aws-s3

@noy-db/to-aws-s3 · pnpm add @noy-db/to-aws-s3 @aws-sdk/client-s3 Encrypted object storage with zero-knowledge cloud sync.

What it does

Stores one encrypted envelope per record as an S3 object. @aws-sdk/client-s3 is a peer dependency you install and pass in as an S3Client. Also ships s3Bundle() for storing a whole vault as a single bundle rather than record-per-object.

Notes

• prefix must not end in / — the separator is appended for you, and since 0.7.0-pre.0 a trailing slash is refused at construction rather than silently producing double-separator keys. tenant-a and tenant-a/ address different objects, so if a store already holds data under a trailing-slash prefix, copy the objects to the single-separator keys before fixing the config (noy-db-to#109).
• casAtomic: true via conditional writes (IfMatch / IfNoneMatch).
• loadAll() is O(N) requests — fine up to ~10K records; for larger vaults keep indexed records in DynamoDB and route blobs to S3 via routeStore.
• Record shape by default, or bundle shape via s3Bundle(). Factory: toAwsS3(options: S3Options).

Store-locator descriptor

See store-locator descriptors for the general model. kind: 'aws-s3', class: 'cloud'. address is { bucket, region?, prefix? }; options is { clockUncertaintyMs? }. binding.client? carries a pre-built S3Client, which always wins over region/credentials-derived construction — this is to-aws-s3's binding-slot citizen. AWS credentials arrive via a kind: 'aws' StoreCredentialSource at resolve() time, or implicitly via the SDK's default provider chain.

import { s3StoreDescriptor, registerS3Store } from '@noy-db/to-aws-s3'

const descriptor = s3StoreDescriptor({ bucket: 'my-vault', region: 'us-east-1' })

See also

• to-* family
• aws-dynamo
• cloudflare-r2