undefined,
+    accessKeyId: env.AWS_ACCESS_KEY_ID,
+    secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+    sessionToken: env.AWS_SESSION_TOKEN || undefined,
+    pathStyle: forced === '' ? undefined : forced !== 'false' && forced !== '0',
+  };
+}
+
+/**
+ * Which configured bucket a source's address should be read through.
+ *
+ * By name first, then whichever row names no bucket, then the environment --
+ * one set of credentials for a whole account is the ordinary case, and making
+ * the operator write the same keys once per bucket would be busywork with a
+ * copy-paste mistake in it.
+ * @param {string} url - An `s3://` address.
+ * @param {object[]} rows - `config.s3`.
+ * @param {object} [env] - The environment, for the last resort.
+ * @returns {object|null} - The row, or null if nothing matches.
+ */
+export function bucketFor(url, rows = [], env = process.env) {
+  if (!isS3Url(url)) return null;
+  const { bucket } = splitS3Url(url);
+  const named = (rows ?? []).find(
+    (row) => row?.bucket && row.bucket === bucket,
+  );
+  return (
+    named ??
+    (rows ?? []).find((row) => row && !row.bucket) ??
+    bucketFromEnv(env)
+  );
+}
+
+/**
+ * The HTTPS address an `s3://` one is actually fetched from.
+ *
+ * Path style unless the endpoint is AWS's own, where it was withdrawn for
+ * buckets made after September 2020. Every other S3-compatible server this is
+ * likely to meet -- MinIO, Ceph, Garage, R2 -- speaks path style, and it is
+ * the form that works with an endpoint naming a port or a bare host.
+ * @param {string} url - The `s3://` address.
+ * @param {object} row - The matching row of `config.s3`.
+ * @returns {string} - An https address.
+ */
+export function httpsFor(url, row) {
+  const { bucket, key } = splitS3Url(url);
+  const region = row?.region || 'us-east-1';
+  const endpoint = row?.endpoint || `https://s3.${region}.amazonaws.com`;
+  const base = new URL(
+    endpoint.includes('://') ? endpoint : `https://${endpoint}`,
+  );
+  const path = key
+    .split('/')
+    .map((part) => encodeURIComponent(part))
+    .join('/');
+
+  const virtual =
+    row?.pathStyle === false ||
+    (row?.pathStyle === undefined &&
+      /(^|\.)amazonaws\.com$/i.test(base.hostname));
+  if (virtual) {
+    base.hostname = `${bucket}.${base.hostname}`;
+    base.pathname = `/${path}`;
+  } else {
+    base.pathname = `${base.pathname.replace(/\/$/, '')}/${bucket}/${path}`;
+  }
+  return base.toString();
+}
+
+/**
+ * A PMTiles source reading a private bucket, signing every request.
+ *
+ * The same shape as `NodeFileSource` and the swarm's own source, because that
+ * is all PMTiles asks for: a key to cache under, and a way to get a range of
+ * bytes. Nothing about the archive is different -- only where the bytes come
+ * from, and that the request carries a signature.
+ */
+export class S3Source {
+  #url;
+  #row;
+  #now;
+
+  /**
+   * @param {string} url - An `s3://bucket/key` address.
+   * @param {object} row - The matching row of `config.s3`.
+   * @param {Function} [now] - The clock, for tests.
+   */
+  constructor(url, row, now = () => new Date()) {
+    this.#url = url;
+    this.#row = row ?? {};
+    this.#now = now;
+  }
+
+  /**
+   * A stable key for PMTiles' internal caching.
+   *
+   * The `s3://` address rather than the signed one: the signature changes
+   * every request, and a cache keyed on it would never hit.
+   * @returns {string} - The address.
+   */
+  getKey() {
+    return this.#url;
+  }
+
+  /**
+   * Reads a byte range out of the object.
+   * @param {number} offset - Byte offset.
+   * @param {number} length - How many bytes.
+   * @param {AbortSignal} [signal] - To give up early.
+   * @returns {Promise<object>} - `{data, etag, cacheControl, expires}`.
+   */
+  async getBytes(offset, length, signal) {
+    const href = httpsFor(this.#url, this.#row);
+    const amzDate = `${this.#now()
+      .toISOString()
+      .replace(/[-:]/g, '')
+      .slice(0, 15)}Z`;
+    const headers = {
+      host: new URL(href).host,
+      range: `bytes=${offset}-${offset + length - 1}`,
+      'x-amz-content-sha256': EMPTY_SHA256,
+      'x-amz-date': amzDate,
+    };
+    if (this.#row.sessionToken) {
+      headers['x-amz-security-token'] = this.#row.sessionToken;
+    }
+
+    headers.authorization = authorization(
+      { method: 'GET', url: href, headers },
+      {
+        accessKeyId: this.#row.accessKeyId,
+        secretAccessKey: this.#row.secretAccessKey,
+        region: this.#row.region || 'us-east-1',
+        amzDate,
+      },
+    );
+
+    // `host` is set by fetch itself and refused as a header, but it has to be
+    // in the signature: it is what stops a signed request being replayed
+    // against a different endpoint.
+    const sent = { ...headers };
+    delete sent.host;
+
+    const response = await fetch(href, { headers: sent, signal });
+    if (!response.ok) {
+      throw new Error(
+        `${this.#url} answered ${response.status} ${response.statusText}`,
+      );
+    }
+    return {
+      data: await response.arrayBuffer(),
+      etag: response.headers.get('etag') ?? undefined,
+      cacheControl: response.headers.get('cache-control') ?? undefined,
+      expires: response.headers.get('expires') ?? undefined,
+    };
+  }
+}

package/src/stacks.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { isS3Url } from './s3-source.js';
 import {
   MAX_BLUR_SIGMA,
   RESAMPLING,
@@ -91,6 +92,20 @@ export function isHttpUrl(value) {
   }
 }
 
+/**
+ * Whether an address is one a source may be read from.
+ *
+ * Wider than `isHttpUrl` by one scheme: `s3://bucket/key` is an object in a
+ * bucket, fetched over HTTPS like anything else once a configured endpoint
+ * and a signature have been put on it. A feed address is not this -- that is
+ * something the node fetches plainly and has no credentials for.
+ * @param {string} value - What the recipe said.
+ * @returns {boolean} - True for http, https or s3.
+ */
+export function isSourceUrl(value) {
+  return isHttpUrl(value) || isS3Url(value);
+}
+
 /**
  * How many stacks deep a recipe may reach.
  *
@@ -159,8 +174,10 @@ export function validateStack(stack) {
       );
     }
     if (source?.url !== undefined) {
-      if (typeof source.url !== 'string' || !isHttpUrl(source.url)) {
-        problems.push(`sources[${index}].url must be an http(s) address`);
+      if (typeof source.url !== 'string' || !isSourceUrl(source.url)) {
+        problems.push(
+          `sources[${index}].url must be an http(s) or s3:// address`,
+        );
       }
     }
     for (const key of ['minzoom', 'maxzoom']) {
@@ -653,8 +670,13 @@ export function stackCoverage(resolved) {
       (at?.nested ? stackCoverage(at.nested).bounds : undefined);
   }
   if (!bounds && summaries.length) {
-    const boxes = summaries.map((s) => s.bounds).filter(Array.isArray);
-    if (boxes.length) {
+    const boxes = summaries.map((s) => s.bounds);
+    // Every source, or none of them. A source that states no box is not one
+    // covering nothing: an archive's box comes off its own header, and the
+    // source without one is the imported global base, which covers the world.
+    // Unioning only the boxes that exist advertised a planet-wide stack as
+    // covering whichever patches happened to state theirs.
+    if (boxes.length && boxes.every(Array.isArray)) {
       bounds = [
         Math.min(...boxes.map((b) => b[0])),
         Math.min(...boxes.map((b) => b[1])),

package/src/tiles.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { FetchSource, PMTiles, SharedPromiseCache } from 'pmtiles';
+import { S3Source, bucketFor, isS3Url, splitS3Url } from './s3-source.js';
 import { TorrentSource } from 'pmtiles-torrent';
 import { NodeFileSource } from './file-source.js';
 import { onDiskPath } from './incomplete.js';
@@ -199,6 +200,18 @@ export class TileStore {
    * @param {string} url - Where the archive is.
    * @returns {Promise<object>} - The open handle.
    */
+  /**
+   * Drops every open reader of an archive read over the network.
+   *
+   * Called when the bucket settings change. A handle holds the credentials it
+   * was opened with, so without this a corrected key would apply to archives
+   * opened afterwards and not to the one being looked at.
+   * @returns {void}
+   */
+  forgetRemote() {
+    this.#remote.clear();
+  }
+
   async #acquireRemote(url) {
     const existing = this.#remote.get(url);
     if (existing) {
@@ -207,7 +220,18 @@ export class TileStore {
       return existing;
     }
 
-    const source = new FetchSource(url);
+    // A bucket rather than a web server. The difference is the signature on
+    // every request and where the address is really fetched from; everything
+    // after this line -- the archive, the directory cache, the LRU -- is the
+    // same, because a source is only a key and a way to get bytes.
+    const row = bucketFor(url, this.#config.s3);
+    if (isS3Url(url) && !row) {
+      throw new TileReadError(
+        `no credentials configured for ${splitS3Url(url).bucket}`,
+        502,
+      );
+    }
+    const source = row ? new S3Source(url, row) : new FetchSource(url);
     const handle = {
       mode: 'remote',
       source,
@@ -261,6 +285,36 @@ export class TileStore {
     const answer = await handle.source.getBytes(offset, length, options.signal);
     return Buffer.from(answer.data);
   }
+
+  /**
+   * Reads a byte range out of an archive at a URL.
+   *
+   * The same question `readRange` answers, for the sources that have no
+   * infohash to ask it about. A bake needs this rather than tile-by-tile
+   * reads: it walks the directories of every source to find which tiles exist
+   * at all, and a stack of remote sources with no way to do that could be
+   * served and not exported -- which is backwards, since exporting is how
+   * something read from somewhere else becomes something this node holds.
+   * @param {string} url - The archive's address.
+   * @param {number} offset - Byte offset into the archive file.
+   * @param {number} length - How many bytes.
+   * @param {object} [options] - Abort signal.
+   * @returns {Promise<Buffer>} - The bytes.
+   */
+  async readRemoteRange(url, offset, length, options = {}) {
+    const handle = await this.#acquireRemote(url);
+    try {
+      const answer = await handle.source.getBytes(
+        offset,
+        length,
+        options.signal,
+      );
+      return Buffer.from(answer.data);
+    } catch (error) {
+      if (error instanceof TileReadError) throw error;
+      throw new TileReadError(`${url}: ${error.message}`, 502);
+    }
+  }
   /**
    * Reads an archive's header and metadata, through whatever source applies.
    *

package/src/web/index.html

@@ -6726,6 +6726,56 @@ Every piece is hashed against the ` +
             'anybody remembering to press it.',
         });
 
+        renderRowEditor({
+          into: paneFor('Feeds'),
+          key: 's3',
+          title: 'S3 buckets',
+          blurb:
+            'Credentials for reading a stack source written as ' +
+            '<code>s3://bucket/key.pmtiles</code>. Only for a bucket that is ' +
+            'not public — a public or presigned address is read as any other ' +
+            'URL and needs nothing here. <b>Endpoint</b> is what makes it ' +
+            'S3-compatible rather than S3: MinIO, Ceph, Garage, R2, Wasabi ' +
+            'and B2 all answer the same protocol at their own address.',
+          columns: [
+            {
+              field: 'bucket',
+              label: 'Bucket',
+              placeholder: 'any bucket',
+            },
+            {
+              field: 'endpoint',
+              label: 'Endpoint',
+              placeholder: 'AWS for the region',
+              wide: true,
+            },
+            { field: 'region', label: 'Region', placeholder: 'us-east-1' },
+            { field: 'accessKeyId', label: 'Access key' },
+            { field: 'secretAccessKey', label: 'Secret key', secret: true },
+            {
+              field: 'pathStyle',
+              label: 'Addressing',
+              options: [
+                ['', 'path style, unless AWS'],
+                ['true', 'path style'],
+                ['false', 'bucket as a subdomain'],
+              ],
+            },
+          ],
+          rows: config.s3 ?? [],
+          footnote:
+            'A source is read through the row naming its bucket, or through ' +
+            'whichever row names none — one set of credentials for a whole ' +
+            'account is the ordinary case. With no rows at all the standard ' +
+            '<code>AWS_ACCESS_KEY_ID</code>, <code>AWS_SECRET_ACCESS_KEY</code>, ' +
+            '<code>AWS_REGION</code> and <code>AWS_S3_ENDPOINT</code> ' +
+            'variables are read, so a machine already set up to reach a ' +
+            'bucket needs nothing typed here. Addressing is only worth ' +
+            'setting for a server that insists: path style is what every ' +
+            'S3-compatible server speaks, and AWS itself withdrew it for ' +
+            'buckets made after September 2020.',
+        });
+
         renderRowEditor({
           // With the monitored folders and the scheduled sources, because it
           // is the same kind of thing: something that puts an archive into
@@ -7655,21 +7705,64 @@ Every piece is hashed against the ` +
                    and this node has no codec. <code>npm install sharp</code>.</p>`
                 : ''
             }
-            <table class="tight">
-              <thead>
-                <tr><th>#</th><th>Source</th><th>Resolves to</th><th>Zooms</th><th></th></tr>
-              </thead>
-              <tbody>
-                ${stack.sources.map(renderStackSource).join('')}
-              </tbody>
-            </table>
-            <p class="muted">
-              Listed in the file's order: the first is the base, each one covers
-              the one before it wherever it has data, and the last wins.
-            </p>
+            <details${stack.sources.length > SOURCES_SHOWN ? '' : ' open'}>
+              <summary>${stack.sources.length} source${
+                stack.sources.length === 1 ? '' : 's'
+              }${
+                stack.sources.length > SOURCES_SHOWN
+                  ? ` <span class="muted">— ${escapeHtml(
+                      summarizeSources(stack.sources),
+                    )}</span>`
+                  : ''
+              }</summary>
+              <table class="tight">
+                <thead>
+                  <tr><th>#</th><th>Source</th><th>Resolves to</th><th>Zooms</th><th></th></tr>
+                </thead>
+                <tbody>
+                  ${stack.sources.map(renderStackSource).join('')}
+                </tbody>
+              </table>
+              <p class="muted">
+                Listed in the file's order: the first is the base, each one covers
+                the one before it wherever it has data, and the last wins.
+              </p>
+            </details>
           </div>`;
       };
 
+      /**
+       * How many sources a stack shows without being asked.
+       *
+       * A stack built from a provider's file list runs to several hundred
+       * rows, which buries every other stack on the page under one of them.
+       * Small enough that the ordinary stack -- a base and a layer or two --
+       * is still open on arrival, since collapsing that hides nothing worth
+       * the click.
+       */
+      const SOURCES_SHOWN = 5;
+
+      /**
+       * What a collapsed source list says about itself.
+       * @param {object[]} sources - The stack's sources.
+       * @returns {string} - A line naming the base and the shape of the rest.
+       */
+      const summarizeSources = (sources) => {
+        const first = sources[0];
+        const base =
+          first?.kind === 'url'
+            ? (first.url ?? '').replace(/^https?:\/\//, '')
+            : (first?.name ?? '');
+        const urls = sources.filter((s) => s.kind === 'url').length;
+        const rest =
+          urls === sources.length
+            ? 'all read over HTTP'
+            : urls
+              ? `${urls} read over HTTP`
+              : '';
+        return [base, rest].filter(Boolean).join(', ');
+      };
+
       /**
        * One source row.
        * @param {object} source - A source from /api/stacks.
@@ -7713,7 +7806,11 @@ Every piece is hashed against the ` +
               source.resolved
                 ? source.kind === 'url'
                   ? `<span class="muted" title="Read straight from this address over HTTP. Nothing is downloaded or seeded, and whether it answers is settled at the first tile.">read over HTTP</span>`
-                  : `<code class="muted">${escapeHtml(source.archiveName ?? '')}</code>`
+                  : source.kind === 'stack'
+                    ? `<span class="muted" title="Another recipe, evaluated for this tile and merged as one layer. It follows every later change to that stack.">recipe of ${
+                        source.nested ?? 0
+                      } source${source.nested === 1 ? '' : 's'}</span>`
+                    : `<code class="muted">${escapeHtml(source.archiveName ?? '')}</code>`
                 : '<span class="bad">does not resolve</span>'
             }</td>
             <td>${zooms}${
@@ -7754,6 +7851,18 @@ Every piece is hashed against the ` +
         return candidate;
       };
 
+      /**
+       * Whether an address is one a source can be read from.
+       *
+       * `s3://bucket/key` as well as the two web schemes: a bucket is fetched
+       * over HTTPS like anything else, once the endpoint and the signature
+       * configured under Settings have been put on it.
+       * @param {string} value - What was typed.
+       * @returns {boolean} - True if a source could use it.
+       */
+      const isSourceAddress = (value) =>
+        /^https?:\/\//i.test(value) || /^s3:\/\/[^/]+\/.+/i.test(value);
+
       /** Forty characters of hex is not a label. */
       const shortHash = (hash) => (hash ? `${hash.slice(0, 12)}…` : hash);
 
@@ -7972,11 +8081,14 @@ Every piece is hashed against the ` +
           );
         }
 
-        select.innerHTML = groups.length
-          ? groups.join('')
-          : '<option value="">nothing left to add</option>';
-        select.disabled = groups.length === 0;
-        $('stack-add-source-go').disabled = groups.length === 0;
+        // Always offered, and last: it names nothing this node holds, so
+        // there is no list to be empty and no reason to prefer it over an
+        // archive that is already here.
+        groups.push(
+          `<optgroup label="A URL — read over HTTP, never downloaded"><option value="url:">an address you type…</option></optgroup>`,
+        );
+
+        select.innerHTML = groups.join('');
       };
 
       /** Redraws the source list and the fields that depend on the space. */
@@ -8124,6 +8236,10 @@ Every piece is hashed against the ` +
         // against. Those fields are left out rather than shown and refused on
         // save; everything that acts on heights stays.
         const nested = Boolean(source.stack);
+        // An archive somewhere else. It has no catalog entry to read a zoom
+        // range or an extent from, so the recipe is the only place either can
+        // come from -- which is why the card asks for them.
+        const remote = source.url !== undefined;
         const perSpace = rgba
           ? `<label class="choice">Opacity
                <input type="number" min="0" max="1" step="0.05" style="width:5rem"
@@ -8240,16 +8356,29 @@ Every piece is hashed against the ` +
             <div class="row">
               <span class="muted">${index}</span>
               <code>${escapeHtml(
-                source.stack ?? source.category ?? shortHash(source.archive) ?? '',
+                remote
+                  ? (source.url || 'an address').replace(/^https?:\/\//, '')
+                  : (source.stack ??
+                      source.category ??
+                      shortHash(source.archive) ??
+                      ''),
               )}</code>
               <span class="sub" title="${
-                source.archive
-                  ? 'Pinned to this build. It will not follow a rebuild, and breaks if the archive is removed.'
-                  : source.stack
-                    ? 'Another stack, merged as one layer. It follows every later change to that recipe, and to whatever it resolves to.'
-                    : 'Follows whichever build in this category is newest.'
+                remote
+                  ? 'Read straight from this address over HTTP, with byte ranges. Nothing is downloaded, nothing is seeded, and this node never rebuilds or retires it.'
+                  : source.archive
+                    ? 'Pinned to this build. It will not follow a rebuild, and breaks if the archive is removed.'
+                    : source.stack
+                      ? 'Another stack, merged as one layer. It follows every later change to that recipe, and to whatever it resolves to.'
+                      : 'Follows whichever build in this category is newest.'
               }">${
-                source.archive ? 'pinned' : source.stack ? 'stack' : 'category'
+                remote
+                  ? 'url'
+                  : source.archive
+                    ? 'pinned'
+                    : source.stack
+                      ? 'stack'
+                      : 'category'
               }</span>
               ${role}
               <span class="bar-gap"></span>
@@ -8259,6 +8388,38 @@ Every piece is hashed against the ` +
                       ${last ? 'disabled' : ''} title="Later: covers more">↓</button>
               <button type="button" data-stack-remove="${index}">Remove</button>
             </div>
+            ${
+              remote
+                ? `<div class="bar">
+                     <label class="choice" style="flex:1">Address
+                       <input style="flex:1;min-width:22rem" placeholder="https://example.org/terrain.pmtiles or s3://bucket/terrain.pmtiles"
+                              data-stack-field="url" data-stack-index="${index}"
+                              value="${escapeHtml(source.url ?? '')}" />
+                     </label>
+                     ${
+                       source.url && !isSourceAddress(source.url)
+                         ? '<span class="bad">http://, https:// or s3://bucket/key</span>'
+                         : ''
+                     }
+                   </div>
+                   <div class="bar">
+                     <label class="choice"
+                            title="The zooms this archive actually holds. Checked before anything is opened, so a tile outside the range skips it without a request leaving this node — which is what makes a stack of many of these cheap. Leave empty and every tile asks it.">
+                       Only zooms
+                       <input type="number" min="0" max="24" step="1" style="width:4.5rem"
+                              placeholder="any"
+                              data-stack-field="minzoom" data-stack-index="${index}"
+                              value="${source.minzoom ?? ''}" />
+                       to
+                       <input type="number" min="0" max="24" step="1" style="width:4.5rem"
+                              placeholder="any"
+                              data-stack-field="maxzoom" data-stack-index="${index}"
+                              value="${source.maxzoom ?? ''}" />
+                     </label>
+                     <span class="sub">Clip it to a box below to skip it by area too.</span>
+                   </div>`
+                : ''
+            }
             <div class="bar">
               ${perSpace}
               ${
@@ -8402,6 +8563,12 @@ Every piece is hashed against the ` +
               source.featherMetres = width;
             }
           }
+        } else if (field === 'minzoom' || field === 'maxzoom') {
+          // Blank means "every zoom", so an empty box removes the field
+          // rather than writing 0 -- which for minzoom is the same thing and
+          // for maxzoom would silence the source everywhere above z0.
+          if (event.target.value === '') delete source[field];
+          else source[field] = Math.round(Number(event.target.value));
         } else if (field === 'baseVal' || field === 'interval') {
           // Blank means "the default", not zero -- an interval of 0 would make
           // every height the base value.
@@ -8499,7 +8666,12 @@ Every piece is hashed against the ` +
             ? { archive: name }
             : kind === 'stk'
               ? { stack: name }
-              : { category: name },
+              : kind === 'url'
+                ? // Empty, because the address is typed into the card rather
+                  // than chosen from a menu. It is refused on save until it
+                  // is filled in.
+                  { url: '' }
+                : { category: name },
         );
         renderStackDraft();
         fillStackSourceChoices();
@@ -8546,6 +8718,23 @@ Every piece is hashed against the ` +
             'is made of, so saving would replace it rather than add this one.';
           return;
         }
+        // A URL source is the one kind whose name is typed rather than
+        // chosen, so it is the one kind that can be left half-made. Caught
+        // here because the reply to a recipe the node refuses says which
+        // source is wrong by index, which is not where the operator is
+        // looking.
+        const blank = stackDraft.sources.findIndex(
+          (source) =>
+            source.url !== undefined && !isSourceAddress(source.url ?? ''),
+        );
+        if (blank >= 0) {
+          $('stack-error').textContent =
+            `Source ${blank} needs an address: http://, https://, or ` +
+            's3://bucket/key for a bucket set up under Settings → Feeds. It ' +
+            'is read straight from wherever it is, so there is nothing else ' +
+            'to find it by.';
+          return;
+        }
         const body = {
           title: $('stack-title').value.trim() || undefined,
           space: stackDraft.space,