aws-s3

@noy-db/as-aws-s3 · pnpm add @noy-db/as-aws-s3 Holds blob bytes as native, presigned-or-public S3 objects.

What it does

as-aws-s3 is the one as-* package that is not a vault exporter — it implements the hub's ObjectProjection contract, so blob bytes can be served directly from S3 or a CDN instead of round-tripping through the zero-knowledge store. Where @noy-db/to-aws-s3 is a to-* store (ciphertext envelopes in and out), this projection sees raw bytes and lives outside the zero-knowledge guarantee. Wiring it up is a deliberate, per-field opt-in — only blob fields declared external in a collection's blob config route their bytes here — and it sits outside the exportCapability gate entirely.

Usage

import { asAwsS3 } from '@noy-db/as-aws-s3'

const objects = asAwsS3({ bucket: 'acme-public-assets', region: 'eu-west-1' })

await objects.putObject('logos/acme.png', bytes, { contentType: 'image/png', public: true })
objects.publicUrl('logos/acme.png')                                // stable CDN/S3 URL
await objects.objectUrl('docs/x.pdf')                               // presigned GET (time-limited)
await objects.putUrl('videos/x.mp4', { contentType: 'video/mp4' })  // presigned PUT (direct upload)

Prefer presigned (objectUrl) over public for anything sensitive — public objects are not crypto-shreddable. Requires the peer dependencies @noy-db/hub, @aws-sdk/client-s3, and @aws-sdk/s3-request-presigner.

See also

• as-* family
• noydb — the encrypted, zero-knowledge-preserving alternative