@cytario/web 2.1.8 → 2.2.0

package/app/utils/connectionsStore/useConnectionsStore.ts

@@ -1,15 +1,11 @@
 import { Credentials } from "@aws-sdk/client-sts";
 import { create } from "zustand";
-import { createJSONStorage, devtools, persist } from "zustand/middleware";
+import { devtools } from "zustand/middleware";
 import { immer } from "zustand/middleware/immer";
 
 import type { ConnectionConfig } from "~/.generated/client";
-import { createMigrate } from "~/utils/persistMigration";
 
-/**
- * A connection joins the static config (DB metadata) with the credentials
- * (STS-minted) needed to make signed requests.
- */
+/** Static config + STS credentials needed to sign requests for one connection. */
 export interface Connection {
   connectionConfig: ConnectionConfig;
   credentials: Credentials;
@@ -18,74 +14,41 @@ export interface Connection {
 /**
  * Connections store. Single map keyed by `config.name`.
  *
- * Note: credentials are stored per-connection, not per-bucket. STS dedup
- * happens server-side at mint time (`getAllSessionCredentials`); on the
- * client we keep a flat per-connection mapping so connections that share
- * a bucket but differ in role can hold distinct credentials.
+ * Deliberately not persisted: STS credentials never leave in-memory state —
+ * any script in the realm can read `sessionStorage` / `localStorage`.
  */
 export interface ConnectionsStore {
   connections: Record<string, Connection>;
-  /**
-   * Replace the whole store contents in a single write. Both inputs are
-   * keyed by connection name (server's `getAllSessionCredentials` mints one
-   * set of credentials per connection). Prunes entries for connections
-   * deleted server-side.
-   */
+  /** Replace the whole store in one write; prunes entries removed server-side. */
   setConnections: (configs: ConnectionConfig[], credentials: Record<string, Credentials>) => void;
 }
 
 const name = "ConnectionsStore";
 
-const FALLBACK_STATE: Pick<ConnectionsStore, "connections"> = {
-  connections: {},
-};
-
 export const useConnectionsStore = create<ConnectionsStore>()(
   devtools(
-    persist(
-      immer((set) => ({
-        connections: {},
+    immer((set) => ({
+      connections: {},
 
-        setConnections: (configs, credentials) => {
-          set(
-            (state) => {
-              const next: Record<string, Connection> = {};
-              for (const connectionConfig of configs) {
-                const creds = credentials[connectionConfig.name];
-                if (!creds) continue;
-                next[connectionConfig.name] = {
-                  connectionConfig,
-                  credentials: creds,
-                };
-              }
-              state.connections = next;
-            },
-            false,
-            "setConnections",
-          );
-        },
-      })),
-      {
-        name: "connections-storage",
-        storage: createJSONStorage(() => sessionStorage),
-        version: 5,
-        migrate: createMigrate<typeof FALLBACK_STATE>(
-          {
-            1: () => FALLBACK_STATE,
-            2: () => FALLBACK_STATE,
-            3: () => FALLBACK_STATE,
-            4: () => FALLBACK_STATE,
+      setConnections: (configs, credentials) => {
+        set(
+          (state) => {
+            const next: Record<string, Connection> = {};
+            for (const connectionConfig of configs) {
+              const creds = credentials[connectionConfig.name];
+              if (!creds) continue;
+              next[connectionConfig.name] = {
+                connectionConfig,
+                credentials: creds,
+              };
+            }
+            state.connections = next;
           },
-          FALLBACK_STATE,
-        ),
-        partialize: (state) => ({
-          connections: state.connections,
-        }),
-        onRehydrateStorage: () => (_state, error) => {
-          if (error) console.error("[ConnectionsStore] Rehydration failed:", error);
-        },
+          false,
+          "setConnections",
+        );
       },
-    ),
-    { name },
+    })),
+    { name, enabled: process.env.NODE_ENV !== "production" },
   ),
 );

package/app/utils/credentialsRefresh.ts

@@ -0,0 +1,53 @@
+/**
+ * Module-level singleton so utility code (signedFetch, listObjectsClient) can
+ * ask for fresh STS credentials without importing React. A route/component
+ * that owns a `useRevalidator` installs the refresher at mount.
+ */
+
+import type { Credentials } from "@aws-sdk/client-sts";
+
+/** Thrown when no refresher is installed or the refresh+retry still fails. */
+export class ExpiredCredentialsError extends Error {
+  public readonly connectionName?: string;
+
+  constructor(message: string, connectionName?: string, cause?: unknown) {
+    super(message);
+    this.name = "ExpiredCredentialsError";
+    this.connectionName = connectionName;
+    if (cause !== undefined) {
+      (this as { cause?: unknown }).cause = cause;
+    }
+  }
+}
+
+export type CredentialsRefresher = (connectionName: string) => Promise<Credentials>;
+
+let installed: CredentialsRefresher | undefined;
+
+/** Install the refresher. Returns an uninstall function for React cleanup. */
+export function setCredentialsRefresher(refresher: CredentialsRefresher): () => void {
+  installed = refresher;
+  return () => {
+    if (installed === refresher) installed = undefined;
+  };
+}
+
+/** Trigger a refresh; throws `ExpiredCredentialsError` if none is installed or it fails. */
+export async function requestCredentialsRefresh(connectionName: string): Promise<Credentials> {
+  if (!installed) {
+    throw new ExpiredCredentialsError(
+      "STS credentials expired and no refresher is installed.",
+      connectionName,
+    );
+  }
+  try {
+    return await installed(connectionName);
+  } catch (error) {
+    throw new ExpiredCredentialsError("Failed to refresh STS credentials.", connectionName, error);
+  }
+}
+
+/** Test-only — module state survives `vi.resetModules()` unless explicitly wiped. */
+export function __resetCredentialsRefresher(): void {
+  installed = undefined;
+}

package/app/utils/db/convertCsvToParquet.ts

@@ -1,11 +1,7 @@
-import {
-  getJsDelivrBundles,
-  selectBundle,
-  createWorker,
-  AsyncDuckDB,
-  ConsoleLogger,
-} from "@duckdb/duckdb-wasm";
+import { selectBundle, createWorker, AsyncDuckDB, ConsoleLogger } from "@duckdb/duckdb-wasm";
 
+import { getLocalDuckDbBundles } from "./duckdbBundles";
+import { escapeSqlString } from "./escapeSqlString";
 import { getUint8ArrayForResourceId } from "./getBlobFromObjectNode";
 import { buildCreateTableQuery } from "./sqlQueries";
 import { resolveResourceId } from "../connectionsStore/selectors";
@@ -17,8 +13,7 @@ export async function convertCsvToParquet(resourceId: string) {
   let conn: Awaited<ReturnType<AsyncDuckDB["connect"]>> | null = null;
 
   try {
-    const JSDELIVR_BUNDLES = getJsDelivrBundles();
-    const bundle = await selectBundle(JSDELIVR_BUNDLES);
+    const bundle = await selectBundle(getLocalDuckDbBundles());
 
     if (!bundle.mainWorker) {
       throw new Error("DuckDB WASM worker is not available");
@@ -27,9 +22,17 @@ export async function convertCsvToParquet(resourceId: string) {
     const worker = await createWorker(bundle.mainWorker);
     db = new AsyncDuckDB(new ConsoleLogger(4), worker);
     await db.instantiate(bundle.mainModule, bundle.pthreadWorker);
+    // See `createDatabase.ts` for the unsigned-extensions rationale.
+    await db.open({ allowUnsignedExtensions: true });
 
     conn = await db.connect();
 
+    // Pin the extension loader at the cytario origin (see `createDatabase.ts`).
+    if (typeof window !== "undefined") {
+      const repo = `${window.location.origin}/duckdb-extensions`;
+      await conn.query(`SET custom_extension_repository='${repo}'`);
+    }
+
     await conn.query(`INSTALL httpfs;`);
     await conn.query(`LOAD httpfs;`);
     await conn.query(`INSTALL spatial;`);
@@ -38,21 +41,26 @@ export async function convertCsvToParquet(resourceId: string) {
     const csvBytes = await getUint8ArrayForResourceId(resourceId);
     await db.registerFileBuffer(resourceId, csvBytes);
 
-    // Create table `geometries`
     const createTableSQL = buildCreateTableQuery(resourceId, "polygon");
     await conn.query(createTableSQL);
 
     const { credentials, connectionConfig, s3Uri } = resolveResourceId(resourceId);
 
-    await conn.query(`SET s3_access_key_id='${credentials.AccessKeyId}'`);
-    await conn.query(`SET s3_secret_access_key='${credentials.SecretAccessKey}'`);
+    // Single-quote-escape every interpolated value — credentials, region,
+    // and S3 keys can carry `'` on non-AWS providers.
+    await conn.query(`SET s3_access_key_id='${escapeSqlString(credentials.AccessKeyId ?? "")}'`);
+    await conn.query(
+      `SET s3_secret_access_key='${escapeSqlString(credentials.SecretAccessKey ?? "")}'`,
+    );
     if (credentials.SessionToken) {
-      await conn.query(`SET s3_session_token='${credentials.SessionToken}'`);
+      await conn.query(`SET s3_session_token='${escapeSqlString(credentials.SessionToken)}'`);
     }
-    await conn.query(`SET s3_region='${connectionConfig.region ?? "eu-central-1"}'`);
+    await conn.query(
+      `SET s3_region='${escapeSqlString(connectionConfig.region ?? "eu-central-1")}'`,
+    );
 
-    // Write to Parquet with WKB geometry
     const parquetDestination = `${s3Uri}.parquet`;
+    const escapedParquetDestination = escapeSqlString(parquetDestination);
 
     console.log(`[CSV→Parquet] Writing to S3 as Parquet (ZSTD compression, 500k row groups)...`);
     console.log(`[CSV→Parquet] → Destination: ${parquetDestination}`);
@@ -70,7 +78,7 @@ export async function convertCsvToParquet(resourceId: string) {
           COLUMNS('marker_positive_.*')
         FROM geometries
       )
-      TO '${parquetDestination}'
+      TO '${escapedParquetDestination}'
       (FORMAT PARQUET, COMPRESSION ZSTD);
     `);
 

package/app/utils/db/createDatabase.ts

@@ -1,22 +1,13 @@
 import { Credentials } from "@aws-sdk/client-sts";
-import {
-  getJsDelivrBundles,
-  selectBundle,
-  createWorker,
-  AsyncDuckDB,
-  ConsoleLogger,
-} from "@duckdb/duckdb-wasm";
+import { selectBundle, createWorker, AsyncDuckDB, ConsoleLogger } from "@duckdb/duckdb-wasm";
 
 import { createSingleton } from "./createSingleton";
+import { getLocalDuckDbBundles } from "./duckdbBundles";
+import { escapeSqlString } from "./escapeSqlString";
 import { shouldUseSSL, getEndpointHostname } from "../s3Provider";
 import { ConnectionConfig } from "~/.generated/client";
 
-/**
- * Initialize DuckDB WASM with S3 support (singleton per resourceId)
- * @param resourceId - S3 resource identifier (bucketName/pathName)
- * @param credentials - AWS credentials
- * @param connectionConfig - Optional bucket configuration for S3-compatible services
- */
+/** Initialize a DuckDB WASM connection with S3 support (singleton per resourceId). */
 const createDatabaseInternal = async (
   resourceId: string,
   credentials: Credentials,
@@ -24,9 +15,7 @@ const createDatabaseInternal = async (
 ) => {
   console.info("[getTileDataWasm] Initializing DuckDB WASM with S3 support...");
 
-  // Load DuckDB WASM bundle
-  const JSDELIVR_BUNDLES = getJsDelivrBundles();
-  const bundle = await selectBundle(JSDELIVR_BUNDLES);
+  const bundle = await selectBundle(getLocalDuckDbBundles());
 
   if (!bundle.mainWorker) {
     throw new Error("DuckDB WASM worker is not available");
@@ -36,37 +25,41 @@ const createDatabaseInternal = async (
   const db = new AsyncDuckDB(new ConsoleLogger(4), worker);
   await db.instantiate(bundle.mainModule, bundle.pthreadWorker);
 
+  // Must be set before `open` (no SQL toggle). The mirror serves the same
+  // upstream binary verified at build time, but signatures are tied to
+  // `extensions.duckdb.org` so signature validation must be skipped.
+  await db.open({ allowUnsignedExtensions: true });
+
   const connection = await db.connect();
 
-  // Use experimental HTTPFS for S3 access
-  // see https://github.com/duckdb/duckdb-wasm/discussions/2107
+  // Pin the extension loader at the cytario origin — going to
+  // `extensions.duckdb.org` would leak the user's IP and is blocked by CSP.
+  if (typeof window !== "undefined") {
+    const repo = `${window.location.origin}/duckdb-extensions`;
+    await connection.query(`SET custom_extension_repository='${repo}'`);
+  }
+
+  // Use experimental HTTPFS for S3 — see duckdb-wasm discussion #2107.
   await connection.query("SET builtin_httpfs = false;");
   await connection.query("LOAD httpfs;");
 
-  // Install and load spatial extension for geometry operations
-  await connection.query("INSTALL spatial;");
-  await connection.query("LOAD spatial;");
-
-  // Enable caching for parquet metadata and HTTP connections
   await connection.query("SET enable_object_cache = true;");
   await connection.query("SET http_keep_alive = true;");
 
-  // Configure S3 credentials
+  // Single-quote-escape every interpolated value — non-AWS providers may carry `'`.
   const { AccessKeyId, SecretAccessKey, SessionToken } = credentials;
-  await connection.query(`SET s3_access_key_id='${AccessKeyId}'`);
-  await connection.query(`SET s3_secret_access_key='${SecretAccessKey}'`);
-  await connection.query(`SET s3_session_token='${SessionToken}'`);
+  await connection.query(`SET s3_access_key_id='${escapeSqlString(AccessKeyId ?? "")}'`);
+  await connection.query(`SET s3_secret_access_key='${escapeSqlString(SecretAccessKey ?? "")}'`);
+  await connection.query(`SET s3_session_token='${escapeSqlString(SessionToken ?? "")}'`);
 
-  // Configure S3 endpoint. Always path-style: works for every bucket shape
-  // (dotted names break the vhost wildcard cert `*.s3.<region>.amazonaws.com`)
-  // and keeps a single URL form across AWS and S3-compatible endpoints.
+  // Always path-style: dotted bucket names break the vhost wildcard cert.
   const endpoint = connectionConfig?.endpoint;
   const region = connectionConfig?.region ?? "eu-central-1";
   const useSSL = shouldUseSSL(endpoint);
   const hostname = getEndpointHostname(endpoint);
 
-  await connection.query(`SET s3_region='${region}'`);
-  await connection.query(`SET s3_endpoint='${hostname}'`);
+  await connection.query(`SET s3_region='${escapeSqlString(region)}'`);
+  await connection.query(`SET s3_endpoint='${escapeSqlString(hostname)}'`);
   await connection.query(`SET s3_url_style='path'`);
   await connection.query(`SET s3_use_ssl=${useSSL}`);
 
@@ -75,5 +68,4 @@ const createDatabaseInternal = async (
   return connection;
 };
 
-// Wrap with singleton pattern to prevent multiple initializations
 export const createDatabase = createSingleton(createDatabaseInternal);

package/app/utils/db/duckdbBundles.ts

@@ -0,0 +1,42 @@
+// Bundled locally rather than fetched from cdn.jsdelivr.net so we do not leak
+// every user's IP to a third-party CDN (also blocked by CSP).
+import type { DuckDBBundles } from "@duckdb/duckdb-wasm";
+import duckdbCoiPthreadWorker from "@duckdb/duckdb-wasm/dist/duckdb-browser-coi.pthread.worker.js?url";
+import duckdbCoiWorker from "@duckdb/duckdb-wasm/dist/duckdb-browser-coi.worker.js?url";
+import duckdbEhWorker from "@duckdb/duckdb-wasm/dist/duckdb-browser-eh.worker.js?url";
+import duckdbMvpWorker from "@duckdb/duckdb-wasm/dist/duckdb-browser-mvp.worker.js?url";
+import duckdbCoiModule from "@duckdb/duckdb-wasm/dist/duckdb-coi.wasm?url";
+import duckdbEhModule from "@duckdb/duckdb-wasm/dist/duckdb-eh.wasm?url";
+import duckdbMvpModule from "@duckdb/duckdb-wasm/dist/duckdb-mvp.wasm?url";
+
+/**
+ * Resolve a Vite-emitted URL to an absolute URL. DuckDB's worker runs in a
+ * `blob:` origin where `new Request("/...")` throws — we must pre-resolve.
+ */
+function absoluteUrl(path: string): string {
+  if (typeof window === "undefined") {
+    throw new Error(
+      "getLocalDuckDbBundles() must not be called during SSR — DuckDB-WASM is a browser-only module.",
+    );
+  }
+  return new URL(path, window.location.origin).href;
+}
+
+/** Drop-in replacement for `getJsDelivrBundles()` pointing at the local assets. */
+export function getLocalDuckDbBundles(): DuckDBBundles {
+  return {
+    mvp: {
+      mainModule: absoluteUrl(duckdbMvpModule),
+      mainWorker: absoluteUrl(duckdbMvpWorker),
+    },
+    eh: {
+      mainModule: absoluteUrl(duckdbEhModule),
+      mainWorker: absoluteUrl(duckdbEhWorker),
+    },
+    coi: {
+      mainModule: absoluteUrl(duckdbCoiModule),
+      mainWorker: absoluteUrl(duckdbCoiWorker),
+      pthreadWorker: absoluteUrl(duckdbCoiPthreadWorker),
+    },
+  };
+}

package/app/utils/db/ensureSpatialLoaded.ts

@@ -0,0 +1,28 @@
+type Connection = {
+  query: (sql: string) => Promise<unknown>;
+};
+
+const loaded = new WeakMap<Connection, Promise<void>>();
+
+/**
+ * Lazily install + load the DuckDB `spatial` extension. ~23 MB, so kept off
+ * `createDatabase`'s critical path. Idempotent per connection via WeakMap.
+ */
+export function ensureSpatialLoaded<T extends Connection>(connection: T): Promise<void> {
+  const cached = loaded.get(connection);
+  if (cached) return cached;
+
+  // Evict on rejection so a transient failure does not poison the connection
+  // until full reload.
+  const promise = (async () => {
+    try {
+      await connection.query("INSTALL spatial;");
+      await connection.query("LOAD spatial;");
+    } catch (error) {
+      loaded.delete(connection);
+      throw error;
+    }
+  })();
+  loaded.set(connection, promise);
+  return promise;
+}

package/app/utils/db/escapeSqlString.ts

@@ -0,0 +1,4 @@
+/** Double every `'` so the value is safe to interpolate in a single-quoted DuckDB literal. */
+export function escapeSqlString(value: string): string {
+  return value.replaceAll("'", "''");
+}

package/app/utils/db/getBlobFromObjectNode.ts

@@ -1,17 +1,14 @@
+import { resolveResourceId } from "../connectionsStore/selectors";
 import { useFileStore, type DownloadProgress } from "../localFilesStore/useFileStore";
-import { parseResourceId } from "../resourceId";
+import { createSignedFetch } from "../signedFetch";
 
 export type ProgressCallback = (progress: DownloadProgress) => void;
 
-/**
- * Download a file from URL with progress tracking
- */
-async function downloadFileWithProgress(
-  url: string,
+/** Stream a response body into a `Uint8Array`, emitting progress when possible. */
+async function readStreamWithProgress(
+  response: Response,
   onProgress?: ProgressCallback,
 ): Promise<Uint8Array> {
-  const response = await fetch(url);
-
   if (!response.ok) {
     throw new Error(`Failed to fetch file: ${response.statusText}`);
   }
@@ -44,7 +41,6 @@ async function downloadFileWithProgress(
     }
   }
 
-  // Combine all chunks into a single Uint8Array
   const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
   const combined = new Uint8Array(totalLength);
   let offset = 0;
@@ -55,39 +51,22 @@ async function downloadFileWithProgress(
   return combined;
 }
 
-/**
- * Get presigned URL for a given resourceId.
- */
-async function getPresignedUrl(resourceId: string): Promise<string> {
-  const { connectionName, pathName } = parseResourceId(resourceId);
-  const response = await fetch(`/presign/${connectionName}/${pathName}`);
-  const data = await response.json();
-  return data.url;
-}
-
-/**
- * Get file data for a resourceId, with caching and progress tracking
- * @param resourceId - S3 resource identifier (provider/bucketName/pathName)
- */
+/** Cached SigV4 GetObject for a resourceId, with progress tracking. */
 export const getUint8ArrayForResourceId = async (resourceId: string): Promise<Uint8Array> => {
   const { getFile, saveFile, setFileProgress } = useFileStore.getState();
 
-  // Check cache first
   const cachedData = await getFile(resourceId);
+  if (cachedData) return cachedData;
 
-  if (cachedData) {
-    return cachedData;
-  } else {
-    const url = await getPresignedUrl(resourceId);
+  const { connectionConfig, credentials, httpsUrl } = resolveResourceId(resourceId);
+  const signedFetch = createSignedFetch(() => credentials, connectionConfig);
 
-    // Download file with progress, updating store
-    const data = await downloadFileWithProgress(url, (progress) => {
-      setFileProgress(resourceId, progress);
-    });
+  const response = await signedFetch(httpsUrl);
+  const data = await readStreamWithProgress(response, (progress) => {
+    setFileProgress(resourceId, progress);
+  });
 
-    // Save to cache
-    await saveFile(resourceId, data);
+  await saveFile(resourceId, data);
 
-    return data;
-  }
+  return data;
 };

package/app/utils/db/getTileDataWasm.ts

@@ -1,6 +1,7 @@
 import { type Table } from "apache-arrow";
 
 import { createDatabase } from "./createDatabase";
+import { ensureSpatialLoaded } from "./ensureSpatialLoaded";
 import { getGeomQuery } from "./getGeomQuery";
 import { resolveResourceId } from "../connectionsStore/selectors";
 
@@ -15,9 +16,6 @@ export interface PointRow extends Record<string, unknown> {
   y: number;
 }
 
-/**
- * Fetch tile data from DuckDB-WASM database on S3.
- */
 export async function getTileDataWasm(
   resourceId: string,
   tileIndex: TileIndex,
@@ -26,6 +24,7 @@ export async function getTileDataWasm(
   try {
     const { credentials, connectionConfig, s3Uri } = resolveResourceId(resourceId);
     const connection = await createDatabase(resourceId, credentials, connectionConfig);
+    await ensureSpatialLoaded(connection);
     const tileQuery = getGeomQuery(s3Uri, tileIndex, markerColumns);
     const arrowTable = await connection.query(tileQuery);
 
@@ -33,8 +32,8 @@ export async function getTileDataWasm(
       return null;
     }
 
-    // Type assertion needed: DuckDB-WASM bundles its own apache-arrow version
-    // which is compatible at runtime but TypeScript sees them as different types
+    // DuckDB-WASM bundles its own apache-arrow; runtime-compatible but
+    // structurally different to TypeScript.
     return arrowTable as unknown as Table;
   } catch (error) {
     console.error(`[getTileDataWasm] Error fetching tile data:`, error);

package/app/utils/db/sqlQueries.ts

@@ -1,4 +1,9 @@
+import { escapeSqlString } from "./escapeSqlString";
+
 export function buildCreateTableQuery(id: string, geometryColumn: string = "polygon"): string {
+  // S3 keys may contain `'`. `geometryColumn` is an unquoted identifier — callers
+  // must keep it to known-safe values.
+  const escapedId = escapeSqlString(id);
   return /*sql*/ `
     CREATE TABLE IF NOT EXISTS geometries AS
     SELECT
@@ -9,7 +14,7 @@ export function buildCreateTableQuery(id: string, geometryColumn: string = "poly
       ST_YMin(geom) as y
       -- ST_X(ST_Centroid(geom)) AS x,
       -- ST_Y(ST_Centroid(geom)) AS y
-    FROM read_csv_auto('${id}', HEADER=TRUE, comment='#');
+    FROM read_csv_auto('${escapedId}', HEADER=TRUE, comment='#');
   `;
 }
 

package/app/utils/filterObjects.ts

@@ -1,9 +1,6 @@
 import { _Object } from "@aws-sdk/client-s3";
 
 import { search } from "~/components/GlobalSearch/search";
-import { cytarioConfig } from "~/config";
-
-export const allowedFilesPattern = new RegExp(cytarioConfig.setup.allowedFiles, "i");
 
 export const filterObjects = (
   objects: Readonly<_Object>[] = [],
@@ -11,28 +8,15 @@ export const filterObjects = (
 ): _Object[] => {
   return objects
     .reduce((acc, item) => {
-      // does not match allowed file pattern
-      if (!allowedFilesPattern.test(item.Key!)) {
+      if (!item.Key) {
         return acc;
       }
 
-      // does not match provided search query
       if (query && !search(query, item.Key)) {
         return acc;
       }
 
-      // add item to array
       return [...acc, item];
     }, [] as _Object[])
-    .sort((a, b) => {
-      const aIsDir = a.Key!.includes("/");
-      const bIsDir = b.Key!.includes("/");
-
-      // First, ensure directories come before files
-      if (aIsDir && !bIsDir) return -1;
-      if (!aIsDir && bIsDir) return 1;
-
-      // Then, if both are either directories or files, sort them alphabetically
-      return a.Key!.localeCompare(b.Key!);
-    });
+    .sort((a, b) => a.Key!.localeCompare(b.Key!));
 };

package/app/utils/limitConcurrency.ts

@@ -0,0 +1,28 @@
+/**
+ * Bounded-concurrency map: at most `limit` promises in flight, results in
+ * input order. Errors propagate like `Promise.all`; callers wanting per-item
+ * error visibility should wrap `fn` and return a tagged result.
+ */
+export async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  if (items.length === 0) return [];
+  const effectiveLimit = Math.max(1, Math.min(limit, items.length));
+
+  const results = new Array<R>(items.length);
+  let nextIndex = 0;
+
+  const worker = async (): Promise<void> => {
+    while (true) {
+      const current = nextIndex++;
+      if (current >= items.length) return;
+      results[current] = await fn(items[current], current);
+    }
+  };
+
+  const workers = Array.from({ length: effectiveLimit }, () => worker());
+  await Promise.all(workers);
+  return results;
+}