@5ss/ai-tools 2.11.1

package/dist/s3-CsOaPWMP.js

@@ -0,0 +1,955 @@
+import { n as isToolError, t as ToolError } from "./errors-DoSpNHvs.js";
+import { n as defineModule, r as defineTool } from "./define-CvpJ_pNP.js";
+import { n as requireAuth } from "./provider-CgDAlg6K.js";
+import { t as AwsService } from "./aws-service-msttbPrz.js";
+import { a as toArrayBuffer, i as encodeObjectKeyPath, n as bytesToBase64, o as utf8ToBytes, r as bytesToUtf8, t as base64ToBytes } from "./bytes-BxpimpQx.js";
+import { t as batchResultSchema } from "./batch-Co1ujeAW.js";
+import { isNil, isNumber, isPlainObject, isString } from "es-toolkit";
+import { isArray } from "es-toolkit/compat";
+import { z } from "zod";
+import { XMLParser } from "fast-xml-parser";
+//#region src/vendors/_storage/keys.ts
+/**
+* Object-key prefix helpers for storage vendors (S3, Textract DocumentLocation, …).
+* Logical keys are prefix-relative; wire keys include key_prefix when set.
+*/
+/** S3 object key maximum length (bytes, UTF-8). */
+const MAX_OBJECT_KEY_BYTES = 1024;
+function utf8ByteLength(value) {
+	return new TextEncoder().encode(value).byteLength;
+}
+function assertKeyByteLimit(wireKey) {
+	const bytes = utf8ByteLength(wireKey);
+	if (bytes > 1024) throw new ToolError(`Object key exceeds ${MAX_OBJECT_KEY_BYTES} bytes`, {
+		code: "bad_input",
+		details: {
+			max_bytes: MAX_OBJECT_KEY_BYTES,
+			key_bytes: bytes
+		}
+	});
+}
+/**
+* Split a logical path into segments. Rejects parent segments and leading absolute form.
+* Allows names like `report..final.pdf` (only a segment equal to `..` is rejected).
+*/
+function keySegments(value, options = {}) {
+	const trimmed = value.trim().replaceAll("\\", "/");
+	if (trimmed.startsWith("/")) throw new ToolError("Object key must not be absolute (no leading /)", { code: "bad_input" });
+	const trailingSlash = trimmed.endsWith("/");
+	if (trailingSlash && options.allowTrailingSlash !== true) throw new ToolError("Object key must not end with /", { code: "bad_input" });
+	const segments = trimmed.split("/").filter((segment) => segment.length > 0 && segment !== ".");
+	for (const segment of segments) if (segment === "..") throw new ToolError("Object key must not contain parent-directory segments", { code: "bad_input" });
+	if (segments.length === 0 && !options.allowEmpty && !trailingSlash) throw new ToolError("Object key is required", { code: "bad_input" });
+	return {
+		segments,
+		trailingSlash
+	};
+}
+function joinSegments(segments, trailingSlash) {
+	const joined = segments.join("/");
+	if (trailingSlash) return joined.length > 0 ? `${joined}/` : "";
+	return joined;
+}
+function remapAuthError(error) {
+	if (isToolError(error) && error.code === "bad_input") throw new ToolError(error.message.replace(/^Object key/, "key_prefix"), {
+		code: "bad_auth",
+		...error.details !== void 0 && { details: error.details },
+		cause: error
+	});
+	throw error;
+}
+/** Normalize key_prefix from auth: non-absolute, no `..` segments, always ends with `/`. */
+function normalizeKeyPrefix(keyPrefix) {
+	try {
+		const { segments } = keySegments(keyPrefix, {
+			allowEmpty: false,
+			allowTrailingSlash: true
+		});
+		if (segments.length === 0) throw new ToolError("key_prefix must not be empty", { code: "bad_auth" });
+		const root = `${segments.join("/")}/`;
+		assertKeyByteLimit(root);
+		return root;
+	} catch (error) {
+		remapAuthError(error);
+	}
+}
+/**
+* Resolve a logical object key to a wire key.
+* - No prefix: validated logical key (normalized segments).
+* - With prefix: relative keys are rooted; keys already under the prefix are accepted as-is.
+*/
+function resolveObjectKey(logicalKey, keyPrefix) {
+	const { segments } = keySegments(logicalKey, { allowEmpty: false });
+	const logical = joinSegments(segments, false);
+	if (!keyPrefix) {
+		assertKeyByteLimit(logical);
+		return logical;
+	}
+	const wire = logical.startsWith(keyPrefix) ? logical : `${keyPrefix}${logical}`;
+	assertKeyByteLimit(wire);
+	return wire;
+}
+/**
+* Resolve a list prefix filter under optional key_prefix.
+* Empty / omitted relative → bound prefix root (or undefined when unbound).
+*/
+function resolveListPrefix(relativePrefix, keyPrefix) {
+	if (relativePrefix === void 0 || relativePrefix.trim().length === 0) return keyPrefix;
+	const { segments, trailingSlash } = keySegments(relativePrefix, {
+		allowEmpty: true,
+		allowTrailingSlash: true
+	});
+	const logical = joinSegments(segments, trailingSlash);
+	if (!keyPrefix) {
+		if (logical.length === 0) return void 0;
+		assertKeyByteLimit(logical);
+		return logical;
+	}
+	if (logical.length === 0 || logical === keyPrefix.slice(0, -1) || logical === keyPrefix) return keyPrefix;
+	if (logical.startsWith(keyPrefix)) {
+		assertKeyByteLimit(logical);
+		return logical;
+	}
+	const wire = `${keyPrefix}${logical}`;
+	assertKeyByteLimit(wire);
+	return wire;
+}
+/**
+* Map a wire key back to a logical (public) key.
+* Returns undefined when the wire key is outside key_prefix (caller should skip/filter).
+*/
+function toPublicKey(wireKey, keyPrefix) {
+	if (!keyPrefix) return wireKey;
+	if (!wireKey.startsWith(keyPrefix)) return void 0;
+	return wireKey.slice(keyPrefix.length);
+}
+//#endregion
+//#region src/vendors/_storage/schemas.ts
+/**
+* Shared object-store I/O schemas for the s3 vendor pack (and nested S3 bindings).
+* Not published — `_storage` is skipped by codegen.
+*/
+const MAX_OBJECT_BYTES = 5 * 1024 * 1024;
+const DEFAULT_SIGNED_URL_SECONDS = 3600;
+const MAX_SIGNED_URL_SECONDS = 168 * 3600;
+const MAX_MULTIPART_PART_BYTES = 25 * 1024 * 1024;
+const listedObjectSchema = z.object({
+	key: z.string(),
+	size: z.number().optional(),
+	last_modified: z.string().optional(),
+	etag: z.string().optional()
+});
+const listObjectsInputSchema = z.object({
+	prefix: z.string().optional().describe("Key prefix filter"),
+	delimiter: z.string().optional().describe("Delimiter for common prefixes (folders), for example /"),
+	cursor: z.string().min(1).optional().describe("Pagination cursor from a prior list call"),
+	limit: z.int().min(1).max(1e3).optional().describe("Maximum keys to return (1-1000)")
+});
+const listObjectsOutputSchema = z.object({
+	keys: z.array(z.string()).describe("Object keys (convenience list)"),
+	items: z.array(listedObjectSchema).describe("Objects with size, last_modified, and etag when present"),
+	common_prefixes: z.array(z.string()).optional().describe("Common prefixes when delimiter is set"),
+	next_cursor: z.string().optional().describe("Pass as cursor to fetch the next page"),
+	truncated: z.boolean().describe("Whether more results exist")
+});
+const getObjectInputSchema = z.object({
+	key: z.string().min(1).describe("Object key to download"),
+	encoding: z.enum(["base64", "utf8"]).optional().describe("Body encoding. Defaults to base64 for binary safety")
+});
+const getObjectOutputSchema = z.object({
+	key: z.string(),
+	content_type: z.string().optional(),
+	content_length: z.number().optional(),
+	body: z.string().describe("Object body encoded per encoding input"),
+	encoding: z.enum(["base64", "utf8"])
+});
+const putObjectInputSchema = z.object({
+	key: z.string().min(1).describe("Object key to write"),
+	body: z.string().describe("Object body as utf8 text or base64 (see body_encoding)"),
+	body_encoding: z.enum(["utf8", "base64"]).optional().describe("How to interpret body. Defaults to utf8"),
+	content_type: z.string().optional().describe("Content-Type header to store")
+});
+const putObjectOutputSchema = z.object({
+	key: z.string(),
+	etag: z.string().optional(),
+	content_length: z.number().describe("Decoded body byte length uploaded")
+});
+const deleteObjectInputSchema = z.object({ key: z.string().min(1).describe("Object key to delete") });
+const deleteObjectOutputSchema = z.object({
+	key: z.string(),
+	deleted: z.boolean()
+});
+const headObjectInputSchema = z.object({ key: z.string().min(1).describe("Object key to inspect") });
+const headObjectOutputSchema = z.object({
+	key: z.string(),
+	exists: z.boolean(),
+	content_type: z.string().optional(),
+	content_length: z.number().optional(),
+	etag: z.string().optional()
+});
+const copyObjectInputSchema = z.object({
+	source_key: z.string().min(1).describe("Source object key to copy from"),
+	destination_key: z.string().min(1).describe("Destination object key to copy to"),
+	source_bucket: z.string().min(1).optional().describe("Optional source bucket when different from the configured default bucket")
+});
+const copyObjectOutputSchema = z.object({
+	source_key: z.string(),
+	destination_key: z.string(),
+	etag: z.string().optional()
+});
+const signedUrlInputSchema = z.object({
+	key: z.string().min(1).describe("Object key to sign"),
+	method: z.enum([
+		"GET",
+		"PUT",
+		"HEAD",
+		"DELETE"
+	]).optional().describe("HTTP method the URL authorizes. Defaults to GET"),
+	expires_in: z.int().min(1).max(MAX_SIGNED_URL_SECONDS).optional().describe("URL lifetime in seconds (1 to 604800). Defaults to 3600")
+});
+const signedUrlOutputSchema = z.object({
+	url: z.url().describe("Presigned URL"),
+	method: z.enum([
+		"GET",
+		"PUT",
+		"HEAD",
+		"DELETE"
+	]),
+	expires_in: z.int().describe("Lifetime in seconds used when signing")
+});
+const createMultipartUploadInputSchema = z.object({
+	key: z.string().min(1).describe("Object key to create via multipart upload"),
+	content_type: z.string().optional().describe("Content-Type stored on the completed object")
+});
+const createMultipartUploadOutputSchema = z.object({
+	key: z.string(),
+	upload_id: z.string().min(1).describe("Upload id required for subsequent part/complete/abort calls")
+});
+const uploadPartInputSchema = z.object({
+	key: z.string().min(1).describe("Object key for the in-progress multipart upload"),
+	upload_id: z.string().min(1).describe("Upload id from createMultipartUpload"),
+	part_number: z.int().min(1).max(1e4).describe("Part number (1-10000). Must be unique within the upload"),
+	body: z.string().describe("Part body as utf8 text or base64 (see body_encoding)"),
+	body_encoding: z.enum(["utf8", "base64"]).optional().describe("How to interpret body. Defaults to utf8")
+});
+const uploadPartOutputSchema = z.object({
+	key: z.string(),
+	upload_id: z.string(),
+	part_number: z.int(),
+	etag: z.string().min(1).describe("Part ETag required when completing the multipart upload"),
+	content_length: z.number().describe("Decoded part byte length uploaded")
+});
+const multipartUploadedPartSchema = z.object({
+	part_number: z.int().min(1).max(1e4).describe("Uploaded part number from s3-upload-part"),
+	etag: z.string().min(1).describe("ETag returned by uploadPart (with or without surrounding quotes)")
+});
+const completeMultipartUploadInputSchema = z.object({
+	key: z.string().min(1).describe("Object key for the in-progress multipart upload"),
+	upload_id: z.string().min(1).describe("Upload id from createMultipartUpload"),
+	parts: z.array(multipartUploadedPartSchema).min(1).max(1e4).describe("Uploaded parts with part_number and etag, in any order (sorted before complete)")
+});
+const completeMultipartUploadOutputSchema = z.object({
+	key: z.string(),
+	upload_id: z.string(),
+	etag: z.string().optional().describe("Final object ETag when the store returns one")
+});
+const abortMultipartUploadInputSchema = z.object({
+	key: z.string().min(1).describe("Object key for the in-progress multipart upload"),
+	upload_id: z.string().min(1).describe("Upload id from createMultipartUpload")
+});
+const abortMultipartUploadOutputSchema = z.object({
+	key: z.string(),
+	upload_id: z.string(),
+	aborted: z.boolean()
+});
+z.object({
+	keys: z.array(z.string().min(1)).min(1).max(25).describe("Object keys to download"),
+	encoding: z.enum(["base64", "utf8"]).optional().describe("Body encoding for each item. Defaults to base64")
+});
+z.object({ objects: z.array(putObjectInputSchema).min(1).max(25).describe("Objects to upload") });
+z.object({ keys: z.array(z.string().min(1)).min(1).max(25).describe("Object keys to delete") });
+batchResultSchema(getObjectOutputSchema);
+batchResultSchema(putObjectOutputSchema);
+batchResultSchema(deleteObjectOutputSchema);
+//#endregion
+//#region src/vendors/s3/contracts.ts
+/**
+* S3 / S3-compatible vendor auth + re-exports of shared object-store I/O.
+*/
+const s3AuthSchema = z.object({
+	access_key_id: z.string().min(1).describe("S3 access key id"),
+	secret_access_key: z.string().min(1).describe("S3 secret access key"),
+	region: z.string().min(1).describe("AWS region, or auto / us-east-1 for R2 S3 endpoint"),
+	bucket: z.string().min(1).describe("Default bucket name"),
+	endpoint: z.url().optional().describe("S3-compatible endpoint when not AWS (R2: https://<account_id>.r2.cloudflarestorage.com, MinIO, …)"),
+	session_token: z.string().min(1).optional().describe("Optional session token for temporary credentials"),
+	key_prefix: z.string().min(1).optional().describe("Optional object-key root for this binding (no leading slash). Logical keys are relative to this prefix; wire keys include it. Host tenant scoping binds once here.")
+});
+//#endregion
+//#region src/vendors/s3/domain.ts
+/**
+* S3 URL building + XML response parse (fast-xml-parser).
+*/
+const listParser = new XMLParser({
+	ignoreAttributes: true,
+	trimValues: true,
+	isArray: (name) => name === "Contents" || name === "CommonPrefixes"
+});
+const genericParser = new XMLParser({
+	ignoreAttributes: true,
+	trimValues: true
+});
+function objectUrl(auth, key, query) {
+	const encodedKey = encodeObjectKeyPath(key);
+	const base = auth.endpoint ? `${auth.endpoint.replace(/\/+$/, "")}/${encodeURIComponent(auth.bucket)}/${encodedKey}` : `https://${auth.bucket}.s3.${auth.region}.amazonaws.com/${encodedKey}`;
+	return query ? `${base}?${query}` : base;
+}
+function listUrl(auth, params) {
+	const base = auth.endpoint ? `${auth.endpoint.replace(/\/+$/, "")}/${encodeURIComponent(auth.bucket)}` : `https://${auth.bucket}.s3.${auth.region}.amazonaws.com`;
+	const qs = params.toString();
+	return qs ? `${base}?${qs}` : base;
+}
+function copySourceHeader(auth, sourceKey, sourceBucket) {
+	const bucket = sourceBucket ?? auth.bucket;
+	return `/${encodeURIComponent(bucket)}/${encodeObjectKeyPath(sourceKey)}`;
+}
+function stripEtagQuotes(etag) {
+	return etag.replaceAll("\"", "");
+}
+/** Parse `Content-Range: bytes start-end/total` → total object size when known. */
+function contentRangeTotal(header) {
+	if (header === null || header.length === 0) return void 0;
+	const slash = header.lastIndexOf("/");
+	if (slash < 0) return void 0;
+	const totalRaw = header.slice(slash + 1).trim();
+	if (totalRaw === "*" || totalRaw.length === 0) return void 0;
+	const total = Number.parseInt(totalRaw, 10);
+	return Number.isFinite(total) ? total : void 0;
+}
+function asArray(value) {
+	if (value === void 0 || value === null) return [];
+	return isArray(value) ? value : [value];
+}
+function textValue(value) {
+	if (isString(value) && value.length > 0) return value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value === "boolean") return value ? "true" : "false";
+}
+function numberValue(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (isString(value) && value.length > 0) {
+		const n = Number.parseInt(value, 10);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/** Parse ListObjectsV2 XML into list items + pagination. */
+function parseListResult(xml) {
+	const doc = listParser.parse(xml);
+	const root = isPlainObject(doc) && isPlainObject(doc["ListBucketResult"]) ? doc["ListBucketResult"] : isPlainObject(doc) ? doc : null;
+	if (!root) return {
+		items: [],
+		truncated: false
+	};
+	const items = [];
+	for (const row of asArray(root["Contents"])) {
+		if (!isPlainObject(row)) continue;
+		const key = textValue(row["Key"]);
+		if (!key) continue;
+		const size = numberValue(row["Size"]);
+		const last_modified = textValue(row["LastModified"]);
+		const etagRaw = textValue(row["ETag"]);
+		const etag = etagRaw ? stripEtagQuotes(etagRaw) : void 0;
+		items.push({
+			key,
+			...size !== void 0 && { size },
+			...last_modified && { last_modified },
+			...etag && { etag }
+		});
+	}
+	const truncatedRaw = root["IsTruncated"];
+	const truncated = truncatedRaw === true || truncatedRaw === "true" || isString(truncatedRaw) && truncatedRaw.toLowerCase() === "true";
+	const next = textValue(root["NextContinuationToken"]);
+	const common_prefixes = [];
+	for (const row of asArray(root["CommonPrefixes"])) {
+		if (!isPlainObject(row)) continue;
+		const prefix = textValue(row["Prefix"]);
+		if (prefix) common_prefixes.push(prefix);
+	}
+	return {
+		items,
+		truncated,
+		...next && { next_cursor: next },
+		...common_prefixes.length > 0 && { common_prefixes }
+	};
+}
+/** First text value for a tag anywhere in a small S3 XML body (ETag, UploadId, …). */
+function firstXmlText(xml, tag) {
+	return findTagText(genericParser.parse(xml), tag);
+}
+function findTagText(node, tag) {
+	if (!isPlainObject(node)) return void 0;
+	if (Object.hasOwn(node, tag)) {
+		const direct = textValue(node[tag]);
+		if (direct) return direct;
+	}
+	for (const value of Object.values(node)) {
+		const found = findTagText(value, tag);
+		if (found) return found;
+	}
+}
+//#endregion
+//#region src/vendors/s3/client.ts
+/**
+* S3 / S3-compatible object-store client (AwsService SigV4).
+* Host: `new S3Client(auth)`. Agent tools: `fromContext(ctx)`.
+*
+* When auth.key_prefix is set, public API keys are logical (prefix-relative);
+* wire keys always include the prefix. Resolve once; private methods take wire keys.
+*/
+function objectNotFound() {
+	throw new ToolError("Object not found", { code: "not_found" });
+}
+function remapNotFound(error) {
+	if (isToolError(error) && error.code === "not_found") objectNotFound();
+	throw error;
+}
+function tooLarge(maxBytes, contentLength, message, cause) {
+	throw new ToolError(message, {
+		code: "too_large",
+		details: {
+			max_bytes: maxBytes,
+			content_length: contentLength
+		},
+		...cause !== void 0 && { cause }
+	});
+}
+function assertByteLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new ToolError("Download limit must be a non-negative safe integer", { code: "bad_input" });
+}
+var S3Client = class S3Client {
+	#auth;
+	#aws;
+	/** Normalized key_prefix with trailing `/`, or undefined when unbound. */
+	#keyPrefix;
+	constructor(auth, options = {}) {
+		const parsed = s3AuthSchema.safeParse(auth);
+		if (!parsed.success) throw new ToolError("Invalid S3 auth credentials", {
+			code: "bad_auth",
+			details: { issues: parsed.error.issues.map((issue) => issue.message) }
+		});
+		this.#auth = parsed.data;
+		this.#keyPrefix = parsed.data.key_prefix !== void 0 ? normalizeKeyPrefix(parsed.data.key_prefix) : void 0;
+		const awsOptions = {
+			accessKeyId: this.#auth.access_key_id,
+			secretAccessKey: this.#auth.secret_access_key,
+			region: this.#auth.region,
+			service: "s3",
+			label: "S3"
+		};
+		if (options.fetch) awsOptions.fetch = options.fetch;
+		if (options.signal) awsOptions.signal = options.signal;
+		if (this.#auth.session_token) awsOptions.sessionToken = this.#auth.session_token;
+		this.#aws = new AwsService(awsOptions);
+	}
+	static fromContext(ctx) {
+		const auth = requireAuth(ctx, s3AuthSchema);
+		const options = {};
+		if (ctx.fetch) options.fetch = ctx.fetch;
+		if (ctx.signal) options.signal = ctx.signal;
+		return new S3Client(auth, options);
+	}
+	#resolve(logicalKey) {
+		return resolveObjectKey(logicalKey, this.#keyPrefix);
+	}
+	#publicKey(wireKey) {
+		const publicKey = toPublicKey(wireKey, this.#keyPrefix);
+		if (publicKey === void 0) throw new ToolError("Object key is outside the bound key_prefix", { code: "bad_input" });
+		return publicKey;
+	}
+	/** Source key for copy: scoped only when same bucket as this client. */
+	#resolveCopySourceKey(sourceKey, sourceBucket) {
+		if (sourceBucket === void 0 || sourceBucket === this.#auth.bucket) return this.#resolve(sourceKey);
+		return resolveObjectKey(sourceKey, void 0);
+	}
+	async list(input) {
+		const prefix = resolveListPrefix(input.prefix, this.#keyPrefix);
+		const params = new URLSearchParams({ "list-type": "2" });
+		if (prefix !== void 0) params.set("prefix", prefix);
+		if (input.delimiter) params.set("delimiter", input.delimiter);
+		if (input.cursor) params.set("continuation-token", input.cursor);
+		if (input.limit !== void 0) params.set("max-keys", String(input.limit));
+		const { bytes } = await this.#aws.bytes("GET", listUrl(this.#auth, params), { label: "S3 list" });
+		const listed = parseListResult(bytesToUtf8(bytes));
+		const items = [];
+		const keys = [];
+		for (const obj of listed.items) {
+			const publicKey = toPublicKey(obj.key, this.#keyPrefix);
+			if (publicKey === void 0) continue;
+			keys.push(publicKey);
+			items.push({
+				key: publicKey,
+				...obj.size !== void 0 && { size: obj.size },
+				...obj.last_modified && { last_modified: obj.last_modified },
+				...obj.etag && { etag: obj.etag }
+			});
+		}
+		const out = {
+			keys,
+			items,
+			truncated: listed.truncated
+		};
+		if (listed.common_prefixes && listed.common_prefixes.length > 0) {
+			const common = [];
+			for (const folderAbs of listed.common_prefixes) {
+				const publicPrefix = toPublicKey(folderAbs, this.#keyPrefix);
+				if (publicPrefix !== void 0) common.push(publicPrefix);
+			}
+			if (common.length > 0) out.common_prefixes = common;
+		}
+		if (listed.next_cursor) out.next_cursor = listed.next_cursor;
+		return out;
+	}
+	/** HEAD size gate plus a bounded Range GET (wire key only). */
+	async #getBoundedWire(wireKey, maxBytes, limitMessage) {
+		assertByteLimit(maxBytes);
+		const head = await this.#headWire(wireKey);
+		if (!head.exists) objectNotFound();
+		if (!isNil(head.content_length) && head.content_length > maxBytes) tooLarge(maxBytes, head.content_length, limitMessage);
+		if (head.content_length === 0) {
+			const headers = new Headers({ "content-length": "0" });
+			if (head.content_type) headers.set("content-type", head.content_type);
+			if (head.etag) headers.set("etag", `"${head.etag}"`);
+			return {
+				bytes: /* @__PURE__ */ new Uint8Array(),
+				headers,
+				head
+			};
+		}
+		const headers = { Range: `bytes=0-${maxBytes}` };
+		if (head.etag) headers["If-Match"] = head.etag.startsWith("\"") ? head.etag : `"${head.etag}"`;
+		let response;
+		try {
+			response = await this.#aws.bytes("GET", objectUrl(this.#auth, wireKey), {
+				label: "S3 get",
+				headers,
+				maxBytes
+			});
+		} catch (error) {
+			if (isToolError(error) && error.code === "too_large") {
+				const observed = error.details?.["content_length"];
+				tooLarge(maxBytes, isNumber(observed) && Number.isFinite(observed) ? observed : maxBytes + 1, limitMessage, error);
+			}
+			if (isToolError(error) && error.details?.["status"] === 412) throw new ToolError("Object changed during download", {
+				code: "upstream",
+				details: {
+					status: 412,
+					key: this.#publicKey(wireKey)
+				},
+				cause: error
+			});
+			remapNotFound(error);
+		}
+		const total = contentRangeTotal(response.headers.get("content-range"));
+		if (total !== void 0 && total > maxBytes) tooLarge(maxBytes, total, limitMessage);
+		return {
+			bytes: response.bytes,
+			headers: response.headers,
+			head
+		};
+	}
+	async #headWire(wireKey) {
+		const response = await this.#aws.head(objectUrl(this.#auth, wireKey), {
+			label: "S3 head",
+			allowStatuses: [404]
+		});
+		const publicKey = this.#publicKey(wireKey);
+		if (response.status === 404) return {
+			key: publicKey,
+			exists: false
+		};
+		const contentType = response.headers.get("content-type");
+		const lengthHeader = response.headers.get("content-length");
+		const etag = response.headers.get("etag");
+		const contentLength = isString(lengthHeader) ? Number.parseInt(lengthHeader, 10) : void 0;
+		const out = {
+			key: publicKey,
+			exists: true
+		};
+		if (isString(contentType)) out.content_type = contentType;
+		if (!isNil(contentLength) && Number.isFinite(contentLength)) out.content_length = contentLength;
+		if (isString(etag)) out.etag = stripEtagQuotes(etag);
+		return out;
+	}
+	async get(input) {
+		const wireKey = this.#resolve(input.key);
+		const { bytes: bodyBytes, headers: responseHeaders, head } = await this.#getBoundedWire(wireKey, MAX_OBJECT_BYTES, "Object exceeds 5 MiB download limit");
+		const encoding = input.encoding ?? "base64";
+		const body = encoding === "utf8" ? bytesToUtf8(bodyBytes) : bytesToBase64(bodyBytes);
+		const contentType = responseHeaders.get("content-type") ?? head.content_type;
+		const lengthHeader = responseHeaders.get("content-length");
+		const contentLength = isString(lengthHeader) ? Number.parseInt(lengthHeader, 10) : head.content_length;
+		const out = {
+			key: this.#publicKey(wireKey),
+			body,
+			encoding
+		};
+		if (isString(contentType)) out.content_type = contentType;
+		out.content_length = !isNil(head.content_length) && Number.isFinite(head.content_length) ? head.content_length : isNil(contentLength) || !Number.isFinite(contentLength) ? bodyBytes.byteLength : contentLength;
+		return out;
+	}
+	async put(input) {
+		const wireKey = this.#resolve(input.key);
+		const bodyBytes = (input.body_encoding ?? "utf8") === "base64" ? base64ToBytes(input.body) : utf8ToBytes(input.body);
+		if (bodyBytes.byteLength > 5242880) throw new ToolError("Object exceeds 5 MiB upload limit", {
+			code: "too_large",
+			details: {
+				max_bytes: MAX_OBJECT_BYTES,
+				content_length: bodyBytes.byteLength
+			}
+		});
+		const headers = {};
+		if (input.content_type) headers["Content-Type"] = input.content_type;
+		const etag = (await this.#aws.put(objectUrl(this.#auth, wireKey), toArrayBuffer(bodyBytes), {
+			label: "S3 put",
+			headers
+		})).headers.get("etag");
+		const out = {
+			key: this.#publicKey(wireKey),
+			content_length: bodyBytes.byteLength
+		};
+		if (isString(etag)) out.etag = stripEtagQuotes(etag);
+		return out;
+	}
+	async delete(input) {
+		const wireKey = this.#resolve(input.key);
+		await this.#aws.delete(objectUrl(this.#auth, wireKey), {
+			label: "S3 delete",
+			allowStatuses: [404]
+		});
+		return {
+			key: this.#publicKey(wireKey),
+			deleted: true
+		};
+	}
+	async head(input) {
+		return this.#headWire(this.#resolve(input.key));
+	}
+	async copy(input) {
+		const destWire = this.#resolve(input.destination_key);
+		const sourceWire = this.#resolveCopySourceKey(input.source_key, input.source_bucket);
+		const response = await this.#aws.bytes("PUT", objectUrl(this.#auth, destWire), {
+			label: "S3 copy",
+			headers: { "x-amz-copy-source": copySourceHeader(this.#auth, sourceWire, input.source_bucket) }
+		});
+		const etagRaw = firstXmlText(bytesToUtf8(response.bytes), "ETag");
+		const headerEtag = response.headers.get("etag");
+		const etag = etagRaw ? stripEtagQuotes(etagRaw) : isString(headerEtag) ? stripEtagQuotes(headerEtag) : void 0;
+		const out = {
+			source_key: input.source_bucket === void 0 || input.source_bucket === this.#auth.bucket ? this.#publicKey(sourceWire) : sourceWire,
+			destination_key: this.#publicKey(destWire)
+		};
+		if (etag) out.etag = etag;
+		return out;
+	}
+	async createSignedUrl(input) {
+		const wireKey = this.#resolve(input.key);
+		const method = input.method ?? "GET";
+		const expiresIn = input.expires_in ?? 3600;
+		const url = objectUrl(this.#auth, wireKey, `X-Amz-Expires=${expiresIn}`);
+		return {
+			url: (await this.#aws.sign(url, {
+				method,
+				signQuery: true
+			})).url,
+			method,
+			expires_in: expiresIn
+		};
+	}
+	async createMultipartUpload(input) {
+		const wireKey = this.#resolve(input.key);
+		const headers = {};
+		if (input.content_type) headers["Content-Type"] = input.content_type;
+		const { bytes } = await this.#aws.bytes("POST", objectUrl(this.#auth, wireKey, "uploads"), {
+			label: "S3 create multipart upload",
+			headers
+		});
+		const uploadIdRaw = firstXmlText(bytesToUtf8(bytes), "UploadId");
+		if (!uploadIdRaw) throw new ToolError("S3 create multipart upload returned no UploadId", { code: "upstream" });
+		return {
+			key: this.#publicKey(wireKey),
+			upload_id: uploadIdRaw
+		};
+	}
+	async uploadPart(input) {
+		const wireKey = this.#resolve(input.key);
+		const bodyBytes = (input.body_encoding ?? "utf8") === "base64" ? base64ToBytes(input.body) : utf8ToBytes(input.body);
+		if (bodyBytes.byteLength > 26214400) throw new ToolError("Multipart part exceeds 25 MiB upload limit", {
+			code: "too_large",
+			details: {
+				max_bytes: MAX_MULTIPART_PART_BYTES,
+				content_length: bodyBytes.byteLength
+			}
+		});
+		if (bodyBytes.byteLength === 0) throw new ToolError("Multipart part body must not be empty", { code: "bad_input" });
+		const query = new URLSearchParams({
+			partNumber: String(input.part_number),
+			uploadId: input.upload_id
+		});
+		const etagHeader = (await this.#aws.put(objectUrl(this.#auth, wireKey, query.toString()), toArrayBuffer(bodyBytes), { label: "S3 upload part" })).headers.get("etag");
+		if (!isString(etagHeader) || etagHeader.length === 0) throw new ToolError("S3 upload part returned no ETag", { code: "upstream" });
+		return {
+			key: this.#publicKey(wireKey),
+			upload_id: input.upload_id,
+			part_number: input.part_number,
+			etag: stripEtagQuotes(etagHeader),
+			content_length: bodyBytes.byteLength
+		};
+	}
+	async completeMultipartUpload(input) {
+		const wireKey = this.#resolve(input.key);
+		const body = `<CompleteMultipartUpload>${[...input.parts].sort((a, b) => a.part_number - b.part_number).map((part) => {
+			const etag = stripEtagQuotes(part.etag);
+			return `<Part><PartNumber>${part.part_number}</PartNumber><ETag>"${etag}"</ETag></Part>`;
+		}).join("")}</CompleteMultipartUpload>`;
+		const query = new URLSearchParams({ uploadId: input.upload_id });
+		const response = await this.#aws.bytes("POST", objectUrl(this.#auth, wireKey, query.toString()), {
+			label: "S3 complete multipart upload",
+			body,
+			headers: { "Content-Type": "application/xml" }
+		});
+		const etagRaw = firstXmlText(bytesToUtf8(response.bytes), "ETag");
+		const headerEtag = response.headers.get("etag");
+		const etag = etagRaw ? stripEtagQuotes(etagRaw) : isString(headerEtag) ? stripEtagQuotes(headerEtag) : void 0;
+		const out = {
+			key: this.#publicKey(wireKey),
+			upload_id: input.upload_id
+		};
+		if (etag) out.etag = etag;
+		return out;
+	}
+	async abortMultipartUpload(input) {
+		const wireKey = this.#resolve(input.key);
+		const query = new URLSearchParams({ uploadId: input.upload_id });
+		await this.#aws.delete(objectUrl(this.#auth, wireKey, query.toString()), {
+			label: "S3 abort multipart upload",
+			allowStatuses: [404]
+		});
+		return {
+			key: this.#publicKey(wireKey),
+			upload_id: input.upload_id,
+			aborted: true
+		};
+	}
+	/** Host-facing raw download. Pass `maxBytes` to enforce a hard download cap. Logical key when key_prefix is set. */
+	async getBytes(key, options = {}) {
+		const wireKey = this.#resolve(key);
+		const maxBytes = options.maxBytes;
+		if (maxBytes !== void 0) {
+			const { bytes } = await this.#getBoundedWire(wireKey, maxBytes, "Object exceeds download limit");
+			return bytes;
+		}
+		try {
+			const { bytes } = await this.#aws.bytes("GET", objectUrl(this.#auth, wireKey), { label: "S3 get" });
+			return bytes;
+		} catch (error) {
+			remapNotFound(error);
+		}
+	}
+	async getBytesRange(key, range) {
+		const wireKey = this.#resolve(key);
+		const requestedBytes = range.end_byte - range.start_byte + 1;
+		if (!Number.isSafeInteger(range.start_byte) || !Number.isSafeInteger(range.end_byte) || range.start_byte < 0 || requestedBytes < 1) throw new ToolError("Byte range must use non-negative inclusive offsets with end_byte >= start_byte", { code: "bad_input" });
+		if (requestedBytes > 5242880) tooLarge(MAX_OBJECT_BYTES, requestedBytes, "Byte range exceeds download limit");
+		const head = await this.#headWire(wireKey);
+		if (!head.exists) objectNotFound();
+		if (head.content_length !== void 0 && range.start_byte >= head.content_length) throw new ToolError("Byte range starts beyond the end of the object", {
+			code: "bad_input",
+			details: {
+				start_byte: range.start_byte,
+				content_length: head.content_length
+			}
+		});
+		const headers = { Range: `bytes=${range.start_byte}-${range.end_byte}` };
+		if (head.etag) headers["If-Match"] = head.etag.startsWith("\"") ? head.etag : `"${head.etag}"`;
+		let response;
+		try {
+			response = await this.#aws.bytes("GET", objectUrl(this.#auth, wireKey), {
+				label: "S3 range get",
+				headers,
+				maxBytes: requestedBytes
+			});
+		} catch (error) {
+			if (isToolError(error) && error.details?.["status"] === 412) throw new ToolError("Object changed during download", {
+				code: "upstream",
+				details: {
+					status: 412,
+					key: this.#publicKey(wireKey)
+				},
+				cause: error
+			});
+			remapNotFound(error);
+		}
+		const out = {
+			bytes: response.bytes,
+			start_byte: range.start_byte,
+			end_byte: range.start_byte + response.bytes.byteLength - 1
+		};
+		const totalBytes = contentRangeTotal(response.headers.get("content-range")) ?? head.content_length;
+		const contentType = response.headers.get("content-type") ?? head.content_type;
+		if (totalBytes !== void 0) out.total_bytes = totalBytes;
+		if (contentType) out.content_type = contentType;
+		return out;
+	}
+	/** Host-facing raw upload. Logical key when key_prefix is set. */
+	async putBytes(key, bytes, contentType) {
+		const wireKey = this.#resolve(key);
+		const headers = {};
+		if (isString(contentType) && contentType.length > 0) headers["Content-Type"] = contentType;
+		await this.#aws.put(objectUrl(this.#auth, wireKey), toArrayBuffer(bytes), {
+			label: "S3 put",
+			headers
+		});
+	}
+};
+//#endregion
+//#region src/vendors/s3/module.ts
+const s3ListObjectsTool = defineTool({
+	id: "s3-list-objects",
+	name: "s3ListObjects",
+	description: "List objects in the bound S3 bucket. Use prefix, delimiter, cursor, and limit for filtered pagination. Returns keys, items with metadata, next_cursor, and truncated.",
+	inputSchema: listObjectsInputSchema,
+	outputSchema: listObjectsOutputSchema,
+	sideEffect: "read",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).list(input)
+});
+const s3GetObjectTool = defineTool({
+	id: "s3-get-object",
+	name: "s3GetObject",
+	description: "Download one object by key from S3. Bodies larger than 5 MiB fail. Returns body as base64 by default or utf8 when requested.",
+	inputSchema: getObjectInputSchema,
+	outputSchema: getObjectOutputSchema,
+	sideEffect: "read",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).get(input)
+});
+const s3PutObjectTool = defineTool({
+	id: "s3-put-object",
+	name: "s3PutObject",
+	description: "Upload or replace one object by key in S3. Provide utf8 text or base64 body. Bodies larger than 5 MiB fail.",
+	inputSchema: putObjectInputSchema,
+	outputSchema: putObjectOutputSchema,
+	sideEffect: "write",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).put(input)
+});
+const s3DeleteObjectTool = defineTool({
+	id: "s3-delete-object",
+	name: "s3DeleteObject",
+	description: "Delete one object by key in S3. Idempotent for missing keys (404 treated as success).",
+	inputSchema: deleteObjectInputSchema,
+	outputSchema: deleteObjectOutputSchema,
+	sideEffect: "delete",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).delete(input)
+});
+const s3HeadObjectTool = defineTool({
+	id: "s3-head-object",
+	name: "s3HeadObject",
+	description: "Inspect S3 object metadata by key without downloading the body. Returns exists flag plus content type, length, and ETag when present.",
+	inputSchema: headObjectInputSchema,
+	outputSchema: headObjectOutputSchema,
+	sideEffect: "read",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).head(input)
+});
+const s3CopyObjectTool = defineTool({
+	id: "s3-copy-object",
+	name: "s3CopyObject",
+	description: "Copy one S3 object to a new key. Set source_bucket only for an allowed cross-bucket copy; otherwise the configured bucket is used.",
+	inputSchema: copyObjectInputSchema,
+	outputSchema: copyObjectOutputSchema,
+	sideEffect: "write",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).copy(input)
+});
+const s3CreateSignedUrlTool = defineTool({
+	id: "s3-create-signed-url",
+	name: "s3CreateSignedUrl",
+	description: "Create a time-limited presigned S3 URL for one object key. Defaults to GET for 3600 seconds.",
+	inputSchema: signedUrlInputSchema,
+	outputSchema: signedUrlOutputSchema,
+	sideEffect: "none",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).createSignedUrl(input)
+});
+const s3CreateMultipartUploadTool = defineTool({
+	id: "s3-create-multipart-upload",
+	name: "s3CreateMultipartUpload",
+	description: "Start an S3 multipart upload for one object key. Returns upload_id for uploadPart/complete/abort. Use for objects larger than the single put limit.",
+	inputSchema: createMultipartUploadInputSchema,
+	outputSchema: createMultipartUploadOutputSchema,
+	sideEffect: "write",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).createMultipartUpload(input)
+});
+const s3UploadPartTool = defineTool({
+	id: "s3-upload-part",
+	name: "s3UploadPart",
+	description: "Upload one part of an in-progress S3 multipart upload. Part bodies up to 25 MiB. S3 requires each part except the last to be at least 5 MiB. Returns etag required for completeMultipartUpload.",
+	inputSchema: uploadPartInputSchema,
+	outputSchema: uploadPartOutputSchema,
+	sideEffect: "write",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).uploadPart(input)
+});
+const s3CompleteMultipartUploadTool = defineTool({
+	id: "s3-complete-multipart-upload",
+	name: "s3CompleteMultipartUpload",
+	description: "Finish an S3 multipart upload by assembling uploaded parts (part_number + etag). Parts may be supplied in any order; they are sorted by part_number before complete.",
+	inputSchema: completeMultipartUploadInputSchema,
+	outputSchema: completeMultipartUploadOutputSchema,
+	sideEffect: "write",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).completeMultipartUpload(input)
+});
+const s3AbortMultipartUploadTool = defineTool({
+	id: "s3-abort-multipart-upload",
+	name: "s3AbortMultipartUpload",
+	description: "Abort an in-progress S3 multipart upload and discard uploaded parts for that upload_id.",
+	inputSchema: abortMultipartUploadInputSchema,
+	outputSchema: abortMultipartUploadOutputSchema,
+	sideEffect: "delete",
+	runtime: "both",
+	execute: async (input, ctx) => S3Client.fromContext(ctx).abortMultipartUpload(input)
+});
+const s3Module = defineModule({
+	id: "s3",
+	title: "S3 / S3-compatible",
+	description: "Store and retrieve objects with S3-compatible storage. Use for object listing, reads, writes, metadata, copies, deletion, signed URLs, and multipart uploads.",
+	runtime: "both",
+	auth: {
+		type: "custom",
+		schema: s3AuthSchema
+	},
+	categories: ["storage", "aws"],
+	classification: "pii",
+	tags: ["object-store"],
+	tools: [
+		s3ListObjectsTool,
+		s3GetObjectTool,
+		s3PutObjectTool,
+		s3DeleteObjectTool,
+		s3HeadObjectTool,
+		s3CopyObjectTool,
+		s3CreateSignedUrlTool,
+		s3CreateMultipartUploadTool,
+		s3UploadPartTool,
+		s3CompleteMultipartUploadTool,
+		s3AbortMultipartUploadTool
+	]
+});
+//#endregion
+export { getObjectOutputSchema as A, uploadPartOutputSchema as B, copyObjectInputSchema as C, deleteObjectInputSchema as D, createMultipartUploadOutputSchema as E, putObjectInputSchema as F, resolveObjectKey as H, putObjectOutputSchema as I, signedUrlInputSchema as L, headObjectOutputSchema as M, listObjectsInputSchema as N, deleteObjectOutputSchema as O, listObjectsOutputSchema as P, signedUrlOutputSchema as R, completeMultipartUploadOutputSchema as S, createMultipartUploadInputSchema as T, normalizeKeyPrefix as V, MAX_OBJECT_BYTES as _, s3CreateSignedUrlTool as a, abortMultipartUploadOutputSchema as b, s3HeadObjectTool as c, s3PutObjectTool as d, s3UploadPartTool as f, MAX_MULTIPART_PART_BYTES as g, DEFAULT_SIGNED_URL_SECONDS as h, s3CreateMultipartUploadTool as i, headObjectInputSchema as j, getObjectInputSchema as k, s3ListObjectsTool as l, s3AuthSchema as m, s3CompleteMultipartUploadTool as n, s3DeleteObjectTool as o, S3Client as p, s3CopyObjectTool as r, s3GetObjectTool as s, s3AbortMultipartUploadTool as t, s3Module as u, MAX_SIGNED_URL_SECONDS as v, copyObjectOutputSchema as w, completeMultipartUploadInputSchema as x, abortMultipartUploadInputSchema as y, uploadPartInputSchema as z };
+
+//# sourceMappingURL=s3-CsOaPWMP.js.map