workerstack 0.1.0-beta.0

package/dist/storage/operations.d.ts

@@ -0,0 +1,54 @@
+import type { AccessContext } from '../access.js';
+import type { AnyDb } from '../dialect.js';
+import type { BucketStorageRegistry } from './registry.js';
+export interface StorageExecutionContext {
+    request: Request;
+    user: AccessContext['user'];
+    session: {
+        activeOrganizationId: string | null;
+    };
+}
+export interface StorageOperationsOptions {
+    registry: BucketStorageRegistry;
+    db: AnyDb;
+    presignExpiresSec?: number;
+}
+export type PrepareUploadResult = {
+    mode: 'proxy';
+    uploadUrl: string;
+} | {
+    mode: 'presign';
+    fileId: string;
+    uploadUrl: string;
+    method: 'PUT';
+    confirmUrl: string;
+};
+export type StorageDownload = {
+    kind: 'redirect';
+    status: 302;
+    url: string;
+} | {
+    kind: 'body';
+    status: number;
+    body: ConstructorParameters<typeof Response>[0];
+    headers: Headers;
+};
+export declare function createStorageOperations(options: StorageOperationsOptions): {
+    prepareUpload(bucketName: string, body: {
+        filename?: string;
+        contentType?: string;
+    }, context: StorageExecutionContext): Promise<PrepareUploadResult>;
+    upload(bucketName: string, file: File, context: StorageExecutionContext): Promise<{
+        status: 201;
+        fileId: string;
+        url: string;
+    }>;
+    confirmUpload(bucketName: string, id: string, context: StorageExecutionContext): Promise<{
+        fileId: string;
+        url: string;
+    }>;
+    download(bucketName: string, id: string, context: StorageExecutionContext): Promise<StorageDownload>;
+    delete(bucketName: string, id: string, context: StorageExecutionContext): Promise<void>;
+};
+export type StorageOperations = ReturnType<typeof createStorageOperations>;
+//# sourceMappingURL=operations.d.ts.map

package/dist/storage/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/storage/operations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,WAAW,CAAA;AAC7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAiBvD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3B,OAAO,EAAE;QAAE,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,EAAE,EAAE,KAAK,CAAA;IACT,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpC;IACE,IAAI,EAAE,SAAS,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,KAAK,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAEL,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9C;IACE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAgEL,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB;8BAYvD,MAAM,QACZ;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,WACxC,uBAAuB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;uBAgDjB,MAAM,QACZ,IAAI,WACD,uBAAuB;;;;;8BAsDpB,MAAM,MACd,MAAM,WACD,uBAAuB;;;;yBAuDpB,MAAM,MACd,MAAM,WACD,uBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC;uBA0Cb,MAAM,MACd,MAAM,WACD,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC;EAWnB;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA"}

package/dist/storage/operations.js

@@ -0,0 +1,212 @@
+import { randomUUID } from 'node:crypto';
+import { extname } from 'node:path';
+import { checkAccess } from '../access.js';
+import { WorkerstackError } from '../errors.js';
+import { deleteStoredFile } from './delete.js';
+import { deleteFileMetaRow, fileMatchesScope, getFileMeta, insertPendingFile, insertReadyFile, markFileReady, scopeToJson, sumReadySize, } from './file-meta.js';
+const FILE_OWNER_COLUMN = 'ownerId';
+function matchMime(type, accept) {
+    if (!accept || accept.length === 0)
+        return true;
+    if (!type)
+        return false;
+    return accept.some((pattern) => pattern === type ||
+        (pattern.endsWith('/*') && type.startsWith(pattern.slice(0, -1))));
+}
+function accessContext(context, extra = {}) {
+    return {
+        request: context.request,
+        user: context.user,
+        session: context.session,
+        row: extra.row,
+        body: extra.body,
+    };
+}
+async function gate(rule, context) {
+    const result = await checkAccess(rule, context, FILE_OWNER_COLUMN);
+    if (!result.allowed) {
+        throw new WorkerstackError(result.status === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN', result.status === 401 ? 'Authentication required' : 'Forbidden');
+    }
+}
+function notFound(message = 'Not found') {
+    throw new WorkerstackError('NOT_FOUND', message);
+}
+function sanitizeFilename(name) {
+    return name.replace(/["\\\r\n]/g, '');
+}
+async function quotaExceeded(db, bucket, quota, ownerId, scopeJson, incoming) {
+    if (quota.perUserBytes !== undefined && ownerId !== undefined) {
+        const current = await sumReadySize(db, { bucket, ownerId });
+        if (current + incoming > quota.perUserBytes)
+            return true;
+    }
+    if (quota.perScopeBytes !== undefined && scopeJson != null) {
+        const current = await sumReadySize(db, { bucket, scopeJson });
+        if (current + incoming > quota.perScopeBytes)
+            return true;
+    }
+    return false;
+}
+export function createStorageOperations(options) {
+    const { registry, db } = options;
+    const presignExpiresSec = options.presignExpiresSec ?? 60;
+    const bucketEntry = (name) => {
+        const entry = registry.get(name);
+        if (!entry)
+            notFound('Unknown bucket');
+        return entry;
+    };
+    return {
+        async prepareUpload(bucketName, body, context) {
+            const { bucket, adapter } = bucketEntry(bucketName);
+            const ctx = accessContext(context, { body });
+            await gate(bucket.access.create, ctx);
+            if (!adapter.presignPut) {
+                return { mode: 'proxy', uploadUrl: `/api/files/${bucket.name}` };
+            }
+            const scopeJson = scopeToJson(bucket.writeScope?.(ctx));
+            if (bucket.quota &&
+                (await quotaExceeded(db, bucket.name, bucket.quota, context.user?.id, scopeJson, bucket.upload?.maxSizeBytes ?? 0))) {
+                throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'Quota exceeded');
+            }
+            const fileId = `${bucket.name}/${randomUUID()}${extname(body.filename ?? '')}`;
+            await insertPendingFile(db, {
+                fileId,
+                bucket: bucket.name,
+                ownerId: context.user?.id ?? null,
+                scopeJson,
+                filename: body.filename ?? null,
+                contentType: body.contentType ?? null,
+            });
+            const uploadUrl = await adapter.presignPut(fileId, {
+                contentType: body.contentType,
+                expiresIn: presignExpiresSec,
+            });
+            const id = fileId.slice(`${bucket.name}/`.length);
+            return {
+                mode: 'presign',
+                fileId,
+                uploadUrl,
+                method: 'PUT',
+                confirmUrl: `/api/files/${bucket.name}/${id}/confirm`,
+            };
+        },
+        async upload(bucketName, file, context) {
+            const { bucket, adapter } = bucketEntry(bucketName);
+            const ctx = accessContext(context);
+            await gate(bucket.access.create, ctx);
+            if (!matchMime(file.type, bucket.upload?.accept)) {
+                throw new WorkerstackError('BAD_REQUEST', `Content type ${file.type || '(none)'} not allowed`);
+            }
+            if (bucket.upload?.maxSizeBytes !== undefined &&
+                file.size > bucket.upload.maxSizeBytes) {
+                throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'File too large');
+            }
+            const scopeJson = scopeToJson(bucket.readScope?.(ctx));
+            if (bucket.quota &&
+                (await quotaExceeded(db, bucket.name, bucket.quota, context.user?.id, scopeJson, file.size))) {
+                throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'Quota exceeded');
+            }
+            const fileId = `${bucket.name}/${randomUUID()}${extname(file.name)}`;
+            await adapter.upload(fileId, await file.arrayBuffer(), file.type);
+            await insertReadyFile(db, {
+                fileId,
+                bucket: bucket.name,
+                ownerId: context.user?.id ?? null,
+                scopeJson,
+                filename: file.name || null,
+                contentType: file.type || null,
+                size: file.size,
+            });
+            const id = fileId.slice(`${bucket.name}/`.length);
+            return {
+                status: 201,
+                fileId,
+                url: `/api/files/${bucket.name}/${id}`,
+            };
+        },
+        async confirmUpload(bucketName, id, context) {
+            const { bucket, adapter } = bucketEntry(bucketName);
+            const fileId = `${bucketName}/${id}`;
+            const row = await getFileMeta(db, fileId);
+            if (!row || row.bucket !== bucketName)
+                notFound();
+            if (row.ownerId != null && row.ownerId !== (context.user?.id ?? null)) {
+                throw new WorkerstackError('FORBIDDEN', 'Forbidden');
+            }
+            const result = { fileId, url: `/api/files/${bucketName}/${id}` };
+            if (row.status === 'ready')
+                return result;
+            const info = await adapter.stat?.(fileId);
+            if (!info)
+                notFound();
+            const rejectUpload = async (message, validation = false) => {
+                await adapter.delete(fileId);
+                await deleteFileMetaRow(db, fileId);
+                throw new WorkerstackError(validation ? 'BAD_REQUEST' : 'PAYLOAD_TOO_LARGE', message);
+            };
+            if (bucket.upload?.maxSizeBytes !== undefined &&
+                info.size > bucket.upload.maxSizeBytes) {
+                await rejectUpload('File too large');
+            }
+            if (!matchMime(info.contentType, bucket.upload?.accept)) {
+                await rejectUpload(`Content type ${info.contentType || '(none)'} not allowed`, true);
+            }
+            if (bucket.quota &&
+                (await quotaExceeded(db, bucket.name, bucket.quota, row.ownerId ?? undefined, row.scopeJson, info.size))) {
+                await rejectUpload('Quota exceeded');
+            }
+            await markFileReady(db, fileId, info);
+            return result;
+        },
+        async download(bucketName, id, context) {
+            const { bucket, adapter } = bucketEntry(bucketName);
+            const fileId = `${bucketName}/${id}`;
+            const row = await getFileMeta(db, fileId);
+            if (!row || row.status !== 'ready' || row.bucket !== bucketName)
+                notFound();
+            const ctx = accessContext(context, { row });
+            await gate(bucket.access.get, ctx);
+            if (!fileMatchesScope(row, bucket.readScope?.(ctx)))
+                notFound();
+            if (bucket.visibility === 'public' && adapter.publicUrlFor) {
+                const url = adapter.publicUrlFor(fileId);
+                if (url)
+                    return { kind: 'redirect', status: 302, url };
+            }
+            if (bucket.visibility === 'private' && adapter.presignGet) {
+                return {
+                    kind: 'redirect',
+                    status: 302,
+                    url: await adapter.presignGet(fileId, {
+                        expiresIn: presignExpiresSec,
+                    }),
+                };
+            }
+            const response = await adapter.get(fileId);
+            const headers = new Headers(response.headers);
+            if (response.status !== 404 && row.filename) {
+                headers.set('Content-Disposition', `inline; filename="${sanitizeFilename(row.filename)}"`);
+            }
+            return {
+                kind: 'body',
+                status: response.status,
+                body: response.body,
+                headers,
+            };
+        },
+        async delete(bucketName, id, context) {
+            const { bucket, adapter } = bucketEntry(bucketName);
+            const fileId = `${bucketName}/${id}`;
+            const row = await getFileMeta(db, fileId);
+            if (!row || row.bucket !== bucketName)
+                notFound();
+            const ctx = accessContext(context, { row });
+            await gate(bucket.access.delete, ctx);
+            if (!fileMatchesScope(row, bucket.readScope?.(ctx)))
+                notFound();
+            await deleteStoredFile(adapter, db, fileId);
+        },
+    };
+}
+//# sourceMappingURL=operations.js.map

package/dist/storage/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/storage/operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAMnC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,YAAY,GAEb,MAAM,aAAa,CAAA;AAiCpB,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAEnC,SAAS,SAAS,CAAC,IAAY,EAAE,MAAiB;IAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,IAAI;QAChB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,OAAgC,EAChC,QAA+D,EAAE;IAEjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAmB,EAAE,OAAsB;IAC7D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EACpD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,WAAW,CAChE,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAO,GAAG,WAAW;IACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAS,EACT,MAAc,EACd,KAAwD,EACxD,OAA2B,EAC3B,SAAwB,EACxB,QAAgB;IAEhB,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3D,IAAI,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,IAAI,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,CAAA;IAChC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAEzD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,IAAiD,EACjD,OAAgC;YAEhC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;YACnD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAErC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;YAClE,CAAC;YAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACvD,IACE,MAAM,CAAC,KAAK;gBACZ,CAAC,MAAM,aAAa,CAClB,EAAE,EACF,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,IAAI,EAAE,EAAE,EAChB,SAAS,EACT,MAAM,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,CACjC,CAAC,EACF,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAA;YAC9E,MAAM,iBAAiB,CAAC,EAAE,EAAE;gBAC1B,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;gBACjC,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;gBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;aACtC,CAAC,CAAA;YACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;gBACjD,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM;gBACN,SAAS;gBACT,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,cAAc,MAAM,CAAC,IAAI,IAAI,EAAE,UAAU;aACtD,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAAU,EACV,OAAgC;YAEhC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;YACnD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;YAClC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAErC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,gBAAgB,CACxB,aAAa,EACb,gBAAgB,IAAI,CAAC,IAAI,IAAI,QAAQ,cAAc,CACpD,CAAA;YACH,CAAC;YACD,IACE,MAAM,CAAC,MAAM,EAAE,YAAY,KAAK,SAAS;gBACzC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EACtC,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,IACE,MAAM,CAAC,KAAK;gBACZ,CAAC,MAAM,aAAa,CAClB,EAAE,EACF,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,IAAI,EAAE,EAAE,EAChB,SAAS,EACT,IAAI,CAAC,IAAI,CACV,CAAC,EACF,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YACpE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACjE,MAAM,eAAe,CAAC,EAAE,EAAE;gBACxB,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;gBACjC,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;gBAC3B,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAA;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO;gBACL,MAAM,EAAE,GAAY;gBACpB,MAAM;gBACN,GAAG,EAAE,cAAc,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE;aACvC,CAAA;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,EAAU,EACV,OAAgC;YAEhC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,EAAE,EAAE,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAA;YACjD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,UAAU,IAAI,EAAE,EAAE,EAAE,CAAA;YAChE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAA;YAEzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI;gBAAE,QAAQ,EAAE,CAAA;YAErB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAe,EAAE,UAAU,GAAG,KAAK,EAAE,EAAE;gBACjE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC5B,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;gBACnC,MAAM,IAAI,gBAAgB,CACxB,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,EAChD,OAAO,CACR,CAAA;YACH,CAAC,CAAA;YACD,IACE,MAAM,CAAC,MAAM,EAAE,YAAY,KAAK,SAAS;gBACzC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EACtC,CAAC;gBACD,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxD,MAAM,YAAY,CAChB,gBAAgB,IAAI,CAAC,WAAW,IAAI,QAAQ,cAAc,EAC1D,IAAI,CACL,CAAA;YACH,CAAC;YACD,IACE,MAAM,CAAC,KAAK;gBACZ,CAAC,MAAM,aAAa,CAClB,EAAE,EACF,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,KAAK,EACZ,GAAG,CAAC,OAAO,IAAI,SAAS,EACxB,GAAG,CAAC,SAAS,EACb,IAAI,CAAC,IAAI,CACV,CAAC,EACF,CAAC;gBACD,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;YACtC,CAAC;YAED,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YACrC,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,QAAQ,CACZ,UAAkB,EAClB,EAAU,EACV,OAAgC;YAEhC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,EAAE,EAAE,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAC7D,QAAQ,EAAE,CAAA;YAEZ,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;gBAAE,QAAQ,EAAE,CAAA;YAE/D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;gBACxC,IAAI,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;YACxD,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC1D,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,GAAG;oBACX,GAAG,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;wBACpC,SAAS,EAAE,iBAAiB;qBAC7B,CAAC;iBACH,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5C,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,qBAAqB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CACvD,CAAA;YACH,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO;aACR,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,EAAU,EACV,OAAgC;YAEhC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,EAAE,EAAE,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAA;YACjD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;gBAAE,QAAQ,EAAE,CAAA;YAC/D,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto'\nimport { extname } from 'node:path'\n\nimport type { AccessContext, OperationRule } from '../access'\nimport type { AnyDb } from '../dialect'\nimport type { BucketStorageRegistry } from './registry'\n\nimport { checkAccess } from '../access'\nimport { WorkerstackError } from '../errors'\nimport { deleteStoredFile } from './delete'\nimport {\n  deleteFileMetaRow,\n  fileMatchesScope,\n  getFileMeta,\n  insertPendingFile,\n  insertReadyFile,\n  markFileReady,\n  scopeToJson,\n  sumReadySize,\n  type FileMetaRow,\n} from './file-meta'\n\nexport interface StorageExecutionContext {\n  request: Request\n  user: AccessContext['user']\n  session: { activeOrganizationId: string | null }\n}\n\nexport interface StorageOperationsOptions {\n  registry: BucketStorageRegistry\n  db: AnyDb\n  presignExpiresSec?: number\n}\n\nexport type PrepareUploadResult =\n  | { mode: 'proxy'; uploadUrl: string }\n  | {\n      mode: 'presign'\n      fileId: string\n      uploadUrl: string\n      method: 'PUT'\n      confirmUrl: string\n    }\n\nexport type StorageDownload =\n  | { kind: 'redirect'; status: 302; url: string }\n  | {\n      kind: 'body'\n      status: number\n      body: ConstructorParameters<typeof Response>[0]\n      headers: Headers\n    }\n\nconst FILE_OWNER_COLUMN = 'ownerId'\n\nfunction matchMime(type: string, accept?: string[]): boolean {\n  if (!accept || accept.length === 0) return true\n  if (!type) return false\n  return accept.some(\n    (pattern) =>\n      pattern === type ||\n      (pattern.endsWith('/*') && type.startsWith(pattern.slice(0, -1))),\n  )\n}\n\nfunction accessContext(\n  context: StorageExecutionContext,\n  extra: { row?: FileMetaRow; body?: Record<string, unknown> } = {},\n): AccessContext {\n  return {\n    request: context.request,\n    user: context.user,\n    session: context.session,\n    row: extra.row,\n    body: extra.body,\n  }\n}\n\nasync function gate(rule: OperationRule, context: AccessContext) {\n  const result = await checkAccess(rule, context, FILE_OWNER_COLUMN)\n  if (!result.allowed) {\n    throw new WorkerstackError(\n      result.status === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN',\n      result.status === 401 ? 'Authentication required' : 'Forbidden',\n    )\n  }\n}\n\nfunction notFound(message = 'Not found'): never {\n  throw new WorkerstackError('NOT_FOUND', message)\n}\n\nfunction sanitizeFilename(name: string): string {\n  return name.replace(/[\"\\\\\\r\\n]/g, '')\n}\n\nasync function quotaExceeded(\n  db: AnyDb,\n  bucket: string,\n  quota: { perUserBytes?: number; perScopeBytes?: number },\n  ownerId: string | undefined,\n  scopeJson: string | null,\n  incoming: number,\n): Promise<boolean> {\n  if (quota.perUserBytes !== undefined && ownerId !== undefined) {\n    const current = await sumReadySize(db, { bucket, ownerId })\n    if (current + incoming > quota.perUserBytes) return true\n  }\n  if (quota.perScopeBytes !== undefined && scopeJson != null) {\n    const current = await sumReadySize(db, { bucket, scopeJson })\n    if (current + incoming > quota.perScopeBytes) return true\n  }\n  return false\n}\n\nexport function createStorageOperations(options: StorageOperationsOptions) {\n  const { registry, db } = options\n  const presignExpiresSec = options.presignExpiresSec ?? 60\n\n  const bucketEntry = (name: string) => {\n    const entry = registry.get(name)\n    if (!entry) notFound('Unknown bucket')\n    return entry\n  }\n\n  return {\n    async prepareUpload(\n      bucketName: string,\n      body: { filename?: string; contentType?: string },\n      context: StorageExecutionContext,\n    ): Promise<PrepareUploadResult> {\n      const { bucket, adapter } = bucketEntry(bucketName)\n      const ctx = accessContext(context, { body })\n      await gate(bucket.access.create, ctx)\n\n      if (!adapter.presignPut) {\n        return { mode: 'proxy', uploadUrl: `/api/files/${bucket.name}` }\n      }\n\n      const scopeJson = scopeToJson(bucket.writeScope?.(ctx))\n      if (\n        bucket.quota &&\n        (await quotaExceeded(\n          db,\n          bucket.name,\n          bucket.quota,\n          context.user?.id,\n          scopeJson,\n          bucket.upload?.maxSizeBytes ?? 0,\n        ))\n      ) {\n        throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'Quota exceeded')\n      }\n\n      const fileId = `${bucket.name}/${randomUUID()}${extname(body.filename ?? '')}`\n      await insertPendingFile(db, {\n        fileId,\n        bucket: bucket.name,\n        ownerId: context.user?.id ?? null,\n        scopeJson,\n        filename: body.filename ?? null,\n        contentType: body.contentType ?? null,\n      })\n      const uploadUrl = await adapter.presignPut(fileId, {\n        contentType: body.contentType,\n        expiresIn: presignExpiresSec,\n      })\n      const id = fileId.slice(`${bucket.name}/`.length)\n      return {\n        mode: 'presign',\n        fileId,\n        uploadUrl,\n        method: 'PUT',\n        confirmUrl: `/api/files/${bucket.name}/${id}/confirm`,\n      }\n    },\n\n    async upload(\n      bucketName: string,\n      file: File,\n      context: StorageExecutionContext,\n    ) {\n      const { bucket, adapter } = bucketEntry(bucketName)\n      const ctx = accessContext(context)\n      await gate(bucket.access.create, ctx)\n\n      if (!matchMime(file.type, bucket.upload?.accept)) {\n        throw new WorkerstackError(\n          'BAD_REQUEST',\n          `Content type ${file.type || '(none)'} not allowed`,\n        )\n      }\n      if (\n        bucket.upload?.maxSizeBytes !== undefined &&\n        file.size > bucket.upload.maxSizeBytes\n      ) {\n        throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'File too large')\n      }\n\n      const scopeJson = scopeToJson(bucket.readScope?.(ctx))\n      if (\n        bucket.quota &&\n        (await quotaExceeded(\n          db,\n          bucket.name,\n          bucket.quota,\n          context.user?.id,\n          scopeJson,\n          file.size,\n        ))\n      ) {\n        throw new WorkerstackError('PAYLOAD_TOO_LARGE', 'Quota exceeded')\n      }\n\n      const fileId = `${bucket.name}/${randomUUID()}${extname(file.name)}`\n      await adapter.upload(fileId, await file.arrayBuffer(), file.type)\n      await insertReadyFile(db, {\n        fileId,\n        bucket: bucket.name,\n        ownerId: context.user?.id ?? null,\n        scopeJson,\n        filename: file.name || null,\n        contentType: file.type || null,\n        size: file.size,\n      })\n      const id = fileId.slice(`${bucket.name}/`.length)\n      return {\n        status: 201 as const,\n        fileId,\n        url: `/api/files/${bucket.name}/${id}`,\n      }\n    },\n\n    async confirmUpload(\n      bucketName: string,\n      id: string,\n      context: StorageExecutionContext,\n    ) {\n      const { bucket, adapter } = bucketEntry(bucketName)\n      const fileId = `${bucketName}/${id}`\n      const row = await getFileMeta(db, fileId)\n      if (!row || row.bucket !== bucketName) notFound()\n      if (row.ownerId != null && row.ownerId !== (context.user?.id ?? null)) {\n        throw new WorkerstackError('FORBIDDEN', 'Forbidden')\n      }\n\n      const result = { fileId, url: `/api/files/${bucketName}/${id}` }\n      if (row.status === 'ready') return result\n\n      const info = await adapter.stat?.(fileId)\n      if (!info) notFound()\n\n      const rejectUpload = async (message: string, validation = false) => {\n        await adapter.delete(fileId)\n        await deleteFileMetaRow(db, fileId)\n        throw new WorkerstackError(\n          validation ? 'BAD_REQUEST' : 'PAYLOAD_TOO_LARGE',\n          message,\n        )\n      }\n      if (\n        bucket.upload?.maxSizeBytes !== undefined &&\n        info.size > bucket.upload.maxSizeBytes\n      ) {\n        await rejectUpload('File too large')\n      }\n      if (!matchMime(info.contentType, bucket.upload?.accept)) {\n        await rejectUpload(\n          `Content type ${info.contentType || '(none)'} not allowed`,\n          true,\n        )\n      }\n      if (\n        bucket.quota &&\n        (await quotaExceeded(\n          db,\n          bucket.name,\n          bucket.quota,\n          row.ownerId ?? undefined,\n          row.scopeJson,\n          info.size,\n        ))\n      ) {\n        await rejectUpload('Quota exceeded')\n      }\n\n      await markFileReady(db, fileId, info)\n      return result\n    },\n\n    async download(\n      bucketName: string,\n      id: string,\n      context: StorageExecutionContext,\n    ): Promise<StorageDownload> {\n      const { bucket, adapter } = bucketEntry(bucketName)\n      const fileId = `${bucketName}/${id}`\n      const row = await getFileMeta(db, fileId)\n      if (!row || row.status !== 'ready' || row.bucket !== bucketName)\n        notFound()\n\n      const ctx = accessContext(context, { row })\n      await gate(bucket.access.get, ctx)\n      if (!fileMatchesScope(row, bucket.readScope?.(ctx))) notFound()\n\n      if (bucket.visibility === 'public' && adapter.publicUrlFor) {\n        const url = adapter.publicUrlFor(fileId)\n        if (url) return { kind: 'redirect', status: 302, url }\n      }\n      if (bucket.visibility === 'private' && adapter.presignGet) {\n        return {\n          kind: 'redirect',\n          status: 302,\n          url: await adapter.presignGet(fileId, {\n            expiresIn: presignExpiresSec,\n          }),\n        }\n      }\n\n      const response = await adapter.get(fileId)\n      const headers = new Headers(response.headers)\n      if (response.status !== 404 && row.filename) {\n        headers.set(\n          'Content-Disposition',\n          `inline; filename=\"${sanitizeFilename(row.filename)}\"`,\n        )\n      }\n      return {\n        kind: 'body',\n        status: response.status,\n        body: response.body,\n        headers,\n      }\n    },\n\n    async delete(\n      bucketName: string,\n      id: string,\n      context: StorageExecutionContext,\n    ): Promise<void> {\n      const { bucket, adapter } = bucketEntry(bucketName)\n      const fileId = `${bucketName}/${id}`\n      const row = await getFileMeta(db, fileId)\n      if (!row || row.bucket !== bucketName) notFound()\n      const ctx = accessContext(context, { row })\n      await gate(bucket.access.delete, ctx)\n      if (!fileMatchesScope(row, bucket.readScope?.(ctx))) notFound()\n      await deleteStoredFile(adapter, db, fileId)\n    },\n  }\n}\n\nexport type StorageOperations = ReturnType<typeof createStorageOperations>\n"]}

package/dist/storage/registry.d.ts

@@ -0,0 +1,11 @@
+import type { StorageAdapterFactory } from '../platform.js';
+import type { ResolvedBackend, ResolvedBucket, ResolvedStorageBuckets } from './buckets.js';
+import type { StorageAdapter } from './index.js';
+export interface BucketStorage {
+    bucket: ResolvedBucket;
+    adapter: StorageAdapter;
+}
+export type BucketStorageRegistry = Map<string, BucketStorage>;
+export declare function createAdapter(backend: ResolvedBackend): StorageAdapter;
+export declare function createBucketStorages(resolved: ResolvedStorageBuckets, factory?: StorageAdapterFactory): BucketStorageRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/storage/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/storage/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,sBAAsB,EACvB,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAK7C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,cAAc,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;CACxB;AACD,MAAM,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE9D,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAYtE;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,qBAAqC,GAC7C,qBAAqB,CAMvB"}

package/dist/storage/registry.js

@@ -0,0 +1,23 @@
+import { LocalStorageAdapter } from './local.js';
+import { S3StorageAdapter } from './s3.js';
+export function createAdapter(backend) {
+    if (backend.type === 'local') {
+        return new LocalStorageAdapter(backend.path);
+    }
+    return new S3StorageAdapter({
+        bucket: backend.bucket,
+        region: backend.region,
+        accessKeyId: backend.accessKeyId,
+        secretAccessKey: backend.secretAccessKey,
+        endpoint: backend.endpoint,
+        publicUrl: backend.publicUrl,
+    });
+}
+export function createBucketStorages(resolved, factory = createAdapter) {
+    const registry = new Map();
+    for (const [name, bucket] of resolved.buckets) {
+        registry.set(name, { bucket, adapter: factory(bucket.backend, bucket) });
+    }
+    return registry;
+}
+//# sourceMappingURL=registry.js.map

package/dist/storage/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/storage/registry.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAQvC,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgC,EAChC,UAAiC,aAAa;IAE9C,MAAM,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["// src/storage/registry.ts\nimport type { StorageAdapterFactory } from '../platform'\nimport type {\n  ResolvedBackend,\n  ResolvedBucket,\n  ResolvedStorageBuckets,\n} from './buckets'\nimport type { StorageAdapter } from './index'\n\nimport { LocalStorageAdapter } from './local'\nimport { S3StorageAdapter } from './s3'\n\nexport interface BucketStorage {\n  bucket: ResolvedBucket\n  adapter: StorageAdapter\n}\nexport type BucketStorageRegistry = Map<string, BucketStorage>\n\nexport function createAdapter(backend: ResolvedBackend): StorageAdapter {\n  if (backend.type === 'local') {\n    return new LocalStorageAdapter(backend.path)\n  }\n  return new S3StorageAdapter({\n    bucket: backend.bucket,\n    region: backend.region,\n    accessKeyId: backend.accessKeyId,\n    secretAccessKey: backend.secretAccessKey,\n    endpoint: backend.endpoint,\n    publicUrl: backend.publicUrl,\n  })\n}\n\nexport function createBucketStorages(\n  resolved: ResolvedStorageBuckets,\n  factory: StorageAdapterFactory = createAdapter,\n): BucketStorageRegistry {\n  const registry: BucketStorageRegistry = new Map()\n  for (const [name, bucket] of resolved.buckets) {\n    registry.set(name, { bucket, adapter: factory(bucket.backend, bucket) })\n  }\n  return registry\n}\n"]}

package/dist/storage/s3.d.ts

@@ -0,0 +1,35 @@
+import type { PresignGetOptions, PresignPutOptions, StorageAdapter } from './index.js';
+type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+interface S3Config {
+    bucket: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    endpoint?: string;
+    publicUrl?: string;
+    /** Injected in tests; defaults to the global fetch. */
+    fetch?: Fetch;
+}
+export declare class S3StorageAdapter implements StorageAdapter {
+    private readonly base;
+    private readonly credentials;
+    private readonly publicUrl?;
+    private readonly fetchFn;
+    constructor(cfg: S3Config);
+    private objectUrl;
+    private send;
+    upload(fileId: string, data: Blob | ArrayBuffer, contentType: string): Promise<void>;
+    get(fileId: string): Promise<Response>;
+    delete(fileId: string): Promise<void>;
+    exists(fileId: string): Promise<boolean>;
+    stat(key: string): Promise<{
+        size: number;
+        contentType: string;
+    } | null>;
+    list(prefix: string): Promise<string[]>;
+    presignPut(key: string, opts: PresignPutOptions): Promise<string>;
+    presignGet(key: string, opts: PresignGetOptions): Promise<string>;
+    publicUrlFor(key: string): string | undefined;
+}
+export {};
+//# sourceMappingURL=s3.d.ts.map

package/dist/storage/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/storage/s3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACf,MAAM,SAAS,CAAA;AAIhB,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,UAAU,QAAQ;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,KAAK,CAAC,EAAE,KAAK,CAAA;CACd;AAWD,qBAAa,gBAAiB,YAAW,cAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAO;gBAEnB,GAAG,EAAE,QAAQ;IAczB,OAAO,CAAC,SAAS;YAIH,IAAI;IAgBZ,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,GAAG,WAAW,EACxB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAYV,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IActC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,IAAI,CACR,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IASlD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4BvC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IASjE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IASvE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAI9C"}

package/dist/storage/s3.js

@@ -0,0 +1,125 @@
+import { presignUrl, signRequest } from './sigv4.js';
+function decodeXml(value) {
+    return value
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, '&');
+}
+export class S3StorageAdapter {
+    base;
+    credentials;
+    publicUrl;
+    fetchFn;
+    constructor(cfg) {
+        const endpoint = (cfg.endpoint ?? `https://s3.${cfg.region}.amazonaws.com`).replace(/\/$/, '');
+        this.base = `${endpoint}/${cfg.bucket}`;
+        this.credentials = {
+            accessKeyId: cfg.accessKeyId,
+            secretAccessKey: cfg.secretAccessKey,
+            region: cfg.region,
+        };
+        this.publicUrl = cfg.publicUrl;
+        this.fetchFn = cfg.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    }
+    objectUrl(key) {
+        return `${this.base}/${key.split('/').map(encodeURIComponent).join('/')}`;
+    }
+    async send(method, url, body, headers = {}) {
+        const signed = await signRequest({
+            method,
+            url,
+            headers,
+            body: body ?? null,
+            credentials: this.credentials,
+        });
+        return this.fetchFn(url, { method, headers: signed, body });
+    }
+    async upload(fileId, data, contentType) {
+        const bytes = data instanceof Blob ? await data.arrayBuffer() : data;
+        const res = await this.send('PUT', this.objectUrl(fileId), bytes, {
+            'content-type': contentType,
+        });
+        if (!res.ok) {
+            throw new Error(`[workerstack] S3 upload failed (${res.status}): ${await res.text()}`);
+        }
+    }
+    async get(fileId) {
+        const res = await this.send('GET', this.objectUrl(fileId));
+        if (res.status === 404)
+            return new Response('Not found', { status: 404 });
+        if (!res.ok) {
+            throw new Error(`[workerstack] S3 get failed (${res.status})`);
+        }
+        return new Response(res.body, {
+            headers: {
+                'Content-Type': res.headers.get('content-type') || 'application/octet-stream',
+            },
+        });
+    }
+    async delete(fileId) {
+        const res = await this.send('DELETE', this.objectUrl(fileId));
+        if (!res.ok && res.status !== 404) {
+            throw new Error(`[workerstack] S3 delete failed (${res.status})`);
+        }
+    }
+    async exists(fileId) {
+        return (await this.stat(fileId)) !== null;
+    }
+    async stat(key) {
+        const res = await this.send('HEAD', this.objectUrl(key));
+        if (!res.ok)
+            return null;
+        return {
+            size: Number(res.headers.get('content-length') ?? 0),
+            contentType: res.headers.get('content-type') ?? '',
+        };
+    }
+    async list(prefix) {
+        const keys = [];
+        let token;
+        do {
+            const url = new URL(this.base);
+            url.searchParams.set('list-type', '2');
+            url.searchParams.set('prefix', prefix);
+            if (token)
+                url.searchParams.set('continuation-token', token);
+            const res = await this.send('GET', url.toString());
+            if (!res.ok) {
+                throw new Error(`[workerstack] S3 list failed (${res.status})`);
+            }
+            const xml = await res.text();
+            for (const match of xml.matchAll(/<Key>([\s\S]*?)<\/Key>/g)) {
+                keys.push(decodeXml(match[1]));
+            }
+            token = /<IsTruncated>true<\/IsTruncated>/.test(xml)
+                ? decodeXml(/<NextContinuationToken>([\s\S]*?)<\/NextContinuationToken>/.exec(xml)?.[1] ?? '')
+                : undefined;
+        } while (token);
+        return keys;
+    }
+    // The content type is not signed: confirmUpload checks the stored type.
+    async presignPut(key, opts) {
+        return presignUrl({
+            method: 'PUT',
+            url: this.objectUrl(key),
+            credentials: this.credentials,
+            expiresIn: opts.expiresIn,
+        });
+    }
+    async presignGet(key, opts) {
+        return presignUrl({
+            method: 'GET',
+            url: this.objectUrl(key),
+            credentials: this.credentials,
+            expiresIn: opts.expiresIn,
+        });
+    }
+    publicUrlFor(key) {
+        if (!this.publicUrl)
+            return undefined;
+        return `${this.publicUrl.replace(/\/$/, '')}/${key}`;
+    }
+}
+//# sourceMappingURL=s3.js.map

package/dist/storage/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../src/storage/s3.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAyB,MAAM,SAAS,CAAA;AAexE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAQ;IACZ,WAAW,CAAkB;IAC7B,SAAS,CAAS;IAClB,OAAO,CAAO;IAE/B,YAAY,GAAa;QACvB,MAAM,QAAQ,GAAG,CACf,GAAG,CAAC,QAAQ,IAAI,cAAc,GAAG,CAAC,MAAM,gBAAgB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG;YACjB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAA;QACD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAA;QAC9B,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAC9E,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3E,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAc,EACd,GAAW,EACX,IAAkB,EAClB,UAAkC,EAAE;QAEpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,MAAM;YACN,GAAG;YACH,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,IAAI;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAc,EACd,IAAwB,EACxB,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;YAChE,cAAc,EAAE,WAAW;SAC5B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CACtE,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;YAC5B,OAAO,EAAE;gBACP,cAAc,EACZ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;aAChE;SACF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAW;QAEX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACpD,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,IAAI,KAAyB,CAAA;QAC7B,GAAG,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YACtC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;YAClD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAA;YACjC,CAAC;YACD,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAClD,CAAC,CAAC,SAAS,CACP,4DAA4D,CAAC,IAAI,CAC/D,GAAG,CACJ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CACb;gBACH,CAAC,CAAC,SAAS,CAAA;QACf,CAAC,QAAQ,KAAK,EAAC;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAuB;QACnD,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAuB;QACnD,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAA;QACrC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAA;IACtD,CAAC;CACF","sourcesContent":["// src/storage/s3.ts — S3 on fetch + SigV4, so the adapter runs outside Bun.\nimport type {\n  PresignGetOptions,\n  PresignPutOptions,\n  StorageAdapter,\n} from './index'\n\nimport { presignUrl, signRequest, type SigV4Credentials } from './sigv4'\n\ntype Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n\ninterface S3Config {\n  bucket: string\n  region: string\n  accessKeyId: string\n  secretAccessKey: string\n  endpoint?: string\n  publicUrl?: string\n  /** Injected in tests; defaults to the global fetch. */\n  fetch?: Fetch\n}\n\nfunction decodeXml(value: string): string {\n  return value\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&apos;/g, \"'\")\n    .replace(/&amp;/g, '&')\n}\n\nexport class S3StorageAdapter implements StorageAdapter {\n  private readonly base: string\n  private readonly credentials: SigV4Credentials\n  private readonly publicUrl?: string\n  private readonly fetchFn: Fetch\n\n  constructor(cfg: S3Config) {\n    const endpoint = (\n      cfg.endpoint ?? `https://s3.${cfg.region}.amazonaws.com`\n    ).replace(/\\/$/, '')\n    this.base = `${endpoint}/${cfg.bucket}`\n    this.credentials = {\n      accessKeyId: cfg.accessKeyId,\n      secretAccessKey: cfg.secretAccessKey,\n      region: cfg.region,\n    }\n    this.publicUrl = cfg.publicUrl\n    this.fetchFn = cfg.fetch ?? ((input, init) => globalThis.fetch(input, init))\n  }\n\n  private objectUrl(key: string): string {\n    return `${this.base}/${key.split('/').map(encodeURIComponent).join('/')}`\n  }\n\n  private async send(\n    method: string,\n    url: string,\n    body?: ArrayBuffer,\n    headers: Record<string, string> = {},\n  ): Promise<Response> {\n    const signed = await signRequest({\n      method,\n      url,\n      headers,\n      body: body ?? null,\n      credentials: this.credentials,\n    })\n    return this.fetchFn(url, { method, headers: signed, body })\n  }\n\n  async upload(\n    fileId: string,\n    data: Blob | ArrayBuffer,\n    contentType: string,\n  ): Promise<void> {\n    const bytes = data instanceof Blob ? await data.arrayBuffer() : data\n    const res = await this.send('PUT', this.objectUrl(fileId), bytes, {\n      'content-type': contentType,\n    })\n    if (!res.ok) {\n      throw new Error(\n        `[workerstack] S3 upload failed (${res.status}): ${await res.text()}`,\n      )\n    }\n  }\n\n  async get(fileId: string): Promise<Response> {\n    const res = await this.send('GET', this.objectUrl(fileId))\n    if (res.status === 404) return new Response('Not found', { status: 404 })\n    if (!res.ok) {\n      throw new Error(`[workerstack] S3 get failed (${res.status})`)\n    }\n    return new Response(res.body, {\n      headers: {\n        'Content-Type':\n          res.headers.get('content-type') || 'application/octet-stream',\n      },\n    })\n  }\n\n  async delete(fileId: string): Promise<void> {\n    const res = await this.send('DELETE', this.objectUrl(fileId))\n    if (!res.ok && res.status !== 404) {\n      throw new Error(`[workerstack] S3 delete failed (${res.status})`)\n    }\n  }\n\n  async exists(fileId: string): Promise<boolean> {\n    return (await this.stat(fileId)) !== null\n  }\n\n  async stat(\n    key: string,\n  ): Promise<{ size: number; contentType: string } | null> {\n    const res = await this.send('HEAD', this.objectUrl(key))\n    if (!res.ok) return null\n    return {\n      size: Number(res.headers.get('content-length') ?? 0),\n      contentType: res.headers.get('content-type') ?? '',\n    }\n  }\n\n  async list(prefix: string): Promise<string[]> {\n    const keys: string[] = []\n    let token: string | undefined\n    do {\n      const url = new URL(this.base)\n      url.searchParams.set('list-type', '2')\n      url.searchParams.set('prefix', prefix)\n      if (token) url.searchParams.set('continuation-token', token)\n      const res = await this.send('GET', url.toString())\n      if (!res.ok) {\n        throw new Error(`[workerstack] S3 list failed (${res.status})`)\n      }\n      const xml = await res.text()\n      for (const match of xml.matchAll(/<Key>([\\s\\S]*?)<\\/Key>/g)) {\n        keys.push(decodeXml(match[1]!))\n      }\n      token = /<IsTruncated>true<\\/IsTruncated>/.test(xml)\n        ? decodeXml(\n            /<NextContinuationToken>([\\s\\S]*?)<\\/NextContinuationToken>/.exec(\n              xml,\n            )?.[1] ?? '',\n          )\n        : undefined\n    } while (token)\n    return keys\n  }\n\n  // The content type is not signed: confirmUpload checks the stored type.\n  async presignPut(key: string, opts: PresignPutOptions): Promise<string> {\n    return presignUrl({\n      method: 'PUT',\n      url: this.objectUrl(key),\n      credentials: this.credentials,\n      expiresIn: opts.expiresIn,\n    })\n  }\n\n  async presignGet(key: string, opts: PresignGetOptions): Promise<string> {\n    return presignUrl({\n      method: 'GET',\n      url: this.objectUrl(key),\n      credentials: this.credentials,\n      expiresIn: opts.expiresIn,\n    })\n  }\n\n  publicUrlFor(key: string): string | undefined {\n    if (!this.publicUrl) return undefined\n    return `${this.publicUrl.replace(/\\/$/, '')}/${key}`\n  }\n}\n"]}

package/dist/storage/sigv4.d.ts

@@ -0,0 +1,24 @@
+export type SigV4Credentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    region: string;
+    service?: string;
+};
+export declare function signRequest(input: {
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    body?: ArrayBuffer | Uint8Array<ArrayBuffer> | string | null;
+    credentials: SigV4Credentials;
+    date?: Date;
+    unsignedPayload?: boolean;
+}): Promise<Record<string, string>>;
+export declare function presignUrl(input: {
+    method: string;
+    url: string;
+    credentials: SigV4Credentials;
+    expiresIn: number;
+    date?: Date;
+    signedHeaders?: Record<string, string>;
+}): Promise<string>;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/storage/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/sigv4.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAiGD,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAC5D,WAAW,EAAE,gBAAgB,CAAA;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgClC;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,gBAAgB,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC,GAAG,OAAO,CAAC,MAAM,CAAC,CAiClB"}