@constructive-io/bucket-provisioner 0.30.0 → 0.31.0

package/README.md

@@ -224,7 +224,8 @@ CORS rules for public/temp buckets (PUT, GET, HEAD).
 
 #### `buildPrivateCorsRules(allowedOrigins, maxAgeSeconds?)`
 
-CORS rules for private buckets (PUT, HEAD only — no GET).
+CORS rules for private buckets (PUT, GET, HEAD for the configured origins).
+Presigned downloads still require browser CORS; allowing GET does not grant unsigned object access.
 
 ### Lifecycle Builders
 
@@ -273,7 +274,7 @@ Error codes:
 
 | Access Type | Block Public Access | Bucket Policy | CORS Methods | Lifecycle |
 |-------------|-------------------|---------------|--------------|-----------|
-| `private` | All blocked | None (deleted) | PUT, HEAD | None |
+| `private` | All blocked | None (deleted) | PUT, GET, HEAD | None |
 | `public` | Partially relaxed | Public-read | PUT, GET, HEAD | None |
 | `temp` | All blocked | None (deleted) | PUT, GET, HEAD | Auto-expire (1 day) |
 

package/cors.d.ts

@@ -23,9 +23,9 @@ export declare function buildUploadCorsRules(allowedOrigins: string[], maxAgeSec
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)

package/cors.js

@@ -53,9 +53,9 @@ function buildUploadCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)
@@ -67,7 +67,7 @@ function buildPrivateCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
     return [
         {
             allowedOrigins,
-            allowedMethods: ['PUT', 'HEAD'],
+            allowedMethods: ['PUT', 'GET', 'HEAD'],
             allowedHeaders: [
                 'Content-Type',
                 'Content-Length',

package/esm/cors.d.ts

@@ -23,9 +23,9 @@ export declare function buildUploadCorsRules(allowedOrigins: string[], maxAgeSec
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)

package/esm/cors.js

@@ -49,9 +49,9 @@ export function buildUploadCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)
@@ -63,7 +63,7 @@ export function buildPrivateCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
     return [
         {
             allowedOrigins,
-            allowedMethods: ['PUT', 'HEAD'],
+            allowedMethods: ['PUT', 'GET', 'HEAD'],
             allowedHeaders: [
                 'Content-Type',
                 'Content-Length',

package/esm/provisioner.d.ts

@@ -91,17 +91,16 @@ export declare class BucketProvisioner {
     /**
      * Configure S3 Block Public Access settings.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO) does not
-     * support PutPublicAccessBlock — the operation is best-effort since
-     * not all providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend (e.g. MinIO) answers that it
+     * does not implement PutPublicAccessBlock; every other failure throws.
      */
     setPublicAccessBlock(bucketName: string, config: PublicAccessBlockConfig): Promise<void>;
     /**
      * Apply an S3 bucket policy.
      *
-     * Gracefully skips if the S3-compatible backend does not support
-     * PutBucketPolicy — bucket policies are best-effort since not all
-     * providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend answers that it does not
+     * implement PutBucketPolicy; every other failure (AccessDenied, a blocked
+     * public policy, a malformed document) throws.
      */
     setBucketPolicy(bucketName: string, policy: BucketPolicyDocument): Promise<void>;
     /**
@@ -114,25 +113,27 @@ export declare class BucketProvisioner {
     /**
      * Set CORS configuration on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. older MinIO) does
-     * not support PutBucketCors — CORS is best-effort since not all providers
-     * implement this API via the same endpoint path.
+     * Skips only when the S3-compatible backend (e.g. older MinIO) answers
+     * that it does not implement PutBucketCors; every other failure throws.
      */
     setCors(bucketName: string, rules: CorsRule[]): Promise<void>;
+    /**
+     * Remove the CORS configuration from an S3 bucket, so no browser origin may
+     * reach it. A bucket that has none already is the converged state.
+     */
+    clearCors(bucketName: string): Promise<void>;
     /**
      * Enable versioning on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketVersioning — versioning is best-effort
-     * since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketVersioning.
      */
     enableVersioning(bucketName: string): Promise<void>;
     /**
      * Set lifecycle rules on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketLifecycleConfiguration — lifecycle rules
-     * are best-effort since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketLifecycleConfiguration.
      */
     setLifecycleRules(bucketName: string, rules: LifecycleRule[]): Promise<void>;
     /**

package/esm/provisioner.js

@@ -9,12 +9,27 @@
  * - Private/temp buckets: Block All Public Access, no bucket policy, presigned URLs only
  * - Public buckets: Block Public Access partially relaxed, public-read bucket policy applied
  */
-import { CreateBucketCommand, DeleteBucketPolicyCommand, GetBucketCorsCommand, GetBucketLifecycleConfigurationCommand, GetBucketPolicyCommand, GetBucketVersioningCommand, GetPublicAccessBlockCommand, HeadBucketCommand, PutBucketCorsCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
+import { CreateBucketCommand, DeleteBucketCorsCommand, DeleteBucketPolicyCommand, GetBucketCorsCommand, GetBucketLifecycleConfigurationCommand, GetBucketPolicyCommand, GetBucketVersioningCommand, GetPublicAccessBlockCommand, HeadBucketCommand, PutBucketCorsCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { createS3Client } from './client';
 import { buildPrivateCorsRules, buildUploadCorsRules } from './cors';
 import { buildTempCleanupRule } from './lifecycle';
 import { buildPublicReadPolicy, getPublicAccessBlock } from './policies';
 import { ProvisionerError } from './types';
+/**
+ * Error codes an S3-compatible backend answers with when it does not implement
+ * a bucket-configuration API at all (older MinIO, some RustFS builds). Matched
+ * on the error's code only — never on message text, which AWS fills with the
+ * operation and policy names of real failures (an AccessDenied for
+ * `s3:PutBucketPolicy` reads "...because no identity-based policy allows...").
+ */
+const UNSUPPORTED_OPERATION_CODES = ['XmlParseException', 'NotImplemented'];
+function errorCode(err) {
+    return err?.Code ?? err?.name;
+}
+function isUnsupportedOperation(err, extraCodes = []) {
+    const code = errorCode(err);
+    return code !== undefined && [...UNSUPPORTED_OPERATION_CODES, ...extraCodes].includes(code);
+}
 /**
  * The BucketProvisioner handles creating and configuring S3-compatible
  * buckets with the correct privacy settings, CORS rules, and policies
@@ -91,6 +106,8 @@ export class BucketProvisioner {
         // A bucket no browser origin may reach gets no rule set: cross-origin
         // access is the bucket's own recorded data, and "none recorded" is a
         // legitimate answer, not a missing setting to invent an origin for.
+        // Provisioning converges, so "none" also clears a rule set an earlier
+        // provision wrote for origins the bucket no longer records.
         const effectiveOrigins = options.allowedOrigins ?? this.allowedOrigins;
         const corsRules = effectiveOrigins.length === 0
             ? []
@@ -100,6 +117,9 @@ export class BucketProvisioner {
         if (corsRules.length > 0) {
             await this.setCors(bucketName, corsRules);
         }
+        else {
+            await this.clearCors(bucketName);
+        }
         // 5. Versioning
         if (versioning) {
             await this.enableVersioning(bucketName);
@@ -173,9 +193,8 @@ export class BucketProvisioner {
     /**
      * Configure S3 Block Public Access settings.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO) does not
-     * support PutPublicAccessBlock — the operation is best-effort since
-     * not all providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend (e.g. MinIO) answers that it
+     * does not implement PutPublicAccessBlock; every other failure throws.
      */
     async setPublicAccessBlock(bucketName, config) {
         try {
@@ -185,16 +204,9 @@ export class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. older MinIO) don't support
-            // PutPublicAccessBlock. Treat XML parse errors or "not implemented"
-            // responses as non-fatal — the bucket is still usable.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('PublicAccessBlockConfiguration')) {
+            // Some S3-compatible backends (e.g. older MinIO) don't implement
+            // PutPublicAccessBlock; the bucket is still usable without it.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new ProvisionerError('POLICY_FAILED', `Failed to set public access block on '${bucketName}': ${err.message}`, err);
@@ -203,9 +215,9 @@ export class BucketProvisioner {
     /**
      * Apply an S3 bucket policy.
      *
-     * Gracefully skips if the S3-compatible backend does not support
-     * PutBucketPolicy — bucket policies are best-effort since not all
-     * providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend answers that it does not
+     * implement PutBucketPolicy; every other failure (AccessDenied, a blocked
+     * public policy, a malformed document) throws.
      */
     async setBucketPolicy(bucketName, policy) {
         try {
@@ -215,15 +227,8 @@ export class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends don't fully support bucket policies.
-            // Treat XML parse errors or "not implemented" responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('policy')) {
+            // Some S3-compatible backends don't implement bucket policies.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new ProvisionerError('POLICY_FAILED', `Failed to set bucket policy on '${bucketName}': ${err.message}`, err);
@@ -241,14 +246,9 @@ export class BucketProvisioner {
         }
         catch (err) {
             // No policy to delete — that's fine
-            if (err.name === 'NoSuchBucketPolicy' ||
+            if (errorCode(err) === 'NoSuchBucketPolicy' ||
                 err.$metadata?.httpStatusCode === 404 ||
-                err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented')) {
+                isUnsupportedOperation(err)) {
                 return;
             }
             throw new ProvisionerError('POLICY_FAILED', `Failed to delete bucket policy on '${bucketName}': ${err.message}`, err);
@@ -257,9 +257,8 @@ export class BucketProvisioner {
     /**
      * Set CORS configuration on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. older MinIO) does
-     * not support PutBucketCors — CORS is best-effort since not all providers
-     * implement this API via the same endpoint path.
+     * Skips only when the S3-compatible backend (e.g. older MinIO) answers
+     * that it does not implement PutBucketCors; every other failure throws.
      */
     async setCors(bucketName, rules) {
         try {
@@ -277,27 +276,34 @@ export class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. older MinIO) don't support
-            // PutBucketCors via the standard path. Treat XML parse errors or
-            // "not implemented" responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('CORSConfiguration')) {
+            // Some S3-compatible backends (e.g. older MinIO) don't implement
+            // PutBucketCors.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new ProvisionerError('CORS_FAILED', `Failed to set CORS on '${bucketName}': ${err.message}`, err);
         }
     }
+    /**
+     * Remove the CORS configuration from an S3 bucket, so no browser origin may
+     * reach it. A bucket that has none already is the converged state.
+     */
+    async clearCors(bucketName) {
+        try {
+            await this.client.send(new DeleteBucketCorsCommand({ Bucket: bucketName }));
+        }
+        catch (err) {
+            if (errorCode(err) === 'NoSuchCORSConfiguration' || isUnsupportedOperation(err)) {
+                return;
+            }
+            throw new ProvisionerError('CORS_FAILED', `Failed to clear CORS on '${bucketName}': ${err.message}`, err);
+        }
+    }
     /**
      * Enable versioning on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketVersioning — versioning is best-effort
-     * since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketVersioning.
      */
     async enableVersioning(bucketName) {
         try {
@@ -307,16 +313,9 @@ export class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't support
-            // PutBucketVersioning. Treat XML parse errors or "not implemented"
-            // responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('VersioningConfiguration')) {
+            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't implement
+            // PutBucketVersioning.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new ProvisionerError('VERSIONING_FAILED', `Failed to enable versioning on '${bucketName}': ${err.message}`, err);
@@ -325,9 +324,8 @@ export class BucketProvisioner {
     /**
      * Set lifecycle rules on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketLifecycleConfiguration — lifecycle rules
-     * are best-effort since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketLifecycleConfiguration.
      */
     async setLifecycleRules(bucketName, rules) {
         try {
@@ -344,20 +342,10 @@ export class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't support
-            // PutBucketLifecycleConfiguration (may require Content-MD5 header
-            // the SDK doesn't send). Treat XML parse errors, "not implemented",
-            // or missing-header responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.Code === 'MissingContentMD5' ||
-                err.name === 'MissingContentMD5' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('Content-Md5') ||
-                err.message?.includes('LifecycleConfiguration')) {
+            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't implement
+            // PutBucketLifecycleConfiguration, or require a Content-MD5 header the
+            // SDK doesn't send.
+            if (isUnsupportedOperation(err, ['MissingContentMD5'])) {
                 return;
             }
             throw new ProvisionerError('LIFECYCLE_FAILED', `Failed to set lifecycle rules on '${bucketName}': ${err.message}`, err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/bucket-provisioner",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "S3-compatible bucket provisioning library — create buckets, configure privacy policies, CORS, and access controls",
   "main": "index.js",
@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1052.0",
-    "@constructive-io/s3-utils": "^2.34.0"
+    "@constructive-io/s3-utils": "^2.35.0"
   },
   "devDependencies": {
     "makage": "^0.8.0"
@@ -44,5 +44,5 @@
     "storage",
     "constructive"
   ],
-  "gitHead": "1f3501d518e175803a1a3372cf9249922d82bfe5"
+  "gitHead": "487c4ec9ee997d7da80584a3d41d7120d4354c54"
 }

package/provisioner.d.ts

@@ -91,17 +91,16 @@ export declare class BucketProvisioner {
     /**
      * Configure S3 Block Public Access settings.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO) does not
-     * support PutPublicAccessBlock — the operation is best-effort since
-     * not all providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend (e.g. MinIO) answers that it
+     * does not implement PutPublicAccessBlock; every other failure throws.
      */
     setPublicAccessBlock(bucketName: string, config: PublicAccessBlockConfig): Promise<void>;
     /**
      * Apply an S3 bucket policy.
      *
-     * Gracefully skips if the S3-compatible backend does not support
-     * PutBucketPolicy — bucket policies are best-effort since not all
-     * providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend answers that it does not
+     * implement PutBucketPolicy; every other failure (AccessDenied, a blocked
+     * public policy, a malformed document) throws.
      */
     setBucketPolicy(bucketName: string, policy: BucketPolicyDocument): Promise<void>;
     /**
@@ -114,25 +113,27 @@ export declare class BucketProvisioner {
     /**
      * Set CORS configuration on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. older MinIO) does
-     * not support PutBucketCors — CORS is best-effort since not all providers
-     * implement this API via the same endpoint path.
+     * Skips only when the S3-compatible backend (e.g. older MinIO) answers
+     * that it does not implement PutBucketCors; every other failure throws.
      */
     setCors(bucketName: string, rules: CorsRule[]): Promise<void>;
+    /**
+     * Remove the CORS configuration from an S3 bucket, so no browser origin may
+     * reach it. A bucket that has none already is the converged state.
+     */
+    clearCors(bucketName: string): Promise<void>;
     /**
      * Enable versioning on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketVersioning — versioning is best-effort
-     * since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketVersioning.
      */
     enableVersioning(bucketName: string): Promise<void>;
     /**
      * Set lifecycle rules on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketLifecycleConfiguration — lifecycle rules
-     * are best-effort since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketLifecycleConfiguration.
      */
     setLifecycleRules(bucketName: string, rules: LifecycleRule[]): Promise<void>;
     /**

package/provisioner.js

@@ -18,6 +18,21 @@ const cors_1 = require("./cors");
 const lifecycle_1 = require("./lifecycle");
 const policies_1 = require("./policies");
 const types_1 = require("./types");
+/**
+ * Error codes an S3-compatible backend answers with when it does not implement
+ * a bucket-configuration API at all (older MinIO, some RustFS builds). Matched
+ * on the error's code only — never on message text, which AWS fills with the
+ * operation and policy names of real failures (an AccessDenied for
+ * `s3:PutBucketPolicy` reads "...because no identity-based policy allows...").
+ */
+const UNSUPPORTED_OPERATION_CODES = ['XmlParseException', 'NotImplemented'];
+function errorCode(err) {
+    return err?.Code ?? err?.name;
+}
+function isUnsupportedOperation(err, extraCodes = []) {
+    const code = errorCode(err);
+    return code !== undefined && [...UNSUPPORTED_OPERATION_CODES, ...extraCodes].includes(code);
+}
 /**
  * The BucketProvisioner handles creating and configuring S3-compatible
  * buckets with the correct privacy settings, CORS rules, and policies
@@ -94,6 +109,8 @@ class BucketProvisioner {
         // A bucket no browser origin may reach gets no rule set: cross-origin
         // access is the bucket's own recorded data, and "none recorded" is a
         // legitimate answer, not a missing setting to invent an origin for.
+        // Provisioning converges, so "none" also clears a rule set an earlier
+        // provision wrote for origins the bucket no longer records.
         const effectiveOrigins = options.allowedOrigins ?? this.allowedOrigins;
         const corsRules = effectiveOrigins.length === 0
             ? []
@@ -103,6 +120,9 @@ class BucketProvisioner {
         if (corsRules.length > 0) {
             await this.setCors(bucketName, corsRules);
         }
+        else {
+            await this.clearCors(bucketName);
+        }
         // 5. Versioning
         if (versioning) {
             await this.enableVersioning(bucketName);
@@ -176,9 +196,8 @@ class BucketProvisioner {
     /**
      * Configure S3 Block Public Access settings.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO) does not
-     * support PutPublicAccessBlock — the operation is best-effort since
-     * not all providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend (e.g. MinIO) answers that it
+     * does not implement PutPublicAccessBlock; every other failure throws.
      */
     async setPublicAccessBlock(bucketName, config) {
         try {
@@ -188,16 +207,9 @@ class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. older MinIO) don't support
-            // PutPublicAccessBlock. Treat XML parse errors or "not implemented"
-            // responses as non-fatal — the bucket is still usable.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('PublicAccessBlockConfiguration')) {
+            // Some S3-compatible backends (e.g. older MinIO) don't implement
+            // PutPublicAccessBlock; the bucket is still usable without it.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new types_1.ProvisionerError('POLICY_FAILED', `Failed to set public access block on '${bucketName}': ${err.message}`, err);
@@ -206,9 +218,9 @@ class BucketProvisioner {
     /**
      * Apply an S3 bucket policy.
      *
-     * Gracefully skips if the S3-compatible backend does not support
-     * PutBucketPolicy — bucket policies are best-effort since not all
-     * providers implement this AWS-specific API.
+     * Skips only when the S3-compatible backend answers that it does not
+     * implement PutBucketPolicy; every other failure (AccessDenied, a blocked
+     * public policy, a malformed document) throws.
      */
     async setBucketPolicy(bucketName, policy) {
         try {
@@ -218,15 +230,8 @@ class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends don't fully support bucket policies.
-            // Treat XML parse errors or "not implemented" responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('policy')) {
+            // Some S3-compatible backends don't implement bucket policies.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new types_1.ProvisionerError('POLICY_FAILED', `Failed to set bucket policy on '${bucketName}': ${err.message}`, err);
@@ -244,14 +249,9 @@ class BucketProvisioner {
         }
         catch (err) {
             // No policy to delete — that's fine
-            if (err.name === 'NoSuchBucketPolicy' ||
+            if (errorCode(err) === 'NoSuchBucketPolicy' ||
                 err.$metadata?.httpStatusCode === 404 ||
-                err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented')) {
+                isUnsupportedOperation(err)) {
                 return;
             }
             throw new types_1.ProvisionerError('POLICY_FAILED', `Failed to delete bucket policy on '${bucketName}': ${err.message}`, err);
@@ -260,9 +260,8 @@ class BucketProvisioner {
     /**
      * Set CORS configuration on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. older MinIO) does
-     * not support PutBucketCors — CORS is best-effort since not all providers
-     * implement this API via the same endpoint path.
+     * Skips only when the S3-compatible backend (e.g. older MinIO) answers
+     * that it does not implement PutBucketCors; every other failure throws.
      */
     async setCors(bucketName, rules) {
         try {
@@ -280,27 +279,34 @@ class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. older MinIO) don't support
-            // PutBucketCors via the standard path. Treat XML parse errors or
-            // "not implemented" responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('CORSConfiguration')) {
+            // Some S3-compatible backends (e.g. older MinIO) don't implement
+            // PutBucketCors.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new types_1.ProvisionerError('CORS_FAILED', `Failed to set CORS on '${bucketName}': ${err.message}`, err);
         }
     }
+    /**
+     * Remove the CORS configuration from an S3 bucket, so no browser origin may
+     * reach it. A bucket that has none already is the converged state.
+     */
+    async clearCors(bucketName) {
+        try {
+            await this.client.send(new client_s3_1.DeleteBucketCorsCommand({ Bucket: bucketName }));
+        }
+        catch (err) {
+            if (errorCode(err) === 'NoSuchCORSConfiguration' || isUnsupportedOperation(err)) {
+                return;
+            }
+            throw new types_1.ProvisionerError('CORS_FAILED', `Failed to clear CORS on '${bucketName}': ${err.message}`, err);
+        }
+    }
     /**
      * Enable versioning on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketVersioning — versioning is best-effort
-     * since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketVersioning.
      */
     async enableVersioning(bucketName) {
         try {
@@ -310,16 +316,9 @@ class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't support
-            // PutBucketVersioning. Treat XML parse errors or "not implemented"
-            // responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('VersioningConfiguration')) {
+            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't implement
+            // PutBucketVersioning.
+            if (isUnsupportedOperation(err)) {
                 return;
             }
             throw new types_1.ProvisionerError('VERSIONING_FAILED', `Failed to enable versioning on '${bucketName}': ${err.message}`, err);
@@ -328,9 +327,8 @@ class BucketProvisioner {
     /**
      * Set lifecycle rules on an S3 bucket.
      *
-     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
-     * does not support PutBucketLifecycleConfiguration — lifecycle rules
-     * are best-effort since not all providers implement this API.
+     * Skips only when the S3-compatible backend (e.g. MinIO edge-cicd)
+     * answers that it does not implement PutBucketLifecycleConfiguration.
      */
     async setLifecycleRules(bucketName, rules) {
         try {
@@ -347,20 +345,10 @@ class BucketProvisioner {
             }));
         }
         catch (err) {
-            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't support
-            // PutBucketLifecycleConfiguration (may require Content-MD5 header
-            // the SDK doesn't send). Treat XML parse errors, "not implemented",
-            // or missing-header responses as non-fatal.
-            if (err.Code === 'XmlParseException' ||
-                err.name === 'XmlParseException' ||
-                err.Code === 'NotImplemented' ||
-                err.name === 'NotImplemented' ||
-                err.Code === 'MissingContentMD5' ||
-                err.name === 'MissingContentMD5' ||
-                err.message?.includes('not well-formed') ||
-                err.message?.includes('not implemented') ||
-                err.message?.includes('Content-Md5') ||
-                err.message?.includes('LifecycleConfiguration')) {
+            // Some S3-compatible backends (e.g. MinIO edge-cicd) don't implement
+            // PutBucketLifecycleConfiguration, or require a Content-MD5 header the
+            // SDK doesn't send.
+            if (isUnsupportedOperation(err, ['MissingContentMD5'])) {
                 return;
             }
             throw new types_1.ProvisionerError('LIFECYCLE_FAILED', `Failed to set lifecycle rules on '${bucketName}': ${err.message}`, err);