@cloudflare/sandbox 0.12.7 → 0.12.9

package/dist/{sandbox-CcCJwCbh.js → sandbox-D0rNqxlr.js}

@@ -5322,11 +5322,22 @@ function xmlResponse(body, status = 200) {
 function normalizeObjectKey(value) {
 	return value.replace(/^\/+/, "");
 }
+function decodeObjectKey(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
 function trimTrailingSlashes(s) {
 	let end = s.length;
 	while (end > 0 && s[end - 1] === "/") end--;
 	return s.slice(0, end);
 }
+function normalizeMountPrefix(prefix) {
+	if (!prefix) return void 0;
+	return trimTrailingSlashes(normalizeObjectKey(prefix)) || void 0;
+}
 function parsePath(pathname) {
 	const stripped = pathname.startsWith("/") ? pathname.slice(1) : pathname;
 	if (!stripped) return null;
@@ -5524,15 +5535,17 @@ async function handleGetObject(r2, key, request) {
 		headers
 	});
 }
-async function handlePutObject(r2, bucketName, key, request, env$1, permitted, mountPrefix) {
+async function handlePutObject(r2, bucketName, key, request, env$1, buckets) {
 	const copySourceHeader = request.headers.get("x-amz-copy-source");
 	if (copySourceHeader) {
 		const copySource = parseCopySource(copySourceHeader);
 		if (!copySource || !copySource.key) return new Response("Bad Request: invalid x-amz-copy-source", { status: 400 });
-		if (!permitted.has(copySource.bucket)) return new Response(`Access to R2 bucket "${copySource.bucket}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
+		if (!Object.hasOwn(buckets, copySource.bucket)) return new Response(`Access to R2 bucket "${copySource.bucket}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
+		const sourceParams = buckets[copySource.bucket];
 		const sourceBucket = copySource.bucket === bucketName ? r2 : resolveR2Bucket(env$1, copySource.bucket);
 		if (!sourceBucket) return new Response(`R2 binding "${copySource.bucket}" not found in Worker env. Ensure the binding name matches the bucket name passed to mountBucket().`, { status: 500 });
-		const sourceKey = mountPrefix && copySource.bucket === bucketName ? `${mountPrefix}/${copySource.key}` : copySource.key;
+		const sourcePrefix = normalizeMountPrefix(sourceParams.prefix);
+		const sourceKey = sourcePrefix ? `${sourcePrefix}/${copySource.key}` : copySource.key;
 		const sourceObject = await sourceBucket.get(sourceKey);
 		if (!sourceObject) return new Response(null, { status: 404 });
 		const httpMetadata = request.headers.get("x-amz-metadata-directive")?.toUpperCase() === "REPLACE" ? extractHttpMetadata(request) : sourceObject.httpMetadata;
@@ -5603,11 +5616,11 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 	const url = new URL(request.url);
 	const parsed = parsePath(url.pathname);
 	if (!parsed) return new Response("Bad Request: empty path", { status: 400 });
-	const { bucket: bucketName, key } = parsed;
+	const { bucket: bucketName, key: encodedKey } = parsed;
+	const key = decodeObjectKey(encodedKey);
 	if (!ctx.params?.buckets || !(bucketName in ctx.params.buckets)) return new Response(`Access to R2 bucket "${bucketName}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
 	const bucketParams = ctx.params.buckets[bucketName];
-	const rawPrefix = bucketParams.prefix;
-	const mountPrefix = rawPrefix ? trimTrailingSlashes(normalizeObjectKey(rawPrefix)) : void 0;
+	const mountPrefix = normalizeMountPrefix(bucketParams.prefix);
 	const readOnly = bucketParams.readOnly ?? false;
 	const r2 = resolveR2Bucket(env$1, bucketName);
 	if (!r2) return new Response(`R2 binding "${bucketName}" not found in Worker env. Ensure the binding name matches the bucket name passed to mountBucket().`, { status: 500 });
@@ -5619,7 +5632,6 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 		return new Response("Method Not Allowed", { status: 405 });
 	}
 	const fullKey = mountPrefix ? `${mountPrefix}/${key}` : key;
-	const permitted = new Set(Object.keys(ctx.params.buckets));
 	if (readOnly && (method === "PUT" || method === "DELETE" || method === "POST" && (url.searchParams.has("uploads") || url.searchParams.has("uploadId")))) return new Response("Forbidden: bucket mount is read-only", { status: 403 });
 	if (method === "POST" && url.searchParams.has("uploads")) return handleCreateMultipartUpload(r2, bucketName, fullKey, request);
 	if (method === "POST" && url.searchParams.has("uploadId")) return handleCompleteMultipartUpload(r2, bucketName, fullKey, url, request);
@@ -5628,7 +5640,7 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 	switch (method) {
 		case "HEAD": return handleHeadObject(r2, fullKey);
 		case "GET": return handleGetObject(r2, fullKey, request);
-		case "PUT": return handlePutObject(r2, bucketName, fullKey, request, env$1, permitted, mountPrefix);
+		case "PUT": return handlePutObject(r2, bucketName, fullKey, request, env$1, ctx.params.buckets);
 		case "DELETE": return handleDeleteObject(r2, fullKey);
 		default: return new Response("Method Not Allowed", { status: 405 });
 	}
@@ -7168,7 +7180,7 @@ function createTunnelsHandler(host) {
 * This file is auto-updated by .github/changeset-version.ts during releases
 * DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
 */
-const SDK_VERSION = "0.12.7";
+const SDK_VERSION = "0.12.9";
 
 //#endregion
 //#region src/sandbox.ts
@@ -11549,4 +11561,4 @@ var Sandbox = class Sandbox extends Container {
 
 //#endregion
 export { PortClient as A, InvalidBackupConfigError as B, collectFile as C, SandboxClient as D, isPlatformTransientError as E, BackupCreateError as F, SessionTerminatedError as G, ProcessExitedBeforeReadyError as H, BackupExpiredError as I, BackupNotFoundError as L, FileClient as M, CommandClient as N, UtilityClient as O, BackupClient as P, BackupRestoreError as R, validateTunnelName as S, isDurableObjectCodeUpdateReset as T, ProcessReadyTimeoutError as U, OperationInterruptedError as V, RPCTransportError as W, responseToAsyncIterable as _, PREVIEW_PROXY_HEADER as a, sanitizeSandboxId as b, PREVIEW_PROXY_SANDBOX_ID_HEADER as c, BucketUnmountError as d, InvalidMountConfigError as f, parseSSEStream as g, asyncIterableToSSEStream as h, proxyTerminal as i, GitClient as j, ProcessClient as k, PREVIEW_PROXY_TOKEN_HEADER as l, S3FSMountError as m, Sandbox as n, PREVIEW_PROXY_HEADERS as o, MissingCredentialsError as p, getSandbox as r, PREVIEW_PROXY_PORT_HEADER as s, ContainerProxy$1 as t, BucketMountError as u, CodeInterpreter as v, streamFile as w, validatePort as x, SandboxSecurityError as y, ContainerUnavailableError as z };
-//# sourceMappingURL=sandbox-CcCJwCbh.js.map
+//# sourceMappingURL=sandbox-D0rNqxlr.js.map