@datrix/api-upload 0.1.0 → 0.2.0

package/dist/index.js

@@ -36,10 +36,17 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/upload.ts
+var import_core4 = require("@datrix/core");
+
 // src/schema.ts
 var import_core = require("@datrix/core");
-function createMediaSchema(options, permission) {
-  const modelName = options.modelName ?? "media";
+function createMediaSchema(modelName, permission) {
+  const effectivePermission = {
+    create: false,
+    update: false,
+    ...permission
+  };
   return (0, import_core.defineSchema)({
     name: modelName,
     fields: {
@@ -50,7 +57,7 @@ function createMediaSchema(options, permission) {
       key: { type: "string", required: true },
       variants: { type: "json" }
     },
-    ...permission !== void 0 && { permission }
+    permission: effectivePermission
   });
 }
 
@@ -68,6 +75,16 @@ var IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/gif",
   "image/tiff"
 ]);
+var FORMAT_TO_MIME = {
+  jpeg: "image/jpeg",
+  png: "image/png",
+  webp: "image/webp",
+  avif: "image/avif",
+  heif: "image/avif",
+  gif: "image/gif",
+  tiff: "image/tiff",
+  svg: "image/svg+xml"
+};
 function isImage(mimetype) {
   return IMAGE_MIME_TYPES.has(mimetype);
 }
@@ -83,6 +100,22 @@ function getMimeType(format) {
 function getExtension(format) {
   return format === "jpeg" ? "jpg" : format;
 }
+var sharpModule = null;
+async function loadSharp() {
+  if (sharpModule === null) {
+    sharpModule = (await import("sharp")).default;
+  }
+  return sharpModule;
+}
+async function detectImageMime(buffer) {
+  const sharp = await loadSharp();
+  try {
+    const { format } = await sharp(buffer).metadata();
+    return format !== void 0 ? FORMAT_TO_MIME[format] : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function convertFormat(file, format, quality) {
   if (!isImage(file.mimetype)) {
     return {
@@ -91,15 +124,7 @@ async function convertFormat(file, format, quality) {
       filename: file.filename
     };
   }
-  let sharp;
-  try {
-    sharp = (await import("sharp")).default;
-  } catch (error) {
-    throw new import_core2.DatrixError("sharp is not installed", {
-      code: "SHARP_NOT_FOUND",
-      operation: "upload:convertFormat"
-    });
-  }
+  const sharp = await loadSharp();
   try {
     const converted = await sharp(file.buffer).toFormat(format, { quality }).toBuffer();
     const ext = getExtension(format);
@@ -122,15 +147,7 @@ async function generateVariants(file, resolutions, format, quality, uploadFn) {
   if (!isImage(file.mimetype)) {
     return {};
   }
-  let sharp;
-  try {
-    sharp = (await import("sharp")).default;
-  } catch (error) {
-    throw new import_core2.DatrixError("sharp is not installed", {
-      code: "SHARP_NOT_FOUND",
-      operation: "upload:generateVariants"
-    });
-  }
+  const sharp = await loadSharp();
   const targetFormat = format ?? "jpeg";
   const outputMime = getMimeType(targetFormat);
   const outputExt = getExtension(targetFormat);
@@ -158,8 +175,7 @@ async function generateVariants(file, resolutions, format, quality, uploadFn) {
         width: variantBuffer.info.width,
         height: variantBuffer.info.height,
         size: variantBuffer.data.length,
-        mimeType: outputMime,
-        url: void 0
+        mimeType: outputMime
       };
     } catch (error) {
       if (error instanceof import_core2.DatrixError) throw error;
@@ -174,18 +190,37 @@ async function generateVariants(file, resolutions, format, quality, uploadFn) {
 }
 
 // src/handler.ts
+var MULTIPART_OVERHEAD = 64 * 1024;
 async function handleUploadRequest(request, options) {
   try {
     const { method } = request;
     const url = new URL(request.url);
     const pathAfterUpload = url.pathname.replace(/.*\/upload/, "");
-    const idSegment = pathAfterUpload.replace(/^\//, "").split("/")[0];
-    const id = idSegment !== void 0 && idSegment !== "" ? Number(idSegment) : null;
-    if (method === "POST" && id === null) {
+    const segments = pathAfterUpload.split("/").filter(Boolean);
+    const idSegment = segments[0];
+    if (segments.length > 1) {
+      return (0, import_api.datrixErrorResponse)(
+        import_api.handlerError.recordNotFound(options.modelName, segments.join("/"))
+      );
+    }
+    if (method === "POST") {
+      if (idSegment !== void 0) {
+        return (0, import_api.datrixErrorResponse)(
+          import_api.handlerError.recordNotFound(options.modelName, idSegment)
+        );
+      }
       return await handleUpload(request, options);
     }
-    if (method === "DELETE" && id !== null) {
-      return await handleDeleteMedia(id, options);
+    if (method === "DELETE") {
+      if (idSegment === void 0) {
+        return (0, import_api.datrixErrorResponse)(import_api.handlerError.missingId("delete"));
+      }
+      if (!/^\d+$/.test(idSegment)) {
+        return (0, import_api.datrixErrorResponse)(
+          import_api.handlerError.recordNotFound(options.modelName, idSegment)
+        );
+      }
+      return await handleDeleteMedia(parseInt(idSegment, 10), options);
     }
     return (0, import_api.datrixErrorResponse)(import_api.handlerError.methodNotAllowed(method));
   } catch (error) {
@@ -201,15 +236,26 @@ async function handleUploadRequest(request, options) {
     );
   }
 }
+function isFileEntry(entry) {
+  return entry !== null && typeof entry === "object" && typeof entry.arrayBuffer === "function" && typeof entry.name === "string" && typeof entry.size === "number" && typeof entry.type === "string";
+}
 async function handleUpload(request, options) {
-  const { datrix, uploadOptions } = options;
-  const modelName = uploadOptions.modelName ?? "media";
+  const { datrix, modelName, uploadOptions } = options;
   const contentType = request.headers.get("content-type") ?? "";
   if (!contentType.includes("multipart/form-data")) {
     return (0, import_api.datrixErrorResponse)(
       import_api.handlerError.invalidBody("Expected multipart/form-data")
     );
   }
+  if (uploadOptions.maxSize !== void 0) {
+    const contentLength = Number(request.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > uploadOptions.maxSize + MULTIPART_OVERHEAD) {
+      throw new import_api.DatrixApiError(
+        `Request size ${contentLength} exceeds maximum allowed size ${uploadOptions.maxSize}`,
+        { code: "FILE_TOO_LARGE", status: 413 }
+      );
+    }
+  }
   let formData;
   try {
     formData = await request.formData();
@@ -221,21 +267,39 @@ async function handleUpload(request, options) {
       ...cause !== void 0 && { cause }
     });
   }
-  const fileEntry = formData.get("file");
-  if (!(fileEntry instanceof File)) {
+  const fileEntries = formData.getAll("file");
+  if (fileEntries.length === 0 || !isFileEntry(fileEntries[0])) {
     return (0, import_api.datrixErrorResponse)(
       import_api.handlerError.invalidBody("No file field in form data")
     );
   }
-  const buffer = await fileEntry.arrayBuffer();
+  if (fileEntries.length > 1) {
+    return (0, import_api.datrixErrorResponse)(
+      import_api.handlerError.invalidBody(
+        "Multiple file entries \u2014 upload a single file per request"
+      )
+    );
+  }
+  const fileEntry = fileEntries[0];
+  validateFileLimits(fileEntry.size, fileEntry.type, uploadOptions);
+  const buffer = new Uint8Array(await fileEntry.arrayBuffer());
+  const declaredMime = fileEntry.type;
+  if (declaredMime.startsWith("image/")) {
+    const actualMime = await detectImageMime(buffer);
+    if (actualMime !== declaredMime) {
+      throw new import_api.DatrixApiError(
+        `Declared MIME type ${declaredMime} does not match file content`,
+        { code: "INVALID_MIME_TYPE", status: 400 }
+      );
+    }
+  }
   const rawFile = {
     filename: fileEntry.name,
     originalName: fileEntry.name,
-    mimetype: fileEntry.type,
+    mimetype: declaredMime,
     size: fileEntry.size,
-    buffer: new Uint8Array(buffer)
+    buffer
   };
-  validateFileLimits(rawFile, uploadOptions);
   const quality = uploadOptions.quality ?? 80;
   const fileToUpload = uploadOptions.format !== void 0 && isImage(rawFile.mimetype) ? await convertFormat(rawFile, uploadOptions.format, quality) : rawFile;
   const uploadFile = {
@@ -245,57 +309,78 @@ async function handleUpload(request, options) {
     size: fileToUpload.buffer.length,
     buffer: fileToUpload.buffer
   };
+  const uploadedKeys = [];
   const result = await uploadOptions.provider.upload(uploadFile);
-  let variants = null;
-  if (uploadOptions.resolutions !== void 0 && isImage(uploadFile.mimetype)) {
-    const generated = await generateVariants(
-      uploadFile,
-      uploadOptions.resolutions,
-      uploadOptions.format,
-      quality,
-      async (variantFile) => {
-        const variantResult = await uploadOptions.provider.upload(variantFile);
-        return { key: variantResult.key };
-      }
-    );
-    variants = generated;
-  }
-  const mediaRecord = await datrix.raw.create(modelName, {
-    filename: result.key,
-    originalName: uploadFile.originalName,
-    mimeType: uploadFile.mimetype,
-    size: uploadFile.size,
-    key: result.key,
-    ...variants !== null && { variants }
-  });
-  const data = options.injectUrls ? await options.injectUrls(mediaRecord) : mediaRecord;
-  return (0, import_api.jsonResponse)({ data }, 201);
+  uploadedKeys.push(result.key);
+  try {
+    let variants = null;
+    if (uploadOptions.resolutions !== void 0 && isImage(uploadFile.mimetype)) {
+      variants = await generateVariants(
+        uploadFile,
+        uploadOptions.resolutions,
+        uploadOptions.format,
+        quality,
+        async (variantFile) => {
+          const variantResult = await uploadOptions.provider.upload(variantFile);
+          uploadedKeys.push(variantResult.key);
+          return { key: variantResult.key };
+        }
+      );
+    }
+    const mediaRecord = await datrix.raw.create(modelName, {
+      filename: result.key,
+      originalName: uploadFile.originalName,
+      mimeType: uploadFile.mimetype,
+      size: uploadFile.size,
+      key: result.key,
+      ...variants !== null && { variants }
+    });
+    const data = options.injectUrls ? await options.injectUrls(mediaRecord) : mediaRecord;
+    return (0, import_api.jsonResponse)({ data }, 201);
+  } catch (error) {
+    await cleanupKeys(uploadOptions.provider, uploadedKeys);
+    throw error;
+  }
 }
 async function handleDeleteMedia(id, options) {
-  const { datrix, uploadOptions } = options;
-  const modelName = uploadOptions.modelName ?? "media";
+  const { datrix, modelName, uploadOptions } = options;
   const record = await datrix.raw.findById(modelName, id);
   if (record === null) {
     return (0, import_api.datrixErrorResponse)(import_api.handlerError.recordNotFound(modelName, id));
   }
+  await datrix.raw.delete(modelName, id);
+  const keys = [record.key];
   if (record.variants !== null && record.variants !== void 0) {
     for (const variant of Object.values(record.variants)) {
-      await uploadOptions.provider.delete(variant.key);
+      if (typeof variant?.key === "string") {
+        keys.push(variant.key);
+      }
     }
   }
-  await uploadOptions.provider.delete(record.key);
-  await datrix.raw.delete(modelName, id);
+  await cleanupKeys(uploadOptions.provider, keys);
   return (0, import_api.jsonResponse)({ data: { id } });
 }
-function validateFileLimits(file, options) {
-  if (options.maxSize !== void 0 && file.size > options.maxSize) {
+async function cleanupKeys(provider, keys) {
+  for (const key of keys) {
+    try {
+      await provider.delete(key);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(
+        `[Datrix Upload] Failed to delete storage object '${key}': ${message}`
+      );
+    }
+  }
+}
+function validateFileLimits(size, mimetype, options) {
+  if (options.maxSize !== void 0 && size > options.maxSize) {
     throw new import_api.DatrixApiError(
-      `File size ${file.size} exceeds maximum allowed size ${options.maxSize}`,
+      `File size ${size} exceeds maximum allowed size ${options.maxSize}`,
       { code: "FILE_TOO_LARGE", status: 400 }
     );
   }
-  if (options.allowedMimeTypes !== void 0 && options.allowedMimeTypes.length > 0 && !isMimeTypeAllowed(file.mimetype, options.allowedMimeTypes)) {
-    throw new import_api.DatrixApiError(`MIME type ${file.mimetype} is not allowed`, {
+  if (options.allowedMimeTypes !== void 0 && options.allowedMimeTypes.length > 0 && !isMimeTypeAllowed(mimetype, options.allowedMimeTypes)) {
+    throw new import_api.DatrixApiError(`MIME type ${mimetype} is not allowed`, {
       code: "INVALID_MIME_TYPE",
       status: 400
     });
@@ -317,22 +402,29 @@ var Upload = class {
   options;
   provider;
   constructor(options) {
+    const quality = options.quality;
+    if (quality !== void 0 && (quality < 1 || quality > 100)) {
+      throw new import_core4.DatrixError(
+        `Upload quality must be between 1 and 100, got ${quality}`,
+        { code: "INVALID_UPLOAD_CONFIG", operation: "upload:config" }
+      );
+    }
     this.options = options;
     this.provider = options.provider;
   }
   getModelName() {
     return this.options.modelName ?? "media";
   }
+  getPermission() {
+    return this.options.permission;
+  }
   getSchemas() {
-    const mediaSchema = createMediaSchema(
-      this.options,
-      this.options.permission
-    );
-    return [mediaSchema];
+    return [createMediaSchema(this.getModelName(), this.options.permission)];
   }
   async handleRequest(request, datrix) {
     return handleUploadRequest(request, {
       datrix,
+      modelName: this.getModelName(),
       uploadOptions: this.options,
       injectUrls: (data) => this.injectUrls(data)
     });
@@ -343,47 +435,51 @@ var Upload = class {
   getUrl(key) {
     return this.options.provider.getUrl(key);
   }
-  async traverse(node) {
+  /**
+   * Recursively inject `url` into media-shaped objects (`key` + `mimeType` +
+   * numeric `size` — the media record signature; variant entries match it
+   * too). Non-plain objects (Date, class instances) pass through untouched,
+   * and unchanged subtrees keep their original reference.
+   */
+  traverse(node) {
     if (Array.isArray(node)) {
-      const results = [];
-      for (const item of node) {
-        results.push(await this.traverse(item));
-      }
-      return results;
+      let changed2 = false;
+      const results = node.map((item) => {
+        const result2 = this.traverse(item);
+        if (result2 !== item) changed2 = true;
+        return result2;
+      });
+      return changed2 ? results : node;
     }
-    if (node !== null && typeof node === "object") {
-      const obj = node;
-      const result = {};
-      for (const [k, v] of Object.entries(obj)) {
-        result[k] = await this.traverse(v);
-      }
-      if (typeof result["key"] === "string" && result["url"] === void 0) {
-        result["url"] = this.options.provider.getUrl(result["key"]);
-      }
-      if (result["variants"] !== null && typeof result["variants"] === "object") {
-        const variants = result["variants"];
-        for (const [name, variant] of Object.entries(variants)) {
-          if (variant !== null && typeof variant === "object") {
-            const v = variant;
-            if (typeof v["key"] === "string" && v["url"] === void 0) {
-              variants[name] = {
-                ...v,
-                url: this.options.provider.getUrl(v["key"])
-              };
-            }
-          }
-        }
-      }
-      return result;
+    if (!isPlainObject(node)) {
+      return node;
+    }
+    let changed = false;
+    const result = {};
+    for (const [k, v] of Object.entries(node)) {
+      const traversed = this.traverse(v);
+      if (traversed !== v) changed = true;
+      result[k] = traversed;
+    }
+    if (typeof result["key"] === "string" && typeof result["mimeType"] === "string" && typeof result["size"] === "number" && result["url"] === void 0) {
+      result["url"] = this.options.provider.getUrl(result["key"]);
+      changed = true;
     }
-    return node;
+    return changed ? result : node;
   }
 };
+function isPlainObject(node) {
+  if (node === null || typeof node !== "object") {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(node);
+  return proto === Object.prototype || proto === null;
+}
 
 // src/providers/local.ts
-var import_core4 = require("@datrix/core");
 var import_core5 = require("@datrix/core");
-var UploadError = class extends import_core5.DatrixError {
+var import_core6 = require("@datrix/core");
+var UploadError = class extends import_core6.DatrixError {
   constructor(message, cause) {
     super(message, {
       code: "UPLOAD_ERROR",
@@ -407,8 +503,8 @@ var LocalStorageProvider = class {
     try {
       const fs = await import("fs/promises");
       const path = await import("path");
-      const sanitized = (0, import_core4.sanitizeFilename)(file.originalName);
-      const uniqueFilename = (0, import_core4.generateUniqueFilename)(sanitized);
+      const sanitized = (0, import_core5.sanitizeFilename)(file.originalName);
+      const uniqueFilename = (0, import_core5.generateUniqueFilename)(sanitized);
       const fullPath = path.join(this.basePath, uniqueFilename);
       if (this.ensureDirectory) {
         const dirPath = path.dirname(fullPath);
@@ -426,19 +522,18 @@ var LocalStorageProvider = class {
       throw new UploadError("Failed to upload file to local filesystem", cause);
     }
   }
+  /**
+   * Delete is idempotent — a missing file is treated as already deleted.
+   */
   async delete(key) {
+    const fullPath = await this.resolveContainedPath(key);
     const fs = await import("fs/promises");
-    const path = await import("path");
-    const fullPath = path.join(this.basePath, key);
-    try {
-      await fs.access(fullPath);
-    } catch (error) {
-      const cause = error instanceof Error ? error : void 0;
-      throw new UploadError("File not found", cause);
-    }
     try {
       await fs.unlink(fullPath);
     } catch (error) {
+      if (error.code === "ENOENT") {
+        return;
+      }
       const cause = error instanceof Error ? error : void 0;
       throw new UploadError(
         "Failed to delete file from local filesystem",
@@ -447,19 +542,40 @@ var LocalStorageProvider = class {
     }
   }
   getUrl(key) {
+    this.assertSafeKey(key);
     return this.buildUrl(key);
   }
   async exists(key) {
     try {
+      const fullPath = await this.resolveContainedPath(key);
       const fs = await import("fs/promises");
-      const path = await import("path");
-      const fullPath = path.join(this.basePath, key);
       await fs.access(fullPath);
       return true;
     } catch {
       return false;
     }
   }
+  /**
+   * Keys must be relative paths that stay inside basePath — reject
+   * traversal segments and absolute paths before touching the filesystem.
+   */
+  assertSafeKey(key) {
+    const isAbsolute = key.startsWith("/") || /^[A-Za-z]:/.test(key);
+    const hasTraversal = key.split(/[/\\]/).some((segment) => segment === "..");
+    if (key === "" || isAbsolute || hasTraversal) {
+      throw new UploadError(`Invalid storage key: ${key}`);
+    }
+  }
+  async resolveContainedPath(key) {
+    this.assertSafeKey(key);
+    const path = await import("path");
+    const base = path.resolve(this.basePath);
+    const fullPath = path.resolve(base, key);
+    if (!fullPath.startsWith(base + path.sep)) {
+      throw new UploadError(`Invalid storage key: ${key}`);
+    }
+    return fullPath;
+  }
   buildUrl(key) {
     const cleanBaseUrl = this.baseUrl.replace(/\/$/, "");
     const cleanKey = key.replace(/^\//, "");
@@ -468,9 +584,9 @@ var LocalStorageProvider = class {
 };
 
 // src/providers/s3.ts
-var import_core6 = require("@datrix/core");
 var import_core7 = require("@datrix/core");
-var UploadError2 = class extends import_core7.DatrixError {
+var import_core8 = require("@datrix/core");
+var UploadError2 = class extends import_core8.DatrixError {
   constructor(message, cause) {
     super(message, {
       code: "UPLOAD_ERROR",
@@ -488,6 +604,8 @@ var S3StorageProvider = class {
   secretAccessKey;
   endpoint;
   pathPrefix;
+  sessionToken;
+  forcePathStyle;
   constructor(options) {
     this.bucket = options.bucket;
     this.region = options.region;
@@ -495,13 +613,18 @@ var S3StorageProvider = class {
     this.secretAccessKey = options.secretAccessKey;
     this.endpoint = options.endpoint ?? `s3.${options.region}.amazonaws.com`;
     this.pathPrefix = options.pathPrefix ?? "uploads";
+    this.sessionToken = options.sessionToken;
+    this.forcePathStyle = options.forcePathStyle ?? false;
   }
   async upload(file) {
     try {
-      const sanitized = (0, import_core6.sanitizeFilename)(file.originalName);
-      const filename = (0, import_core6.generateUniqueFilename)(sanitized);
+      const sanitized = (0, import_core7.sanitizeFilename)(file.originalName);
+      const filename = (0, import_core7.generateUniqueFilename)(sanitized);
       const key = this.pathPrefix ? `${this.pathPrefix}/${filename}` : filename;
-      await this.putObject(key, file.buffer, file.mimetype);
+      await this.sendRequest("PUT", key, {
+        body: file.buffer,
+        contentType: file.mimetype
+      });
       return {
         key,
         size: file.size,
@@ -516,7 +639,7 @@ var S3StorageProvider = class {
   }
   async delete(key) {
     try {
-      await this.deleteObject(key);
+      await this.sendRequest("DELETE", key, {});
     } catch (error) {
       if (error instanceof UploadError2) throw error;
       const cause = error instanceof Error ? error : void 0;
@@ -524,209 +647,129 @@ var S3StorageProvider = class {
     }
   }
   getUrl(key) {
-    return `https://${this.bucket}.${this.endpoint}/${key}`;
+    const encodedKey = encodePath(key);
+    return this.forcePathStyle ? `https://${this.endpoint}/${this.bucket}/${encodedKey}` : `https://${this.bucket}.${this.endpoint}/${encodedKey}`;
   }
   async exists(key) {
     try {
-      await this.headObject(key);
+      await this.sendRequest("HEAD", key, { readErrorBody: false });
       return true;
     } catch {
       return false;
     }
   }
-  async putObject(key, buffer, contentType) {
-    const https = await import("https");
-    const crypto = await import("crypto");
-    const host = `${this.bucket}.${this.endpoint}`;
-    const urlPath = `/${key}`;
-    const method = "PUT";
-    const date = (/* @__PURE__ */ new Date()).toUTCString();
-    const contentHash = crypto.createHash("sha256").update(buffer).digest("hex");
-    const authorization = await this.signRequest(
-      method,
-      urlPath,
-      host,
-      date,
-      contentType,
-      contentHash
-    );
-    await new Promise((resolve, reject) => {
-      const req = https.request(
-        {
-          hostname: host,
-          port: 443,
-          path: urlPath,
-          method,
-          headers: {
-            Host: host,
-            Date: date,
-            "Content-Type": contentType,
-            "Content-Length": buffer.length,
-            "x-amz-content-sha256": contentHash,
-            Authorization: authorization
-          }
-        },
-        (res) => {
-          const status = res.statusCode ?? 0;
-          if (status >= 200 && status < 300) {
-            resolve();
-          } else {
-            let body = "";
-            res.on("data", (chunk) => {
-              body += chunk.toString();
-            });
-            res.on("end", () => {
-              reject(new UploadError2(`S3 upload failed: ${status} ${body}`));
-            });
-          }
-        }
-      );
-      req.on("error", (error) => {
-        reject(new UploadError2("S3 request failed", error));
-      });
-      req.write(buffer);
-      req.end();
-    });
+  hostAndPath(key) {
+    const encodedKey = encodePath(key);
+    return this.forcePathStyle ? { host: this.endpoint, urlPath: `/${this.bucket}/${encodedKey}` } : { host: `${this.bucket}.${this.endpoint}`, urlPath: `/${encodedKey}` };
   }
-  async deleteObject(key) {
+  /**
+   * Send a SigV4-signed request to S3, resolving on 2xx and rejecting with
+   * the response body otherwise.
+   */
+  async sendRequest(method, key, options) {
     const https = await import("https");
     const crypto = await import("crypto");
-    const host = `${this.bucket}.${this.endpoint}`;
-    const urlPath = `/${key}`;
-    const method = "DELETE";
-    const date = (/* @__PURE__ */ new Date()).toUTCString();
-    const contentHash = crypto.createHash("sha256").update("").digest("hex");
-    const authorization = await this.signRequest(
+    const { host, urlPath } = this.hostAndPath(key);
+    const { body, contentType, readErrorBody = true } = options;
+    const amzDate = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const dateStamp = amzDate.slice(0, 8);
+    const contentHash = crypto.createHash("sha256").update(body ?? "").digest("hex");
+    const signedHeaderEntries = [
+      ["host", host],
+      ["x-amz-content-sha256", contentHash],
+      ["x-amz-date", amzDate]
+    ];
+    if (this.sessionToken !== void 0) {
+      signedHeaderEntries.push(["x-amz-security-token", this.sessionToken]);
+    }
+    const canonicalHeaders = signedHeaderEntries.map(([name, value]) => `${name}:${value}
+`).join("");
+    const signedHeaders = signedHeaderEntries.map(([name]) => name).join(";");
+    const canonicalRequest = [
       method,
       urlPath,
-      host,
-      date,
       "",
+      canonicalHeaders,
+      signedHeaders,
       contentHash
-    );
+    ].join("\n");
+    const algorithm = "AWS4-HMAC-SHA256";
+    const credentialScope = `${dateStamp}/${this.region}/s3/aws4_request`;
+    const canonicalRequestHash = crypto.createHash("sha256").update(canonicalRequest).digest("hex");
+    const stringToSign = [
+      algorithm,
+      amzDate,
+      credentialScope,
+      canonicalRequestHash
+    ].join("\n");
+    const signature = this.calculateSignature(crypto, stringToSign, dateStamp);
+    const authorization = `${algorithm} Credential=${this.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    const headers = {
+      Host: host,
+      "x-amz-date": amzDate,
+      "x-amz-content-sha256": contentHash,
+      Authorization: authorization
+    };
+    if (this.sessionToken !== void 0) {
+      headers["x-amz-security-token"] = this.sessionToken;
+    }
+    if (body !== void 0) {
+      headers["Content-Length"] = body.length;
+      if (contentType !== void 0) {
+        headers["Content-Type"] = contentType;
+      }
+    }
     await new Promise((resolve, reject) => {
       const req = https.request(
-        {
-          hostname: host,
-          port: 443,
-          path: urlPath,
-          method,
-          headers: {
-            Host: host,
-            Date: date,
-            "x-amz-content-sha256": contentHash,
-            Authorization: authorization
-          }
-        },
+        { hostname: host, port: 443, path: urlPath, method, headers },
         (res) => {
           const status = res.statusCode ?? 0;
           if (status >= 200 && status < 300) {
+            res.resume();
             resolve();
-          } else {
-            let body = "";
-            res.on("data", (chunk) => {
-              body += chunk.toString();
-            });
-            res.on("end", () => {
-              reject(new UploadError2(`S3 delete failed: ${status} ${body}`));
-            });
+            return;
           }
-        }
-      );
-      req.on("error", (error) => {
-        reject(new UploadError2("S3 request failed", error));
-      });
-      req.end();
-    });
-  }
-  async headObject(key) {
-    const https = await import("https");
-    const crypto = await import("crypto");
-    const host = `${this.bucket}.${this.endpoint}`;
-    const urlPath = `/${key}`;
-    const method = "HEAD";
-    const date = (/* @__PURE__ */ new Date()).toUTCString();
-    const contentHash = crypto.createHash("sha256").update("").digest("hex");
-    const authorization = await this.signRequest(
-      method,
-      urlPath,
-      host,
-      date,
-      "",
-      contentHash
-    );
-    await new Promise((resolve, reject) => {
-      const req = https.request(
-        {
-          hostname: host,
-          port: 443,
-          path: urlPath,
-          method,
-          headers: {
-            Host: host,
-            Date: date,
-            "x-amz-content-sha256": contentHash,
-            Authorization: authorization
+          if (!readErrorBody) {
+            res.resume();
+            reject(new UploadError2(`S3 ${method} failed: ${status}`));
+            return;
           }
-        },
-        (res) => {
-          const status = res.statusCode ?? 0;
-          if (status >= 200 && status < 300) resolve();
-          else reject(new UploadError2(`Object not found: ${status}`));
+          let responseBody = "";
+          res.on("data", (chunk) => {
+            responseBody += chunk.toString();
+          });
+          res.on("end", () => {
+            reject(
+              new UploadError2(`S3 ${method} failed: ${status} ${responseBody}`)
+            );
+          });
         }
       );
       req.on("error", (error) => {
         reject(new UploadError2("S3 request failed", error));
       });
+      if (body !== void 0) {
+        req.write(body);
+      }
       req.end();
     });
   }
-  async signRequest(method, urlPath, host, date, _contentType, contentHash) {
-    const crypto = await import("crypto");
-    const canonicalHeaders = `host:${host}
-x-amz-content-sha256:${contentHash}
-x-amz-date:${date}
-`;
-    const signedHeaders = "host;x-amz-content-sha256;x-amz-date";
-    const canonicalRequest = [
-      method,
-      urlPath,
-      "",
-      canonicalHeaders,
-      signedHeaders,
-      contentHash
-    ].join("\n");
-    const algorithm = "AWS4-HMAC-SHA256";
-    const amzDate = this.getAmzDate();
-    const credentialScope = `${this.getDateStamp()}/${this.region}/s3/aws4_request`;
-    const canonicalRequestHash = crypto.createHash("sha256").update(canonicalRequest).digest("hex");
-    const stringToSign = [
-      algorithm,
-      amzDate,
-      credentialScope,
-      canonicalRequestHash
-    ].join("\n");
-    const signature = this.calculateSignature(crypto, stringToSign);
-    return `${algorithm} Credential=${this.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
-  }
-  calculateSignature(crypto, stringToSign) {
-    const kDate = crypto.createHmac("sha256", `AWS4${this.secretAccessKey}`).update(this.getDateStamp()).digest();
+  calculateSignature(crypto, stringToSign, dateStamp) {
+    const kDate = crypto.createHmac("sha256", `AWS4${this.secretAccessKey}`).update(dateStamp).digest();
     const kRegion = crypto.createHmac("sha256", kDate).update(this.region).digest();
     const kService = crypto.createHmac("sha256", kRegion).update("s3").digest();
     const kSigning = crypto.createHmac("sha256", kService).update("aws4_request").digest();
     return crypto.createHmac("sha256", kSigning).update(stringToSign).digest("hex");
   }
-  getAmzDate() {
-    return (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
-  }
-  getDateStamp() {
-    const now = /* @__PURE__ */ new Date();
-    const year = now.getUTCFullYear();
-    const month = String(now.getUTCMonth() + 1).padStart(2, "0");
-    const day = String(now.getUTCDate()).padStart(2, "0");
-    return `${year}${month}${day}`;
-  }
 };
+function encodePath(key) {
+  return key.split("/").map(
+    (segment) => encodeURIComponent(segment).replace(
+      /[!'()*]/g,
+      (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
+    )
+  ).join("/");
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LocalStorageProvider,