@blamejs/core 0.6.36 → 0.6.58

package/lib/mtls-engine-default.js

@@ -424,10 +424,50 @@ function algorithmEnvelope() {
   };
 }
 
+// Generate a signed X.509 CRL (RFC 5280) covering every revoked
+// serial number. The vendored peculiar/x509 library exposes
+// X509CrlGenerator.create which builds the TBSCertList, populates
+// the entries, and signs with the CA private key — same signature
+// algorithm the CA itself was issued under (auto-detected via
+// _selectAlgorithm + cached on first issuance).
+async function generateCrl(opts) {
+  opts = opts || {};
+  if (!opts.caCertPem || !opts.caKeyPem) {
+    throw new MtlsEngineError("mtls-engine/missing-arg",
+      "generateCrl requires { caCertPem, caKeyPem, revocations, thisUpdate, nextUpdate }");
+  }
+  var revocations = Array.isArray(opts.revocations) ? opts.revocations : [];
+  var alg = await _selectAlgorithm();
+  CA_KEY_ALG = alg.keyAlg; CA_SIG_ALG = alg.sigAlg;
+
+  var caKey  = await _importPemPrivateKey(opts.caKeyPem, CA_KEY_ALG, ["sign"]);
+  var caCert = _parseCertPem(opts.caCertPem);
+
+  // X509CrlEntry expects { serialNumber: hex, revocationDate, reason }.
+  var entries = revocations.map(function (r) {
+    return {
+      serialNumber:    r.serialNumber,
+      revocationDate:  new Date(r.revokedAt || Date.now()),
+      reason:          (typeof r.reasonCode === "number") ? r.reasonCode : 0,
+    };
+  });
+
+  var crl = await x509.X509CrlGenerator.create({
+    issuer:           caCert.subject,
+    thisUpdate:       opts.thisUpdate || new Date(),
+    nextUpdate:       opts.nextUpdate,
+    entries:          entries,
+    signingAlgorithm: CA_SIG_ALG,
+    signingKey:       caKey,
+  });
+  return crl.toString("pem");
+}
+
 module.exports = {
   generateCa:         generateCa,
   signClientCert:     signClientCert,
   packageP12:         packageP12,
+  generateCrl:        generateCrl,
   algorithmEnvelope:  algorithmEnvelope,
   MtlsEngineError:    MtlsEngineError,
 };

package/lib/object-store/azure-blob-bucket-ops.js

@@ -0,0 +1,291 @@
+"use strict";
+/**
+ * azure-blob-bucket-ops — container-level operations for Azure Blob.
+ *
+ * Per-blob ops (put / get / list / delete) live in
+ * `lib/object-store/azure-blob.js` and are bound to a single container
+ * at create() time. Container lifecycle ops are at a different level —
+ * a service-scoped client that addresses arbitrary containers — so
+ * they get their own factory.
+ *
+ *   create(name, opts?)        async; PUT  /{container}?restype=container
+ *   delete(name)               async; DELETE /{container}?restype=container
+ *   list(opts?)                async; GET  /?comp=list
+ *                              -> [{ name, lastModified, etag,
+ *                                    leaseStatus, leaseState, publicAccess }]
+ *   setCorsRules(rules)        async; PUT  /?restype=service&comp=properties
+ *                              account-level CORS — Azure has no
+ *                              per-container CORS.
+ *
+ * Shared Key auth via `lib/object-store/azure-blob.js`'s `signRequest`
+ * helper. Not implemented here:
+ *
+ *   setLifecycle(name, rules) — Azure Storage lifecycle management
+ *     policies live on Azure Resource Manager
+ *     (`management.azure.com`), not the Blob service endpoint. ARM
+ *     requires an Azure AD bearer token (Service Principal flow), a
+ *     different auth scheme entirely. Operators wiring lifecycle do
+ *     so via Terraform / Bicep / az CLI; the framework documents the
+ *     gap rather than half-implementing one auth path.
+ */
+var azureBlob = require("./azure-blob");
+var httpClient = require("../http-client");
+var safeUrl = require("../safe-url");
+var { ObjectStoreError } = require("../framework-error");
+
+var _err = ObjectStoreError.factory;
+
+// Azure container names: 3-63 chars, lowercase alphanumeric + hyphens,
+// no consecutive hyphens, must start and end with letter or digit.
+var CONTAINER_NAME_RE = /^[a-z0-9](?:[a-z0-9]|-(?!-))*[a-z0-9]$/;
+
+function _validateContainerName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw _err("BUCKET_INVALID_NAME",
+      "azure-blob bucketOps: container name must be a non-empty string", true);
+  }
+  if (name.length < 3 || name.length > 63) {
+    throw _err("BUCKET_INVALID_NAME",
+      "azure-blob bucketOps: container name must be 3-63 chars (got " +
+      name.length + ")", true);
+  }
+  if (!CONTAINER_NAME_RE.test(name)) {
+    throw _err("BUCKET_INVALID_NAME",
+      "azure-blob bucketOps: container name '" + name + "' is invalid; " +
+      "lowercase letters / digits / hyphens only, no consecutive hyphens, " +
+      "must start and end with letter or digit", true);
+  }
+}
+
+function _validateCorsRule(rule, idx) {
+  function bad(msg) {
+    throw _err("INVALID_CORS_RULE",
+      "azure-blob bucketOps: setCorsRules: rule[" + idx + "]: " + msg, true);
+  }
+  if (!rule || typeof rule !== "object") bad("must be an object");
+  if (!Array.isArray(rule.allowedOrigins) || rule.allowedOrigins.length === 0) {
+    bad("allowedOrigins must be a non-empty array");
+  }
+  if (!Array.isArray(rule.allowedMethods) || rule.allowedMethods.length === 0) {
+    bad("allowedMethods must be a non-empty array");
+  }
+  for (var i = 0; i < rule.allowedMethods.length; i++) {
+    var m = rule.allowedMethods[i];
+    if (["GET", "PUT", "POST", "DELETE", "HEAD", "MERGE", "OPTIONS"].indexOf(m) === -1) {
+      bad("allowedMethods[" + i + "] = " + JSON.stringify(m) +
+          " (must be one of GET/PUT/POST/DELETE/HEAD/MERGE/OPTIONS)");
+    }
+  }
+  if (rule.allowedHeaders !== undefined && !Array.isArray(rule.allowedHeaders)) {
+    bad("allowedHeaders, if present, must be an array");
+  }
+  if (rule.exposedHeaders !== undefined && !Array.isArray(rule.exposedHeaders)) {
+    bad("exposedHeaders, if present, must be an array");
+  }
+  if (rule.maxAgeInSeconds !== undefined &&
+      (typeof rule.maxAgeInSeconds !== "number" || rule.maxAgeInSeconds < 0 ||
+       !Number.isFinite(rule.maxAgeInSeconds))) {
+    bad("maxAgeInSeconds, if present, must be a non-negative finite number");
+  }
+}
+
+function _xmlEscape(s) {
+  return String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function _buildCorsXml(rules) {
+  var inner = rules.map(function (rule) {
+    var parts = [
+      "<CorsRule>",
+      "<AllowedOrigins>" + _xmlEscape(rule.allowedOrigins.join(",")) + "</AllowedOrigins>",
+      "<AllowedMethods>" + rule.allowedMethods.join(",") + "</AllowedMethods>",
+      "<AllowedHeaders>" + _xmlEscape((rule.allowedHeaders || []).join(",")) + "</AllowedHeaders>",
+      "<ExposedHeaders>" + _xmlEscape((rule.exposedHeaders || []).join(",")) + "</ExposedHeaders>",
+      "<MaxAgeInSeconds>" +
+        (rule.maxAgeInSeconds == null ? 0 : Math.floor(rule.maxAgeInSeconds)) +
+        "</MaxAgeInSeconds>",
+      "</CorsRule>",
+    ];
+    return parts.join("");
+  }).join("");
+  return '<?xml version="1.0" encoding="utf-8"?>' +
+         "<StorageServiceProperties><Cors>" + inner + "</Cors></StorageServiceProperties>";
+}
+
+// Tiny XML extractor — pulls every occurrence of <Tag>value</Tag>
+// and returns an array of value strings. Sufficient for the limited
+// shapes we read (Containers list, container metadata).
+function _extractAll(xml, tag) {
+  var out = [];
+  var re = new RegExp("<" + tag + ">([\\s\\S]*?)</" + tag + ">", "g");
+  var m;
+  while ((m = re.exec(xml)) !== null) out.push(m[1]);
+  return out;
+}
+
+function _extractBlocks(xml, tag) {
+  var open = "<" + tag + ">";
+  var close = "</" + tag + ">";
+  var blocks = [];
+  var i = 0;
+  while (true) {
+    var s = xml.indexOf(open, i);
+    if (s === -1) break;
+    var e = xml.indexOf(close, s + open.length);
+    if (e === -1) break;
+    blocks.push(xml.slice(s + open.length, e));
+    i = e + close.length;
+  }
+  return blocks;
+}
+
+function create(config) {
+  if (!config) throw _err("BAD_OPT", "azure-blob bucketOps: config required", true);
+  if (!config.accountName) throw _err("BAD_OPT", "azure-blob bucketOps: accountName required", true);
+  if (!config.accountKey)  throw _err("BAD_OPT", "azure-blob bucketOps: accountKey required", true);
+
+  var endpoint = config.endpoint ||
+                 ("https://" + config.accountName + ".blob.core.windows.net");
+  if (endpoint.endsWith("/")) endpoint = endpoint.slice(0, -1);
+  var apiVersion = config.apiVersion || azureBlob.DEFAULT_API_VERSION;
+  var timeoutMs = config.timeoutMs;
+  var allowedProtocols = config.allowedProtocols || safeUrl.ALLOW_HTTP_TLS;
+  var allowInternal = config.allowInternal != null ? config.allowInternal : null;
+
+  function _sign(method, url, headers) {
+    return azureBlob.signRequest({
+      method:      method,
+      url:         url,
+      headers:     headers || {},
+      accountName: config.accountName,
+      accountKey:  config.accountKey,
+      apiVersion:  apiVersion,
+    }).headers;
+  }
+
+  function _request(method, url, headers, body, expectStatus) {
+    var reqOpts = {
+      method:           method,
+      url:              url,
+      headers:          headers,
+      body:             body,
+      idleTimeoutMs:    timeoutMs,
+      allowedProtocols: allowedProtocols,
+      errorClass:       ObjectStoreError,
+    };
+    if (allowInternal !== null) reqOpts.allowInternal = allowInternal;
+    // http-client rejects on any 4xx/5xx by default. The bucket-ops API
+    // semantically accepts certain non-2xx codes (404 for "missing on
+    // delete", 409 for "container already exists"), so we catch those
+    // and surface them as the wrapped response object instead.
+    return httpClient.request(reqOpts).then(function (res) {
+      if (expectStatus && expectStatus.indexOf(res.statusCode) === -1) {
+        throw _err("UNEXPECTED_STATUS",
+          "azure-blob bucketOps: " + method + " " + url +
+          " returned HTTP " + res.statusCode, true);
+      }
+      return res;
+    }, function (e) {
+      var sc = e && e.statusCode;
+      if (sc && expectStatus && expectStatus.indexOf(sc) !== -1) {
+        return { statusCode: sc, headers: {}, body: Buffer.alloc(0) };
+      }
+      throw e;
+    });
+  }
+
+  async function createContainer(name, opts) {
+    _validateContainerName(name);
+    opts = opts || {};
+    var url = new URL(endpoint + "/" + name + "?restype=container");
+    var headers = { "Content-Length": "0" };
+    if (opts.publicAccess) {
+      if (opts.publicAccess !== "blob" && opts.publicAccess !== "container") {
+        throw _err("BAD_OPT",
+          "azure-blob bucketOps: createContainer: publicAccess must be " +
+          "'blob' or 'container' (got " + JSON.stringify(opts.publicAccess) + ")", true);
+      }
+      headers["x-ms-blob-public-access"] = opts.publicAccess;
+    }
+    var signed = _sign("PUT", url, headers);
+    var res = await _request("PUT", url, signed, null, [201, 409]);
+    if (res.statusCode === 409) {
+      throw _err("BUCKET_ALREADY_OWNED",
+        "azure-blob bucketOps: container '" + name +
+        "' already exists or was recently deleted", true);
+    }
+    return { name: name };
+  }
+
+  async function deleteContainer(name) {
+    _validateContainerName(name);
+    var url = new URL(endpoint + "/" + name + "?restype=container");
+    var signed = _sign("DELETE", url, {});
+    var res = await _request("DELETE", url, signed, null, [202, 404]);
+    return res.statusCode === 202;
+  }
+
+  async function listContainers(opts) {
+    opts = opts || {};
+    var url = new URL(endpoint + "/?comp=list");
+    if (opts.prefix)  url.searchParams.set("prefix", opts.prefix);
+    if (opts.maxResults != null) url.searchParams.set("maxresults", String(opts.maxResults));
+    var signed = _sign("GET", url, {});
+    var res = await _request("GET", url, signed, null, [200]);
+    var xml = Buffer.isBuffer(res.body) ? res.body.toString("utf8") :
+              typeof res.body === "string" ? res.body :
+              "";
+    var blocks = _extractBlocks(xml, "Container");
+    return blocks.map(function (block) {
+      return {
+        name:          (_extractAll(block, "Name")[0] || "").trim(),
+        lastModified:  (_extractAll(block, "Last-Modified")[0] || null),
+        etag:          (_extractAll(block, "Etag")[0] || null),
+        leaseStatus:   (_extractAll(block, "LeaseStatus")[0] || null),
+        leaseState:    (_extractAll(block, "LeaseState")[0] || null),
+        publicAccess:  (_extractAll(block, "PublicAccess")[0] || null),
+      };
+    });
+  }
+
+  async function setCorsRules(rules) {
+    if (!Array.isArray(rules)) {
+      throw _err("INVALID_CORS_RULE",
+        "azure-blob bucketOps: setCorsRules: rules must be an array", true);
+    }
+    rules.forEach(_validateCorsRule);
+    var xml = _buildCorsXml(rules);
+    var bodyBuf = Buffer.from(xml, "utf8");
+    var url = new URL(endpoint + "/?restype=service&comp=properties");
+    var headers = {
+      "Content-Type":   "application/xml",
+      "Content-Length": String(bodyBuf.length),
+    };
+    var signed = _sign("PUT", url, headers);
+    await _request("PUT", url, signed, bodyBuf, [202]);
+    return { rulesApplied: rules.length };
+  }
+
+  return {
+    protocol:     "azure-blob",
+    create:       createContainer,
+    delete:       deleteContainer,
+    list:         listContainers,
+    setCorsRules: setCorsRules,
+    setLifecycle: function () {
+      throw _err("NOT_SUPPORTED",
+        "azure-blob bucketOps: setLifecycle is not implemented because " +
+        "Azure Storage lifecycle management policies live on Azure Resource " +
+        "Manager (management.azure.com) and require Azure AD bearer token " +
+        "auth, not Shared Key. Configure lifecycle via Terraform / Bicep / " +
+        "az CLI.", true);
+    },
+  };
+}
+
+module.exports = { create: create };

package/lib/object-store/gcs-bucket-ops.js

@@ -0,0 +1,327 @@
+"use strict";
+/**
+ * gcs-bucket-ops — bucket-level operations for Google Cloud Storage.
+ *
+ * Per-object ops (put / get / list / delete) live in
+ * `lib/object-store/gcs.js` and are bound to a single bucket at
+ * create() time. Bucket lifecycle ops are at a different level — a
+ * project-scoped client that addresses arbitrary buckets — so they
+ * get their own factory.
+ *
+ *   create(name, opts?)         async; POST /storage/v1/b?project={projectId}
+ *                               opts: location ('US' / 'EU' / region) +
+ *                                     storageClass + iamConfiguration
+ *   delete(name)                async; DELETE /storage/v1/b/{name}
+ *   list()                      async; GET  /storage/v1/b?project={projectId}
+ *                               -> [{ name, location, storageClass,
+ *                                     timeCreated, updated }]
+ *   setLifecycle(name, rules)   async; PATCH /storage/v1/b/{name}
+ *                               -> body { lifecycle: { rule: [...] } }
+ *   setCorsRules(name, rules)   async; PATCH /storage/v1/b/{name}
+ *                               -> body { cors: [...] }
+ *
+ * Auth: same service-account JSON / RSA-SHA256-signed JWT exchanged
+ * for an OAuth2 access token as `lib/object-store/gcs.js`.
+ */
+var fs = require("node:fs");
+var gcs = require("./gcs");
+var authHeader = require("../auth-header");
+var httpClient = require("../http-client");
+var safeJson = require("../safe-json");
+var safeUrl = require("../safe-url");
+var C = require("../constants");
+var { ObjectStoreError } = require("../framework-error");
+
+var _err = ObjectStoreError.factory;
+
+// GCS bucket names: 3-63 chars, lowercase letters / digits / hyphens /
+// underscores / dots; can't start or end with hyphen; can't contain '..'
+// or 'goog' prefix; can't be IP address. Most violations the API will
+// reject for us — we sanity-check the basics.
+var BUCKET_NAME_RE = /^[a-z0-9][a-z0-9._-]{1,61}[a-z0-9]$/;
+
+function _validateBucketName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw _err("BUCKET_INVALID_NAME",
+      "gcs bucketOps: bucket name must be a non-empty string", true);
+  }
+  if (name.length < 3 || name.length > 63) {
+    throw _err("BUCKET_INVALID_NAME",
+      "gcs bucketOps: bucket name must be 3-63 chars (got " + name.length + ")", true);
+  }
+  if (!BUCKET_NAME_RE.test(name)) {
+    throw _err("BUCKET_INVALID_NAME",
+      "gcs bucketOps: bucket name '" + name + "' is invalid; lowercase " +
+      "letters / digits / hyphens / underscores / dots only, must start " +
+      "and end with letter or digit", true);
+  }
+  if (name.indexOf("..") !== -1) {
+    throw _err("BUCKET_INVALID_NAME",
+      "gcs bucketOps: bucket name '" + name + "' contains '..'", true);
+  }
+  if (name.indexOf("goog") === 0) {
+    throw _err("BUCKET_INVALID_NAME",
+      "gcs bucketOps: bucket name '" + name + "' starts with 'goog' " +
+      "(reserved by Google)", true);
+  }
+}
+
+// GCS lifecycle rules: { action: { type: "Delete"|"SetStorageClass", storageClass? },
+//                        condition: { age, createdBefore, ...} }
+function _validateLifecycleRule(rule, idx) {
+  function bad(msg) {
+    throw _err("INVALID_LIFECYCLE",
+      "gcs bucketOps: setLifecycle: rule[" + idx + "]: " + msg, true);
+  }
+  if (!rule || typeof rule !== "object") bad("must be an object");
+  if (!rule.action || typeof rule.action !== "object") {
+    bad("action object is required");
+  }
+  if (!rule.action.type) bad("action.type is required");
+  if (rule.action.type !== "Delete" && rule.action.type !== "SetStorageClass" &&
+      rule.action.type !== "AbortIncompleteMultipartUpload") {
+    bad("action.type must be 'Delete' / 'SetStorageClass' / " +
+        "'AbortIncompleteMultipartUpload' (got " +
+        JSON.stringify(rule.action.type) + ")");
+  }
+  if (rule.action.type === "SetStorageClass" && !rule.action.storageClass) {
+    bad("action.storageClass required when action.type='SetStorageClass'");
+  }
+  if (!rule.condition || typeof rule.condition !== "object") {
+    bad("condition object is required");
+  }
+}
+
+function _validateCorsRule(rule, idx) {
+  function bad(msg) {
+    throw _err("INVALID_CORS_RULE",
+      "gcs bucketOps: setCorsRules: rule[" + idx + "]: " + msg, true);
+  }
+  if (!rule || typeof rule !== "object") bad("must be an object");
+  if (!Array.isArray(rule.origin) || rule.origin.length === 0) {
+    bad("origin must be a non-empty array");
+  }
+  if (rule.method !== undefined && !Array.isArray(rule.method)) {
+    bad("method, if present, must be an array");
+  }
+  if (rule.responseHeader !== undefined && !Array.isArray(rule.responseHeader)) {
+    bad("responseHeader, if present, must be an array");
+  }
+  if (rule.maxAgeSeconds !== undefined &&
+      (typeof rule.maxAgeSeconds !== "number" || rule.maxAgeSeconds < 0)) {
+    bad("maxAgeSeconds, if present, must be a non-negative number");
+  }
+}
+
+function create(config) {
+  if (!config) throw _err("BAD_OPT", "gcs bucketOps: config required", true);
+
+  var serviceAccount = config.serviceAccount;
+  if (!serviceAccount && config.serviceAccountFile) {
+    try {
+      serviceAccount = safeJson.parse(fs.readFileSync(config.serviceAccountFile));
+    } catch (e) {
+      throw _err("BAD_OPT", "gcs bucketOps: failed to read serviceAccountFile '" +
+        config.serviceAccountFile + "': " + ((e && e.message) || String(e)), true);
+    }
+  }
+  if (!serviceAccount || !serviceAccount.client_email || !serviceAccount.private_key) {
+    throw _err("BAD_OPT",
+      "gcs bucketOps: serviceAccount with { client_email, private_key } required " +
+      "(or serviceAccountFile pointing to one)", true);
+  }
+  var projectId = config.projectId || serviceAccount.project_id;
+  if (!projectId) {
+    throw _err("BAD_OPT",
+      "gcs bucketOps: projectId required (either config.projectId or " +
+      "serviceAccount.project_id)", true);
+  }
+
+  var endpoint = config.endpoint || gcs.DEFAULT_ENDPOINT;
+  if (endpoint.endsWith("/")) endpoint = endpoint.slice(0, -1);
+  var tokenEndpoint = config.tokenEndpoint || "https://oauth2.googleapis.com/token";
+  // Bucket-level admin needs the full-control scope — list-buckets +
+  // create + delete + lifecycle + CORS are all admin operations beyond
+  // the per-object read_write scope used by gcs.js's per-blob client.
+  var scope = config.scope || "https://www.googleapis.com/auth/devstorage.full_control";
+  var timeoutMs = config.timeoutMs;
+  var allowedProtocols = config.allowedProtocols || safeUrl.ALLOW_HTTP_TLS;
+  var allowInternal = config.allowInternal != null ? config.allowInternal : null;
+
+  // Token cache — same shape as gcs.js's per-blob client, scoped to
+  // this factory instance so a parallel per-blob client doesn't share
+  // the admin-scoped token (different scope).
+  var cachedToken = null;
+  var TOKEN_REFRESH_BUFFER = C.TIME.minutes(5);
+
+  function _request(method, url, headers, body, expectStatus) {
+    var reqOpts = {
+      method:           method,
+      url:              url,
+      headers:          headers,
+      body:             body,
+      idleTimeoutMs:    timeoutMs,
+      allowedProtocols: allowedProtocols,
+      errorClass:       ObjectStoreError,
+    };
+    if (allowInternal !== null) reqOpts.allowInternal = allowInternal;
+    return httpClient.request(reqOpts).then(function (res) {
+      if (expectStatus && expectStatus.indexOf(res.statusCode) === -1) {
+        var bodyText = res.body ?
+          (Buffer.isBuffer(res.body) ? res.body.toString("utf8") : String(res.body)) : "";
+        throw _err("UNEXPECTED_STATUS",
+          "gcs bucketOps: " + method + " " + url + " returned HTTP " +
+          res.statusCode + (bodyText ? " — " + bodyText.slice(0, 500) : ""), true);
+      }
+      return res;
+    }, function (e) {
+      // http-client rejects on 4xx/5xx; if the caller marked the
+      // status as semantically acceptable (404 on delete, 409 on
+      // create) surface it as a normal response.
+      var sc = e && e.statusCode;
+      if (sc && expectStatus && expectStatus.indexOf(sc) !== -1) {
+        return { statusCode: sc, headers: {}, body: Buffer.alloc(0) };
+      }
+      throw e;
+    });
+  }
+
+  async function _ensureToken() {
+    if (cachedToken && Date.now() < cachedToken.expiresAt - TOKEN_REFRESH_BUFFER) {
+      return cachedToken.accessToken;
+    }
+    var assertion = gcs._signJwt(serviceAccount, scope, tokenEndpoint);
+    var bodyStr = "grant_type=" + encodeURIComponent("urn:ietf:params:oauth:grant-type:jwt-bearer") +
+                  "&assertion=" + encodeURIComponent(assertion);
+    var bodyBuf = Buffer.from(bodyStr, "utf8");
+    var res = await _request("POST", new URL(tokenEndpoint), {
+      "Content-Type":   "application/x-www-form-urlencoded",
+      "Content-Length": String(bodyBuf.length),
+    }, bodyBuf, [200]);
+    var tokenResp = safeJson.parse(res.body);
+    if (!tokenResp.access_token) {
+      throw _err("AUTH_FAILED",
+        "gcs bucketOps: token endpoint returned no access_token: " +
+        (res.body ? res.body.toString("utf8") : ""), true);
+    }
+    var expiresInMs = C.TIME.seconds(tokenResp.expires_in || 3600);
+    cachedToken = {
+      accessToken: tokenResp.access_token,
+      expiresAt:   Date.now() + expiresInMs,
+    };
+    return cachedToken.accessToken;
+  }
+
+  function _bucketBaseUrl() {
+    return endpoint + "/storage/v1/b";
+  }
+
+  async function createBucket(name, opts) {
+    _validateBucketName(name);
+    opts = opts || {};
+    var token = await _ensureToken();
+    var url = new URL(_bucketBaseUrl());
+    url.searchParams.set("project", projectId);
+    var bodyObj = { name: name };
+    if (opts.location)     bodyObj.location     = opts.location;
+    if (opts.storageClass) bodyObj.storageClass = opts.storageClass;
+    if (opts.iamConfiguration) bodyObj.iamConfiguration = opts.iamConfiguration;
+    var bodyBuf = Buffer.from(JSON.stringify(bodyObj), "utf8");
+    var headers = Object.assign(authHeader.bearer(token), {
+      "Content-Type":   "application/json",
+      "Content-Length": String(bodyBuf.length),
+    });
+    var res = await _request("POST", url, headers, bodyBuf, [200, 409]);
+    if (res.statusCode === 409) {
+      throw _err("BUCKET_ALREADY_OWNED",
+        "gcs bucketOps: bucket '" + name + "' already exists", true);
+    }
+    var parsed = safeJson.parse(res.body);
+    return {
+      name:         parsed.name,
+      location:     parsed.location || null,
+      storageClass: parsed.storageClass || null,
+    };
+  }
+
+  async function deleteBucket(name) {
+    _validateBucketName(name);
+    var token = await _ensureToken();
+    var url = new URL(_bucketBaseUrl() + "/" + encodeURIComponent(name));
+    var headers = authHeader.bearer(token);
+    var res = await _request("DELETE", url, headers, null, [204, 404]);
+    return res.statusCode === 204;
+  }
+
+  async function listBuckets(opts) {
+    opts = opts || {};
+    var token = await _ensureToken();
+    var url = new URL(_bucketBaseUrl());
+    url.searchParams.set("project", projectId);
+    if (opts.prefix)     url.searchParams.set("prefix", opts.prefix);
+    if (opts.maxResults) url.searchParams.set("maxResults", String(opts.maxResults));
+    if (opts.pageToken)  url.searchParams.set("pageToken", opts.pageToken);
+    var headers = authHeader.bearer(token);
+    var res = await _request("GET", url, headers, null, [200]);
+    var parsed = safeJson.parse(res.body);
+    var items = Array.isArray(parsed.items) ? parsed.items : [];
+    return items.map(function (item) {
+      return {
+        name:         item.name,
+        location:     item.location || null,
+        storageClass: item.storageClass || null,
+        timeCreated:  item.timeCreated || null,
+        updated:      item.updated || null,
+      };
+    });
+  }
+
+  async function setLifecycle(name, rules) {
+    _validateBucketName(name);
+    if (!Array.isArray(rules)) {
+      throw _err("INVALID_LIFECYCLE",
+        "gcs bucketOps: setLifecycle: rules must be an array", true);
+    }
+    rules.forEach(_validateLifecycleRule);
+    var token = await _ensureToken();
+    var url = new URL(_bucketBaseUrl() + "/" + encodeURIComponent(name));
+    var bodyObj = { lifecycle: { rule: rules } };
+    var bodyBuf = Buffer.from(JSON.stringify(bodyObj), "utf8");
+    var headers = Object.assign(authHeader.bearer(token), {
+      "Content-Type":   "application/json",
+      "Content-Length": String(bodyBuf.length),
+    });
+    await _request("PATCH", url, headers, bodyBuf, [200]);
+    return { rulesApplied: rules.length };
+  }
+
+  async function setCorsRules(name, rules) {
+    _validateBucketName(name);
+    if (!Array.isArray(rules)) {
+      throw _err("INVALID_CORS_RULE",
+        "gcs bucketOps: setCorsRules: rules must be an array", true);
+    }
+    rules.forEach(_validateCorsRule);
+    var token = await _ensureToken();
+    var url = new URL(_bucketBaseUrl() + "/" + encodeURIComponent(name));
+    var bodyObj = { cors: rules };
+    var bodyBuf = Buffer.from(JSON.stringify(bodyObj), "utf8");
+    var headers = Object.assign(authHeader.bearer(token), {
+      "Content-Type":   "application/json",
+      "Content-Length": String(bodyBuf.length),
+    });
+    await _request("PATCH", url, headers, bodyBuf, [200]);
+    return { rulesApplied: rules.length };
+  }
+
+  return {
+    protocol:     "gcs",
+    create:       createBucket,
+    delete:       deleteBucket,
+    list:         listBuckets,
+    setLifecycle: setLifecycle,
+    setCorsRules: setCorsRules,
+  };
+}
+
+module.exports = { create: create };