@cloudbitmaps/s3 0.19.0 → 0.20.0

package/README.md

@@ -44,7 +44,7 @@ It builds its own client from your usual AWS credentials. Any other key is refus
 | `maxSockets` | most sockets the client you do not pass opens at once, for `https` and plain `http` alike; a positive integer, default 128 (the SDK's own is 50; if a future SDK changes its handler, the built client keeps the SDK's own limit); refused beside `client` |
 | `partBytes`, `maxObjectBytes` | multipart sizing: part size (default 8 MiB; the upload buffers one part at a time) and the largest object (about 80 GiB by default, up to S3's 5 TiB). A cap above 5 TiB, or a part above S3's 5 GiB part limit, is a `ValidationError` |
 | `readTimeoutMs` | how long one read (a `GetObject` or `HeadObject`, its body included) may take before it throws `TransientError` and the store retries it; `0`, the default, sets no timeout. Writes are not timed |
-| `conditionalDelete` | whether the registry removes a deleted row with a `DeleteObject` under `If-Match` rather than leaving a tombstone. On by default when the host the client resolves is an AWS S3 host, however its endpoint was set (`endpoint`, `AWS_ENDPOINT_URL_S3`, `AWS_ENDPOINT_URL`, the shared config file); off for any other host: set it for an S3-compatible store only once you know it applies the header (MinIO ignores it) |
+| `conditionalDelete` | whether the store applies `If-Match` on a `DeleteObject`: the registry then removes a deleted row rather than leaving a tombstone, and the storage half deletes an erasure's holder only while it is the object the erasure read, by its ETag. On by default when the host the client resolves is an AWS S3 host, however its endpoint was set (`endpoint`, `AWS_ENDPOINT_URL_S3`, `AWS_ENDPOINT_URL`, the shared config file); off for any other host: set it for an S3-compatible store only once you know it applies the header (MinIO ignores it) |
 
 ## Before production
 

package/dist/backend.d.ts

@@ -89,11 +89,13 @@ export interface S3StorageOptions {
     /** Injected clock for the registry's `createdAt`/`updatedAt`; defaults to `Date.now`. */
     readonly now?: () => number;
     /**
-     * Whether the registry removes a deleted row for good, by a `DeleteObject` sent with `If-Match`, rather than leaving
-     * a tombstone a full listing reads forever. Defaults to `true` when the host the client resolves is an AWS S3 host,
-     * whichever way its endpoint was set (`endpoint`, `AWS_ENDPOINT_URL_S3`, `AWS_ENDPOINT_URL`, the shared config file),
-     * and to `false` for any other host: set it for an S3-compatible store only once you know the store applies `If-Match`
-     * on a delete. MinIO, for one, ignores it. It is never `true` for an SDK that does not send the header.
+     * Whether the store applies `If-Match` on a `DeleteObject`, which both halves rely on when it is on: the registry
+     * removes a deleted row for good rather than leaving a tombstone a full listing reads forever, and the storage half
+     * removes an erasure's holder only while it is the object the erasure searched, by its ETag. Defaults to `true` when
+     * the host the client resolves is an AWS S3 host, whichever way its endpoint was set (`endpoint`,
+     * `AWS_ENDPOINT_URL_S3`, `AWS_ENDPOINT_URL`, the shared config file), and to `false` for any other host: set it for an
+     * S3-compatible store only once you know the store applies `If-Match` on a delete. MinIO, for one, ignores it. It is
+     * never `true` for an SDK that does not send the header.
      */
     readonly conditionalDelete?: boolean;
 }

package/dist/client-probe.d.ts

@@ -17,6 +17,18 @@ export declare const PROBE_KEY = "cloudbitmaps-probe";
  * found out. Never throws, never sends a request, and never runs anything the caller added to `client`.
  */
 export declare function probeClient(client: S3Client, bucket: string): Promise<ClientFacts | undefined>;
+/**
+ * Whether a `DeleteObject` may rely on `If-Match`, for the registry's row delete and the storage half's conditional
+ * delete alike: `explicit` when the caller set it, but never for an SDK seen not to send the header; otherwise only
+ * when the client resolves to an AWS S3 host, which applies the precondition, and `false` until the client has been
+ * asked, since an S3-compatible store (MinIO, for one) can accept the header and ignore it.
+ */
+export declare function appliesDeleteIfMatch(explicit: boolean | undefined, facts: ClientFacts | undefined): boolean;
+/**
+ * A `conditionalDelete` option, checked: `undefined` leaves the decision to the client ({@link appliesDeleteIfMatch}),
+ * and anything but a boolean is refused.
+ */
+export declare function checkConditionalDelete(value: unknown): boolean | undefined;
 /**
  * Whether `hostname` is an AWS S3 host, by its structure: under an AWS domain, with a label that names S3 (`s3`,
  * `s3-fips`, an access point's, a multi-region access point's `s3-global`, Object Lambda's, an Outpost's, a dash-joined

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/backend.ts
-import { ValidationError as ValidationError5, brandAsBackend } from "@cloudbitmaps/core/driver-kit";
+import { ValidationError as ValidationError6, brandAsBackend } from "@cloudbitmaps/core/driver-kit";
 import { S3Client } from "@aws-sdk/client-s3";
 
 // src/storage.ts
@@ -7,7 +7,7 @@ import {
   IntegrityError,
   NotFoundError as NotFoundError2,
   TransientError as TransientError2,
-  ValidationError as ValidationError3,
+  ValidationError as ValidationError4,
   WriteConflictError,
   isNotFoundError,
   isValidationError,
@@ -18,11 +18,11 @@ import {
   AbortMultipartUploadCommand,
   CompleteMultipartUploadCommand,
   CreateMultipartUploadCommand,
-  DeleteObjectCommand,
+  DeleteObjectCommand as DeleteObjectCommand2,
   GetObjectCommand,
   HeadObjectCommand,
   ListObjectsV2Command,
-  PutObjectCommand,
+  PutObjectCommand as PutObjectCommand2,
   UploadPartCommand
 } from "@aws-sdk/client-s3";
 
@@ -313,6 +313,136 @@ function scrubCredentials(err) {
   return safe;
 }
 
+// src/client-probe.ts
+import { ValidationError as ValidationError3 } from "@cloudbitmaps/core/driver-kit";
+import { DeleteObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
+var PROBE_KEY = "cloudbitmaps-probe";
+var PLACEHOLDER_CREDENTIALS = { accessKeyId: "cloudbitmaps-probe", secretAccessKey: "unused" };
+var NEVER_SENDS = {
+  handle: () => Promise.reject(new Error("the client probe was asked to send a request")),
+  updateHttpClientConfig: () => {
+  },
+  httpHandlerConfigs: () => ({}),
+  destroy: () => {
+  }
+};
+var SILENT_LOGGER = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+function cloneForProbe(client) {
+  const parts = client;
+  if (typeof parts.send !== "function" || typeof parts.config !== "object" || parts.config === null) {
+    return void 0;
+  }
+  if (typeof parts.constructor !== "function" || parts.constructor === Object) return void 0;
+  const Class = parts.constructor;
+  const clone = new Class({
+    ...parts.config,
+    credentials: PLACEHOLDER_CREDENTIALS,
+    requestHandler: NEVER_SENDS,
+    logger: SILENT_LOGGER
+  });
+  return typeof clone.send === "function" && clone.middlewareStack != null ? clone : void 0;
+}
+async function serialise(client, command) {
+  let seen;
+  command.middlewareStack.addRelativeTo(
+    () => (args) => {
+      seen = args.request;
+      return Promise.resolve({ response: {}, output: { $metadata: {} } });
+    },
+    { relation: "after", toMiddleware: "serializerMiddleware", name: "cloudbitmapsProbe" }
+  );
+  const handler = command.resolveMiddleware(client.middlewareStack, client.config, {});
+  await handler(command);
+  if (seen === void 0) throw new Error("the probe saw no request");
+  return seen;
+}
+var hasHeader = (request, name) => request.headers?.[name] !== void 0;
+async function probeClient(client, bucket) {
+  let probe;
+  try {
+    probe = cloneForProbe(client);
+    if (probe === void 0) return void 0;
+    const del = await serialise(
+      probe,
+      new DeleteObjectCommand({ Bucket: bucket, Key: PROBE_KEY, IfMatch: '"probe"' })
+    );
+    const put = await serialise(
+      probe,
+      new PutObjectCommand({
+        Bucket: bucket,
+        Key: PROBE_KEY,
+        Body: new Uint8Array(0),
+        IfMatch: '"probe"',
+        IfNoneMatch: "*"
+      })
+    );
+    if (typeof del.hostname !== "string" || del.hostname === "") return void 0;
+    return {
+      host: del.hostname,
+      sendsDeleteIfMatch: hasHeader(del, "if-match"),
+      sendsPutIfMatch: hasHeader(put, "if-match"),
+      sendsPutIfNoneMatch: hasHeader(put, "if-none-match")
+    };
+  } catch {
+    return void 0;
+  } finally {
+    probe?.destroy();
+  }
+}
+function appliesDeleteIfMatch(explicit, facts) {
+  if (explicit === false) return false;
+  if (explicit === true) return facts?.sendsDeleteIfMatch !== false;
+  return facts !== void 0 && facts.sendsDeleteIfMatch && isAwsS3Host(facts.host);
+}
+function checkConditionalDelete(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "boolean") {
+    throw new ValidationError3(`conditionalDelete must be a boolean; got ${String(value)}`);
+  }
+  return value;
+}
+var AWS_DOMAINS = [".amazonaws.com", ".amazonaws.com.cn"];
+var S3_LABELS = /* @__PURE__ */ new Set([
+  "s3",
+  "s3-fips",
+  "s3-accesspoint",
+  "s3-accesspoint-fips",
+  "s3-global",
+  "s3-object-lambda",
+  "s3-outposts",
+  "s3-external-1"
+]);
+var S3_DASH_REGION_LABEL = /^s3-(fips-)?[a-z]{2}(-gov)?-[a-z]+-\d$/;
+var S3_EXPRESS_LABEL = /^s3express-[a-z0-9-]+$/;
+var REGION_LABEL = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+var isS3Label = (label) => S3_LABELS.has(label) || S3_DASH_REGION_LABEL.test(label) || S3_EXPRESS_LABEL.test(label);
+function isAwsS3Host(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  const domain = AWS_DOMAINS.find((d) => host.endsWith(d));
+  if (domain === void 0) return false;
+  const labels = host.slice(0, -domain.length).split(".");
+  let at = -1;
+  labels.forEach((label, i) => {
+    if (isS3Label(label)) at = i;
+  });
+  if (at === -1) return false;
+  const rest = labels.slice(at + 1);
+  let k = 0;
+  if (rest[k] === "dualstack") k++;
+  if (k < rest.length && REGION_LABEL.test(rest[k])) k++;
+  if (rest[k] === "vpce") k++;
+  return k === rest.length;
+}
+
 // src/storage.ts
 var S3_PART_BYTES = 8 * 1024 * 1024;
 var S3_MAX_PARTS = 1e4;
@@ -333,8 +463,12 @@ var S3StorageDriver = class {
   readTimeoutMs;
   clock;
   sockets;
+  explicitConditionalDelete;
+  probed;
+  facts;
   constructor(options) {
     this.client = options.client;
+    this.explicitConditionalDelete = checkConditionalDelete(options.conditionalDelete);
     this.sockets = options.sockets;
     this.bucket = options.bucket;
     this.prefix = normalizeObjectPrefix(options.prefix);
@@ -344,16 +478,16 @@ var S3StorageDriver = class {
       ["maxObjectBytes", options.maxObjectBytes]
     ]) {
       if (value !== void 0 && (!Number.isSafeInteger(value) || value < 1)) {
-        throw new ValidationError3(`${name} must be a positive safe integer; got ${value}`);
+        throw new ValidationError4(`${name} must be a positive safe integer; got ${value}`);
       }
     }
     if (options.maxObjectBytes !== void 0 && options.maxObjectBytes > S3_MAX_OBJECT_BYTES) {
-      throw new ValidationError3(
+      throw new ValidationError4(
         `maxObjectBytes must be at most S3's 5 TiB object limit (${S3_MAX_OBJECT_BYTES}); got ${options.maxObjectBytes}`
       );
     }
     if (options.partBytes !== void 0 && options.partBytes > S3_MAX_PART_BYTES) {
-      throw new ValidationError3(
+      throw new ValidationError4(
         `partBytes must be at most S3's 5 GiB part limit (${S3_MAX_PART_BYTES}); got ${options.partBytes}`
       );
     }
@@ -363,7 +497,19 @@ var S3StorageDriver = class {
     this.readTimeoutMs = resolveReadTimeoutMs(options.readTimeoutMs);
   }
   capabilities() {
-    return { rangeRead: true, maxObjectBytes: this.maxObjectBytes, conditionalPut: true };
+    return {
+      rangeRead: true,
+      maxObjectBytes: this.maxObjectBytes,
+      conditionalPut: true,
+      conditionalDelete: appliesDeleteIfMatch(this.explicitConditionalDelete, this.facts)
+    };
+  }
+  /** Ask the client once where its requests go and whether it sends `If-Match` on a delete; it sends nothing. */
+  settle() {
+    this.probed ??= probeClient(this.client, this.bucket).then((facts) => {
+      this.facts = facts;
+    });
+    return this.probed;
   }
   async putImmutable(key, write) {
     const objectKey = storageObjectKey(this.prefix, key);
@@ -394,7 +540,7 @@ var S3StorageDriver = class {
   }
   async getRange(key, offset, length) {
     if (!Number.isInteger(offset) || !Number.isInteger(length) || offset < 0 || length < 0) {
-      throw new ValidationError3(`invalid range offset=${offset} length=${length}`);
+      throw new ValidationError4(`invalid range offset=${offset} length=${length}`);
     }
     const objectKey = storageObjectKey(this.prefix, key);
     if (length === 0) return new Uint8Array(0);
@@ -414,7 +560,7 @@ var S3StorageDriver = class {
         res.ContentLength
       );
       if (bytes.length !== length) {
-        throw new ValidationError3(
+        throw new ValidationError4(
           `range [${offset}, ${offset + length}) out of bounds (got ${bytes.length}B)`
         );
       }
@@ -433,7 +579,8 @@ var S3StorageDriver = class {
   async getTail(key, maxBytes) {
     const objectKey = storageObjectKey(this.prefix, key);
     if (maxBytes <= 0) {
-      return { bytes: new Uint8Array(0), size: await this.headSize(key, objectKey) ?? 0 };
+      const head = await this.head(key, objectKey);
+      return withVersion({ bytes: new Uint8Array(0), size: head.size ?? 0 }, head.version);
     }
     const read = await this.read("GetObject", key, async (options) => {
       try {
@@ -451,17 +598,18 @@ var S3StorageDriver = class {
           () => this.badRead(key, "tail", `the response is longer than the ${maxBytes}B requested`),
           res.ContentLength
         );
-        return { bytes: bytes2, contentRange: res.ContentRange };
+        return { bytes: bytes2, contentRange: res.ContentRange, version: res.ETag };
       } catch (err) {
         if (isInvalidRange(err)) return { refused: err };
         throw err;
       }
     });
     if ("refused" in read) {
-      if (await this.headSize(key, objectKey) !== 0) throw this.mapReadError(read.refused, key);
-      return { bytes: new Uint8Array(0), size: 0 };
+      const head = await this.head(key, objectKey);
+      if (head.size !== 0) throw this.mapReadError(read.refused, key);
+      return withVersion({ bytes: new Uint8Array(0), size: 0 }, head.version);
     }
-    const { bytes, contentRange } = read;
+    const { bytes, contentRange, version } = read;
     let size = totalFromContentRange(contentRange);
     if (contentRange !== void 0 && !(size === 0 && bytes.length === 0)) {
       const span = spanFromContentRange(contentRange);
@@ -475,23 +623,26 @@ var S3StorageDriver = class {
       }
     }
     if (size === void 0) {
-      size = bytes.length === maxBytes ? await this.headSize(key, objectKey) ?? bytes.length : bytes.length;
+      size = bytes.length === maxBytes ? (await this.head(key, objectKey)).size ?? bytes.length : bytes.length;
     }
-    return { bytes, size };
+    return withVersion({ bytes, size }, version);
   }
   badRead(key, what, why) {
-    return new ValidationError3(
+    return new ValidationError4(
       `S3 ${what} read of ${key.segment}.${key.generation} refused: ${why}`
     );
   }
-  /** The object's size from a `HeadObject`, or `undefined` when the response does not carry one. */
-  headSize(key, objectKey) {
+  /**
+   * The object's size and ETag from a `HeadObject`, each `undefined` when the response does not carry it. A missing
+   * object throws {@link NotFoundError}.
+   */
+  head(key, objectKey) {
     return this.read("HeadObject", key, async (options) => {
       const head = await this.client.send(
         new HeadObjectCommand({ Bucket: this.bucket, Key: objectKey }),
         options
       );
-      return head.ContentLength;
+      return { size: head.ContentLength, version: head.ETag };
     });
   }
   /**
@@ -509,15 +660,43 @@ var S3StorageDriver = class {
       }
     });
   }
-  async delete(key) {
+  async delete(key, options) {
+    const objectKey = storageObjectKey(this.prefix, key);
+    const ifVersion = options?.ifVersion;
+    if (ifVersion !== void 0 && this.explicitConditionalDelete !== false) await this.settle();
+    const conditional = ifVersion !== void 0 && appliesDeleteIfMatch(this.explicitConditionalDelete, this.facts);
     try {
       await this.client.send(
-        new DeleteObjectCommand({ Bucket: this.bucket, Key: storageObjectKey(this.prefix, key) })
+        new DeleteObjectCommand2({
+          Bucket: this.bucket,
+          Key: objectKey,
+          ...conditional ? { IfMatch: ifVersion } : {}
+        })
       );
-    } catch (err) {
+    } catch (raw) {
+      const err = scrubCredentials(raw);
+      if (conditional) {
+        if (isNotFound(err)) return;
+        if (isConditionalConflict(err)) {
+          if (!await this.exists(key, objectKey)) return;
+          throw new WriteConflictError(
+            `generation ${key.segment}.${key.generation} is another object than the version given; not deleted`
+          );
+        }
+      }
       throw this.mapError(err);
     }
   }
+  /** Whether an object is under the key, from one `HeadObject`. A read that fails in any other way throws. */
+  async exists(key, objectKey) {
+    try {
+      await this.head(key, objectKey);
+      return true;
+    } catch (err) {
+      if (isNotFoundError(err)) return false;
+      throw err;
+    }
+  }
   async *list(ref) {
     const prefix = segmentObjectPrefix(this.prefix, ref);
     let token;
@@ -558,7 +737,7 @@ var S3StorageDriver = class {
       return new NotFoundError2(`no such generation: ${key.segment}.${key.generation}`);
     }
     if (isInvalidRange(err)) {
-      return new ValidationError3(`range out of bounds for ${key.segment}.${key.generation}`);
+      return new ValidationError4(`range out of bounds for ${key.segment}.${key.generation}`);
     }
     return this.mapError(err);
   }
@@ -579,6 +758,9 @@ var S3StorageDriver = class {
     return err;
   }
 };
+function withVersion(tail, version) {
+  return version === void 0 ? tail : { ...tail, version };
+}
 function concatBytes(parts, total) {
   const out = new Uint8Array(total);
   let offset = 0;
@@ -618,7 +800,7 @@ var S3MultipartSink = class {
     if (bytes.length === 0) return;
     this.total += bytes.length;
     if (this.total > this.maxObjectBytes) {
-      throw new ValidationError3(`object exceeds maxObjectBytes ${this.maxObjectBytes}`);
+      throw new ValidationError4(`object exceeds maxObjectBytes ${this.maxObjectBytes}`);
     }
     this.hash.update(bytes);
     this.pending.push(new Uint8Array(bytes));
@@ -646,7 +828,7 @@ var S3MultipartSink = class {
     this.pendingLen = 0;
     this.partNumber += 1;
     if (this.partNumber > S3_MAX_PARTS) {
-      throw new ValidationError3(`multipart upload exceeded the S3 ${S3_MAX_PARTS}-part limit`);
+      throw new ValidationError4(`multipart upload exceeded the S3 ${S3_MAX_PARTS}-part limit`);
     }
     const res = await this.client.send(
       new UploadPartCommand({
@@ -668,7 +850,7 @@ var S3MultipartSink = class {
         "PutObject",
         () => sendOnce(
           this.client,
-          new PutObjectCommand({
+          new PutObjectCommand2({
             Bucket: this.bucket,
             Key: this.objectKey,
             Body: body,
@@ -785,7 +967,7 @@ import {
   MAX_ROW_BYTES,
   ObjectStoreRegistry,
   TransientError as TransientError3,
-  ValidationError as ValidationError4,
+  ValidationError as ValidationError5,
   WriteConflictError as WriteConflictError2,
   normalizeObjectPrefix as normalizeObjectPrefix2
 } from "@cloudbitmaps/core/driver-kit";
@@ -795,125 +977,6 @@ import {
   ListObjectsV2Command as ListObjectsV2Command2,
   PutObjectCommand as PutObjectCommand3
 } from "@aws-sdk/client-s3";
-
-// src/client-probe.ts
-import { DeleteObjectCommand as DeleteObjectCommand2, PutObjectCommand as PutObjectCommand2 } from "@aws-sdk/client-s3";
-var PROBE_KEY = "cloudbitmaps-probe";
-var PLACEHOLDER_CREDENTIALS = { accessKeyId: "cloudbitmaps-probe", secretAccessKey: "unused" };
-var NEVER_SENDS = {
-  handle: () => Promise.reject(new Error("the client probe was asked to send a request")),
-  updateHttpClientConfig: () => {
-  },
-  httpHandlerConfigs: () => ({}),
-  destroy: () => {
-  }
-};
-var SILENT_LOGGER = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
-};
-function cloneForProbe(client) {
-  const parts = client;
-  if (typeof parts.send !== "function" || typeof parts.config !== "object" || parts.config === null) {
-    return void 0;
-  }
-  if (typeof parts.constructor !== "function" || parts.constructor === Object) return void 0;
-  const Class = parts.constructor;
-  const clone = new Class({
-    ...parts.config,
-    credentials: PLACEHOLDER_CREDENTIALS,
-    requestHandler: NEVER_SENDS,
-    logger: SILENT_LOGGER
-  });
-  return typeof clone.send === "function" && clone.middlewareStack != null ? clone : void 0;
-}
-async function serialise(client, command) {
-  let seen;
-  command.middlewareStack.addRelativeTo(
-    () => (args) => {
-      seen = args.request;
-      return Promise.resolve({ response: {}, output: { $metadata: {} } });
-    },
-    { relation: "after", toMiddleware: "serializerMiddleware", name: "cloudbitmapsProbe" }
-  );
-  const handler = command.resolveMiddleware(client.middlewareStack, client.config, {});
-  await handler(command);
-  if (seen === void 0) throw new Error("the probe saw no request");
-  return seen;
-}
-var hasHeader = (request, name) => request.headers?.[name] !== void 0;
-async function probeClient(client, bucket) {
-  let probe;
-  try {
-    probe = cloneForProbe(client);
-    if (probe === void 0) return void 0;
-    const del = await serialise(
-      probe,
-      new DeleteObjectCommand2({ Bucket: bucket, Key: PROBE_KEY, IfMatch: '"probe"' })
-    );
-    const put = await serialise(
-      probe,
-      new PutObjectCommand2({
-        Bucket: bucket,
-        Key: PROBE_KEY,
-        Body: new Uint8Array(0),
-        IfMatch: '"probe"',
-        IfNoneMatch: "*"
-      })
-    );
-    if (typeof del.hostname !== "string" || del.hostname === "") return void 0;
-    return {
-      host: del.hostname,
-      sendsDeleteIfMatch: hasHeader(del, "if-match"),
-      sendsPutIfMatch: hasHeader(put, "if-match"),
-      sendsPutIfNoneMatch: hasHeader(put, "if-none-match")
-    };
-  } catch {
-    return void 0;
-  } finally {
-    probe?.destroy();
-  }
-}
-var AWS_DOMAINS = [".amazonaws.com", ".amazonaws.com.cn"];
-var S3_LABELS = /* @__PURE__ */ new Set([
-  "s3",
-  "s3-fips",
-  "s3-accesspoint",
-  "s3-accesspoint-fips",
-  "s3-global",
-  "s3-object-lambda",
-  "s3-outposts",
-  "s3-external-1"
-]);
-var S3_DASH_REGION_LABEL = /^s3-(fips-)?[a-z]{2}(-gov)?-[a-z]+-\d$/;
-var S3_EXPRESS_LABEL = /^s3express-[a-z0-9-]+$/;
-var REGION_LABEL = /^[a-z]{2}(-[a-z]+)+-\d+$/;
-var isS3Label = (label) => S3_LABELS.has(label) || S3_DASH_REGION_LABEL.test(label) || S3_EXPRESS_LABEL.test(label);
-function isAwsS3Host(hostname) {
-  const host = hostname.toLowerCase().replace(/\.$/, "");
-  const domain = AWS_DOMAINS.find((d) => host.endsWith(d));
-  if (domain === void 0) return false;
-  const labels = host.slice(0, -domain.length).split(".");
-  let at = -1;
-  labels.forEach((label, i) => {
-    if (isS3Label(label)) at = i;
-  });
-  if (at === -1) return false;
-  const rest = labels.slice(at + 1);
-  let k = 0;
-  if (rest[k] === "dualstack") k++;
-  if (k < rest.length && REGION_LABEL.test(rest[k])) k++;
-  if (rest[k] === "vpce") k++;
-  return k === rest.length;
-}
-
-// src/registry.ts
 var S3RegistryStore = class {
   constructor(client, bucket, readTimeoutMs, explicitConditionalDelete) {
     this.client = client;
@@ -934,10 +997,7 @@ var S3RegistryStore = class {
    * vouched for the store.
    */
   get conditionalDelete() {
-    if (this.explicitConditionalDelete === false) return false;
-    const facts = this.facts;
-    if (this.explicitConditionalDelete === true) return facts?.sendsDeleteIfMatch !== false;
-    return facts !== void 0 && facts.sendsDeleteIfMatch && isAwsS3Host(facts.host);
+    return appliesDeleteIfMatch(this.explicitConditionalDelete, this.facts);
   }
   /** Ask the client once what it does with the registry's requests; every caller waits for the same answer. */
   settle() {
@@ -951,7 +1011,7 @@ var S3RegistryStore = class {
     const header = expect === "absent" ? "If-None-Match" : "If-Match";
     const sent = expect === "absent" ? this.facts?.sendsPutIfNoneMatch : this.facts?.sendsPutIfMatch;
     if (sent === false) {
-      throw new ValidationError4(
+      throw new ValidationError5(
         `the S3 client does not send ${header} on a PutObject: its @aws-sdk/client-s3 predates the member, so a registry write would overwrite whatever is there and lose a concurrent writer's change. Use a newer @aws-sdk/client-s3; the registry sent nothing`
       );
     }
@@ -1064,13 +1124,6 @@ function mapError(err) {
   }
   return err;
 }
-function checkConditionalDelete(value) {
-  if (value === void 0) return void 0;
-  if (typeof value !== "boolean") {
-    throw new ValidationError4(`conditionalDelete must be a boolean; got ${String(value)}`);
-  }
-  return value;
-}
 var S3RegistryDriver = class extends ObjectStoreRegistry {
   constructor(options) {
     super(
@@ -1218,14 +1271,14 @@ function limitSockets(client, maxSockets) {
 }
 function refuseUnknown(name, options, keys, hint) {
   if (options === null || typeof options !== "object") {
-    throw new ValidationError5(
+    throw new ValidationError6(
       `${name} needs an options object \u2014 got ${options === null ? "null" : typeof options}`
     );
   }
   const unknown = Object.keys(options).filter((k) => !keys.includes(k));
   if (unknown.length > 0) {
     const list = (ks) => ks.map((k) => `\`${k}\``).join(", ");
-    throw new ValidationError5(
+    throw new ValidationError6(
       `${name} does not take ${list(unknown)}. It takes ${list(keys)}; ${hint}.`
     );
   }
@@ -1239,17 +1292,17 @@ var S3Storage = class {
   constructor(options) {
     refuseUnknown("S3Storage", options, S3_STORAGE_OPTION_KEYS, "an S3 client goes in `client`");
     if (typeof options.bucket !== "string" || options.bucket.length === 0) {
-      throw new ValidationError5("S3Storage needs a `bucket`: the name of one, a non-empty string");
+      throw new ValidationError6("S3Storage needs a `bucket`: the name of one, a non-empty string");
     }
     if (options.now !== void 0 && typeof options.now !== "function") {
-      throw new ValidationError5(
+      throw new ValidationError6(
         "S3Storage's `now` must be a function that returns epoch milliseconds"
       );
     }
     if (options.client !== void 0 && options.client !== null) {
       const ignored = CLIENT_SETTINGS.filter((k) => options[k] !== void 0);
       if (ignored.length > 0) {
-        throw new ValidationError5(
+        throw new ValidationError6(
           `S3Storage takes \`client\` OR ${CLIENT_SETTINGS.map((k) => `\`${k}\``).join(" / ")}, not both \u2014 got \`client\` with ${ignored.map((k) => `\`${k}\``).join(", ")}; the \`client\` already carries them, so configure them on the client, or drop \`client\``
         );
       }
@@ -1257,7 +1310,7 @@ var S3Storage = class {
     } else {
       const { maxSockets = DEFAULT_MAX_SOCKETS } = options;
       if (!Number.isSafeInteger(maxSockets) || maxSockets < 1) {
-        throw new ValidationError5(
+        throw new ValidationError6(
           `maxSockets must be a positive safe integer; got ${describe(options.maxSockets)}`
         );
       }
@@ -1280,7 +1333,8 @@ var S3Storage = class {
       ...shared,
       sockets: this.sockets,
       ...options.maxObjectBytes === void 0 ? {} : { maxObjectBytes: options.maxObjectBytes },
-      ...options.partBytes === void 0 ? {} : { partBytes: options.partBytes }
+      ...options.partBytes === void 0 ? {} : { partBytes: options.partBytes },
+      ...options.conditionalDelete === void 0 ? {} : { conditionalDelete: options.conditionalDelete }
     });
     this.registry = new S3RegistryDriver({
       ...shared,