@finueva/drive 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @finueva/drive
 
+## 0.7.0
+
+### Minor Changes
+
+- 77546b2: Use portable S3 Content-MD5 transport with mandatory independent server-side whole-file and part SHA-256 verification for all uploads. Descriptor requests require `contentMd5`; there is no legacy transport or profile selector. `completeUpload` and `uploadFile` may return HTTP 202 with a `verifying` result; callers can inspect read-only progress and retry completion with the original idempotency key, or explicitly abort the retained upload. No automatic unbounded polling is performed.
+
+## 0.6.0
+
+### Minor Changes
+
+- 5f0a6b1: Add a separate server-entry-point workspace provisioning client with explicit environment and entitlement validation, bounded service credential transport, and strict replay response checks.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -6,16 +6,18 @@ The package is ESM-only. Node.js 22 is the exact minimum; package CI qualifies N
 
 ## Exports
 
-| Import                  | Runtime                           |
-| ----------------------- | --------------------------------- |
-| `@finueva/drive`        | Browser client, errors, types     |
-| `@finueva/drive/client` | Browser client                    |
-| `@finueva/drive/server` | Request-scoped Worker/Node client |
-| `@finueva/drive/core`   | Error values                      |
-| `@finueva/drive/types`  | Public operation types            |
+| Import                  | Runtime                              |
+| ----------------------- | ------------------------------------ |
+| `@finueva/drive`        | Browser client, errors, types        |
+| `@finueva/drive/client` | Browser client                       |
+| `@finueva/drive/server` | Worker/Node user and service clients |
+| `@finueva/drive/core`   | Error values                         |
+| `@finueva/drive/types`  | Public operation types               |
 
 ## Browser
 
+Approved ecosystem servers can separately use `createDriveProvisioningClient` from `/server` to call `provisionWorkspace(command)`. Configure an exact environment and `getProvisioningCredential` provider using Auth service credentials, not User credentials. Commands require a stable provisioning ID, exact workspace reference, and explicit versioned storage entitlement. The client does not infer quotas, follow redirects, or retry. See [Workspace Provisioning](../../apps/developer/docs/sdk/provisioning.md) for ownership and recovery boundaries.
+
 ```ts
 import { createDriveClient } from "@finueva/drive";
 
@@ -42,6 +44,7 @@ const matches = await drive.searchWorkspaceItems({
   limit: 50,
 });
 
+const completionIdempotencyKey = crypto.randomUUID();
 const uploaded = await drive.uploadFile({
   workspaceId: workspace.workspaceId,
   parentItemId: workspace.rootItemId,
@@ -49,7 +52,7 @@ const uploaded = await drive.uploadFile({
   displayFilename: file.name,
   mediaType: file.type || "application/octet-stream",
   idempotencyKey: crypto.randomUUID(),
-  completionIdempotencyKey: crypto.randomUUID(),
+  completionIdempotencyKey,
   onProgress: ({ phase, confirmedByteLength, totalByteLength }) => {
     renderProgress(phase, confirmedByteLength, totalByteLength);
   },
@@ -124,15 +127,15 @@ Successful calls return `{ data, status, requestId, validators }`. A successful
 
 `createDownload` returns a short-lived archive descriptor for the current or an explicit immutable version, one visible `restore-pending` result for cold content, or a no-body `304` operation result whose validators retain the source ETag. Full, closed, open, and suffix ranges use the selected archive object's strong ETag; malformed or multiple ranges are served as full representations, while valid non-overlapping ranges fail with `range_not_satisfiable`. `downloadItem` follows a descriptor with no Drive credential, ambient browser credentials, or referrer and returns the provider body as a backpressured `Response`; it preserves the same `304` and cold-restore results without a provider request. It validates exact status, ETag, identity encoding, length, and `Content-Range`, cancels malformed upstream bodies, and keeps caller cancellation/deadline authority active until the stream closes or is cancelled. It never returns Blob, ArrayBuffer, text, or base64 whole-file convenience values.
 
-The six low-level upload methods map directly to the Native API. `createUpload` accepts `callerDeclaredContentDigest`, an ordinary whole-file `sha256:{64 lowercase hex}` value calculated or supplied by the caller. It is untrusted metadata, not provider verification evidence. `getUploadStatus` returns one bounded confirmed-part page and the current lifecycle/revision. Descriptor issuance accepts one base64 SHA-256 part checksum, `recordUploadPart` records exact provider ETag/checksum evidence and revision, `completeUpload` returns only a server-verified `ready` result, and `abortUpload` returns bodyless `204` success.
+The six low-level upload methods map directly to the Native API. `createUpload` accepts a caller-declared whole-file `sha256:{64 lowercase hex}` digest. Portable S3 is the only supported upload transport, with no profile selector. Descriptor requests require `contentMd5` (canonical base64 MD5), and return a required `content-md5` header. Part SHA-256 declarations and opaque provider ETags remain separate callback fields; MD5 is transport error detection, not content identity.
 
-Provider part checksums and the provider's multipart composite checksum are verified server-side before publication. They are deliberately distinct from `callerDeclaredContentDigest`: multipart composite SHA-256 is not the ordinary SHA-256 of the complete file. Every low-level control obtains one credential, sends one request, validates exact IDs, checksums, ETags, and safe-integer bounds at runtime, and never retries automatically. `upload_recovery_required` is preserved as a canonical `DriveError` code.
+Publication independently verifies archive bytes against both whole-file and part SHA-256 declarations. `getUploadStatus` exposes bounded confirmed-part pages and read-only verification progress once verification is admitted. `completeUpload` and `uploadFile` return `DriveOperationResult<UploadCompletion, 200 | 202>`: inspect `data.state` for `ready` versus `verifying`. A `202` is not publication. Retain its `uploadId` and the original completion idempotency key, inspect status, then call `completeUpload` again with that key when appropriate. The SDK does not start an unbounded polling loop. To cancel after a pending result, call `abortUpload({ workspaceId, uploadId })`, which returns bodyless `204`.
 
 `uploadFile` is the browser-safe direct-byte path for a Web `Blob` or `File`. It accepts zero-byte input, hashes the empty input correctly, accepts the server-mediated zero-byte mode, skips part transfer, and completes normally. Nonempty input is incrementally hashed in slices no larger than 32 MiB and is never materialized as a complete `ArrayBuffer`, Blob copy, base64 string, or SDK request body. The fixed policy permits at most 10,000 parts and 312.5 GiB.
 
-Each nonempty slice is sent directly to the exact descriptor URL. The request includes only descriptor-required headers, uses `credentials: "omit"`, `cache: "no-store"`, `redirect: "error"`, and `referrerPolicy: "no-referrer"`, and shares the configured cancellation/deadline bound. The archive CORS policy must expose both `ETag` and `x-amz-checksum-sha256`; missing, malformed, or mismatched values fail closed. Drive authorization, cookies, default headers, and file metadata never enter the archive request.
+Each nonempty slice is sent directly to the exact descriptor URL. The SDK computes MD5 with the maintained Noble public API on the same bounded slice as SHA-256. Requests include only descriptor-required headers and use `credentials: "omit"`, `cache: "no-store"`, `redirect: "error"`, and `referrerPolicy: "no-referrer"`. Archive CORS must allow `content-md5` and expose `ETag`; no provider SHA response header is required, and ETags are never interpreted as hashes. If a Content-MD5 response header is exposed, it must match the request. Drive credentials, cookies and file metadata never enter the archive request.
 
-Repeating `uploadFile` with the same creation and completion idempotency keys explicitly resumes the retained session. After create/replay, the SDK reads status in pages of 100, bounded to 100 pages and 10,000 parts; validates session identity, mode, policy, lifecycle, revision, and pagination; re-hashes the supplied source; compares every confirmed part checksum; skips exact confirmed parts; and continues from the current revision. A matching `ready` status returns its exact ready projection. `completing` and `provider-completed` replay completion. Recovery-required and aborted states fail without pretending to resume.
+Repeating `uploadFile` with the same creation and completion keys explicitly resumes the retained session when replay remains available. Status reads are bounded to 100 pages of 100 parts. The SDK checks session identity, policy, lifecycle, revisions and checksums, skips confirmed parts and never re-uploads a part merely because its callback response was lost. `completing`, `provider-completed` and `verifying` resume completion; failed/aborted/recovery-required states do not pretend to resume. After receiving pending, using its upload ID with low-level status/complete avoids re-hashing the source. Both normal and empty uploads may return pending, and progress observers can receive the `verifying` phase.
 
 There is no automatic network or provider retry. If a part-record callback response may have been lost, the SDK performs one bounded status reconciliation before either accepting the confirmed part or recording the same provider evidence once more; it never blindly re-uploads the bytes. If a completion response may have been lost, one status reconciliation returns success only when `ready` is proven. Other transient failures preserve the session for an explicit repeat until server expiry.
 

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-import { $ as UpdateItemInput, A as ListItemVersionsInput, C as FolderPage, D as GetUploadStatusInput, E as GetItemVersionInput, F as ManagedItemVersionPage, I as ManagedItemVersionResource, J as RestoreItemInput, K as ReadyUpload, L as ManagedItemVersionRestoreResult, M as ManagedDownloadRestorePending, N as ManagedItemMetadata, O as ListFolderChildrenInput, P as ManagedItemVersion, Q as TrashItemInput, R as ManagedLifecycleItem, S as FolderItem, T as GetItemInput, W as ProtectionClassification, Y as RestoreItemVersionInput, Z as SearchWorkspaceItemsInput, at as UploadFileProgressCallback, c as CurrentWorkspace, ct as UploadSession, d as DriveClient, dt as WorkspaceItemSearchPage, f as DriveClientConfig, it as UploadFileProgress, j as ManagedDownloadDescriptor, l as DeleteItemInput, lt as UploadStatus, m as DriveCredentialProvider, n as CompleteUploadInput, nt as UploadFileInput, o as CreateUploadInput, ot as UploadPartDescriptor, q as RecordUploadPartInput, r as CreateDownloadInput, rt as UploadFilePhase, s as CreateUploadPartDescriptorInput, st as UploadPartResult, t as AbortUploadInput, tt as UploadConfirmedPart, u as DownloadItemResult, ut as WorkspaceItemSearchItem, w as GetCurrentWorkspaceInput } from "./contract.js";
+import { $ as TrashItemInput, A as ListItemVersionsInput, C as FolderPage, D as GetUploadStatusInput, E as GetItemVersionInput, F as ManagedItemVersionPage, G as ProtectionClassification, I as ManagedItemVersionResource, J as RecordUploadPartInput, L as ManagedItemVersionRestoreResult, M as ManagedDownloadRestorePending, N as ManagedItemMetadata, O as ListFolderChildrenInput, P as ManagedItemVersion, Q as SearchWorkspaceItemsInput, R as ManagedLifecycleItem, S as FolderItem, T as GetItemInput, X as RestoreItemVersionInput, Y as RestoreItemInput, at as UploadFilePhase, c as CurrentWorkspace, ct as UploadPartDescriptor, d as DriveClient, dt as UploadStatus, et as UpdateItemInput, f as DriveClientConfig, ft as WorkspaceItemSearchItem, it as UploadFileInput, j as ManagedDownloadDescriptor, l as DeleteItemInput, lt as UploadPartResult, m as DriveCredentialProvider, n as CompleteUploadInput, nt as UploadCompletion, o as CreateUploadInput, ot as UploadFileProgress, pt as WorkspaceItemSearchPage, q as ReadyUpload, r as CreateDownloadInput, rt as UploadConfirmedPart, s as CreateUploadPartDescriptorInput, st as UploadFileProgressCallback, t as AbortUploadInput, u as DownloadItemResult, ut as UploadSession, w as GetCurrentWorkspaceInput, z as PendingUpload } from "./contract.js";
 //#region src/client.d.ts
 declare function createDriveClient(config: DriveClientConfig): DriveClient;
 //#endregion
-export { type AbortUploadInput, type CompleteUploadInput, type CreateDownloadInput, type CreateUploadInput, type CreateUploadPartDescriptorInput, type CurrentWorkspace, type DeleteItemInput, type DownloadItemResult, type DriveClient, type DriveClientConfig, type DriveCredentialProvider, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetUploadStatusInput, type ListFolderChildrenInput, type ListItemVersionsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type ProtectionClassification, type ReadyUpload, type RecordUploadPartInput, type RestoreItemInput, type RestoreItemVersionInput, type SearchWorkspaceItemsInput, type TrashItemInput, type UpdateItemInput, type UploadConfirmedPart, type UploadFileInput, type UploadFilePhase, type UploadFileProgress, type UploadFileProgressCallback, type UploadPartDescriptor, type UploadPartResult, type UploadSession, type UploadStatus, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, createDriveClient };
+export { type AbortUploadInput, type CompleteUploadInput, type CreateDownloadInput, type CreateUploadInput, type CreateUploadPartDescriptorInput, type CurrentWorkspace, type DeleteItemInput, type DownloadItemResult, type DriveClient, type DriveClientConfig, type DriveCredentialProvider, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetUploadStatusInput, type ListFolderChildrenInput, type ListItemVersionsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type PendingUpload, type ProtectionClassification, type ReadyUpload, type RecordUploadPartInput, type RestoreItemInput, type RestoreItemVersionInput, type SearchWorkspaceItemsInput, type TrashItemInput, type UpdateItemInput, type UploadCompletion, type UploadConfirmedPart, type UploadFileInput, type UploadFilePhase, type UploadFileProgress, type UploadFileProgressCallback, type UploadPartDescriptor, type UploadPartResult, type UploadSession, type UploadStatus, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, createDriveClient };

package/dist/client.js

@@ -584,12 +584,14 @@ function isUploadStatus(value, afterPartNumber, limit) {
 		"nextAfterPartNumber",
 		"expiresAtEpochMilliseconds",
 		"ready"
-	]) || typeof value.itemId !== "string" || !ITEM_ID$1.test(value.itemId) || typeof value.versionId !== "string" || !VERSION_ID$1.test(value.versionId) || typeof value.uploadId !== "string" || !UPLOAD_ID$1.test(value.uploadId) || value.mode !== "presigned-multipart" && value.mode !== "server-mediated-zero-byte" || ![
+	], ["verification"]) || typeof value.itemId !== "string" || !ITEM_ID$1.test(value.itemId) || typeof value.versionId !== "string" || !VERSION_ID$1.test(value.versionId) || typeof value.uploadId !== "string" || !UPLOAD_ID$1.test(value.uploadId) || value.mode !== "presigned-multipart" && value.mode !== "server-mediated-zero-byte" || ![
 		"initiating",
 		"recovery-required",
 		"uploading",
 		"completing",
 		"provider-completed",
+		"verifying",
+		"failed",
 		"ready",
 		"aborting",
 		"aborted"
@@ -599,18 +601,38 @@ function isUploadStatus(value, afterPartNumber, limit) {
 		"maxParts"
 	]) || value.partPolicy.partByteLength !== UPLOAD_PART_BYTE_LENGTH$2 || !isSafeInteger$1(value.partPolicy.partCount) || value.partPolicy.partCount > 1e4 || value.partPolicy.maxParts !== 1e4 || (value.mode === "server-mediated-zero-byte" ? value.partPolicy.partCount !== 0 : value.partPolicy.partCount < 1) || !Array.isArray(value.confirmedParts) || value.confirmedParts.length > limit || !isSafeInteger$1(value.expiresAtEpochMilliseconds)) return false;
 	let previousPartNumber = afterPartNumber;
+	if (value.verification !== void 0) {
+		const progress = value.verification;
+		if (!isExactRecord(progress, [
+			"state",
+			"verifiedByteLength",
+			"totalByteLength",
+			"revision"
+		]) || ![
+			"pending",
+			"verified",
+			"failed"
+		].includes(String(progress.state)) || !isSafeInteger$1(progress.verifiedByteLength) || !isSafeInteger$1(progress.totalByteLength) || progress.totalByteLength > MAX_UPLOAD_BYTE_LENGTH$1 || progress.verifiedByteLength > progress.totalByteLength || !isSafeInteger$1(progress.revision) || progress.state === "verified" && progress.verifiedByteLength !== progress.totalByteLength) return false;
+		Object.freeze(progress);
+	}
+	if (["verifying", "failed"].includes(String(value.lifecycle)) && value.verification === void 0) return false;
 	for (const part of value.confirmedParts) {
 		if (!isExactRecord(part, ["partNumber", "checksumSha256"]) || !isSafeInteger$1(part.partNumber) || part.partNumber <= previousPartNumber || part.partNumber > value.partPolicy.partCount || !isPartChecksum$1(part.checksumSha256)) return false;
 		previousPartNumber = part.partNumber;
 	}
-	if (!(value.nextAfterPartNumber === null || isSafeInteger$1(value.nextAfterPartNumber) && value.confirmedParts.length === limit && value.nextAfterPartNumber === previousPartNumber) || value.mode === "server-mediated-zero-byte" && (value.confirmedParts.length !== 0 || value.nextAfterPartNumber !== null) || value.lifecycle === "ready" !== (value.ready !== null) || value.ready !== null && (!isReadyUpload(value.ready, { uploadId: value.uploadId }) || value.ready.itemId !== value.itemId || value.ready.versionId !== value.versionId)) return false;
+	if (!(value.nextAfterPartNumber === null || isSafeInteger$1(value.nextAfterPartNumber) && value.confirmedParts.length === limit && value.nextAfterPartNumber === previousPartNumber) || value.mode === "server-mediated-zero-byte" && (value.confirmedParts.length !== 0 || value.nextAfterPartNumber !== null) || value.lifecycle === "ready" !== (value.ready !== null) || value.ready !== null && (!isReadyUpload(value.ready, { uploadId: value.uploadId }) || value.ready.itemId !== value.itemId || value.ready.versionId !== value.versionId || !isExactRecord(value.verification, [
+		"state",
+		"verifiedByteLength",
+		"totalByteLength",
+		"revision"
+	]) || value.verification.state !== "verified" || value.verification.totalByteLength !== value.ready.byteLength)) return false;
 	Object.freeze(value.partPolicy);
 	for (const part of value.confirmedParts) Object.freeze(part);
 	Object.freeze(value.confirmedParts);
 	Object.freeze(value);
 	return true;
 }
-function isUploadPartDescriptor(value, expectedPartNumber, checksumSha256, allowInsecureHttp) {
+function isUploadPartDescriptor(value, expectedPartNumber, allowInsecureHttp, contentMd5) {
 	if (!isExactRecord(value, [
 		"url",
 		"method",
@@ -618,7 +640,7 @@ function isUploadPartDescriptor(value, expectedPartNumber, checksumSha256, allow
 		"partNumber",
 		"expectedByteLength",
 		"expiresAtEpochMilliseconds"
-	]) || !isSignedTransferUrl(value.url, allowInsecureHttp) || value.method !== "PUT" || !isExactRecord(value.headers, ["x-amz-checksum-sha256"]) || value.headers["x-amz-checksum-sha256"] !== checksumSha256 || value.partNumber !== expectedPartNumber || !isSafeInteger$1(value.expectedByteLength) || value.expectedByteLength < 1 || value.expectedByteLength > UPLOAD_PART_BYTE_LENGTH$2 || !isSafeInteger$1(value.expiresAtEpochMilliseconds) || value.expiresAtEpochMilliseconds <= Date.now()) return false;
+	]) || !isSignedTransferUrl(value.url, allowInsecureHttp) || value.method !== "PUT" || !contentMd5 || !isExactRecord(value.headers, ["content-md5"]) || value.headers["content-md5"] !== contentMd5 || value.partNumber !== expectedPartNumber || !isSafeInteger$1(value.expectedByteLength) || value.expectedByteLength < 1 || value.expectedByteLength > UPLOAD_PART_BYTE_LENGTH$2 || !isSafeInteger$1(value.expiresAtEpochMilliseconds) || value.expiresAtEpochMilliseconds <= Date.now()) return false;
 	Object.freeze(value.headers);
 	Object.freeze(value);
 	return true;
@@ -642,6 +664,19 @@ function isReadyUpload(value, expected) {
 	Object.freeze(value);
 	return true;
 }
+function isPendingUpload(value, uploadId) {
+	if (!isExactRecord(value, [
+		"itemId",
+		"versionId",
+		"uploadId",
+		"state",
+		"verifiedByteLength",
+		"totalByteLength",
+		"verificationRevision"
+	]) || typeof value.itemId !== "string" || !ITEM_ID$1.test(value.itemId) || typeof value.versionId !== "string" || !VERSION_ID$1.test(value.versionId) || value.uploadId !== uploadId || value.state !== "verifying" || !isSafeInteger$1(value.verifiedByteLength) || !isSafeInteger$1(value.totalByteLength) || value.totalByteLength > MAX_UPLOAD_BYTE_LENGTH$1 || value.verifiedByteLength > value.totalByteLength || !isSafeInteger$1(value.verificationRevision)) return false;
+	Object.freeze(value);
+	return true;
+}
 function isPartChecksum$1(value) {
 	return typeof value === "string" && /^[A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=$/.test(value);
 }
@@ -781,9 +816,9 @@ function isSafeCapabilityUrl(value) {
 		return false;
 	}
 }
-function isExactRecord(value, keys) {
+function isExactRecord(value, keys, optional = []) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+	return Object.keys(value).every((key) => keys.includes(key) || optional.includes(key)) && keys.every((key) => Object.hasOwn(value, key));
 }
 //#endregion
 //#region src/internal/client/request.ts
@@ -1112,14 +1147,17 @@ function validateCreateUploadPartDescriptorInput(value) {
 		"workspaceId",
 		"uploadId",
 		"partNumber",
-		"checksumSha256"
+		"checksumSha256",
+		"contentMd5"
 	], ["signal"]);
 	const upload = validateUploadPath(input.workspaceId, input.uploadId, input.signal);
 	if (!isPartNumber(input.partNumber) || !isPartChecksum(input.checksumSha256)) throw new DriveError("invalid_input");
+	if (typeof input.contentMd5 !== "string" || !/^[A-Za-z0-9+/]{21}[AQgw]==$/.test(input.contentMd5)) throw new DriveError("invalid_input");
 	return {
 		...upload,
 		partNumber: input.partNumber,
-		checksumSha256: input.checksumSha256
+		checksumSha256: input.checksumSha256,
+		contentMd5: input.contentMd5
 	};
 }
 function validateRecordUploadPartInput(value) {
@@ -2437,7 +2475,7 @@ async function getUploadStatus(runtime, input) {
 			}
 		} }),
 		...requestOptions
-	}), [200], (value) => isUploadStatus(value, afterPartNumber, limit), false, STATUS_ERROR_CODES);
+	}), [200], (value) => isUploadStatus(value, afterPartNumber, limit) && value.uploadId === validated.uploadId, false, STATUS_ERROR_CODES);
 }
 async function createUploadPartDescriptor(runtime, input) {
 	const validated = validateCreateUploadPartDescriptorInput(input);
@@ -2449,11 +2487,12 @@ async function createUploadPartDescriptor(runtime, input) {
 			} },
 			body: {
 				partNumber: validated.partNumber,
-				checksumSha256: validated.checksumSha256
+				checksumSha256: validated.checksumSha256,
+				contentMd5: validated.contentMd5
 			}
 		}),
 		...requestOptions
-	}), [200], (value) => isUploadPartDescriptor(value, validated.partNumber, validated.checksumSha256, new URL(runtime.baseUrl).protocol === "http:"), false, TRANSFER_ERROR_CODES);
+	}), [200], (value) => isUploadPartDescriptor(value, validated.partNumber, new URL(runtime.baseUrl).protocol === "http:", validated.contentMd5), false, TRANSFER_ERROR_CODES);
 }
 async function recordUploadPart(runtime, input) {
 	const validated = validateRecordUploadPartInput(input);
@@ -2485,7 +2524,7 @@ async function completeUpload(runtime, input) {
 			header: { "Idempotency-Key": validated.idempotencyKey }
 		} }),
 		...requestOptions
-	}), [200], (value) => isReadyUpload(value, { uploadId: validated.uploadId }), false, COMPLETE_UPLOAD_ERROR_CODES);
+	}), [200, 202], (value, status) => status === 202 ? isPendingUpload(value, validated.uploadId) : isReadyUpload(value, { uploadId: validated.uploadId }), false, COMPLETE_UPLOAD_ERROR_CODES);
 }
 async function abortUpload(runtime, input) {
 	const validated = validateAbortUploadInput(input);
@@ -2549,6 +2588,9 @@ function createView(arr) {
 function rotr(word, shift) {
 	return word << 32 - shift | word >>> shift;
 }
+function rotl(word, shift) {
+	return word << shift | word >>> 32 - shift >>> 0;
+}
 const hasHexBuiltin = (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
 const hexes = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 function bytesToHex(bytes) {
@@ -2860,6 +2902,115 @@ var _SHA256 = class extends SHA2_32B {
 };
 const sha256 = createHasher(() => new _SHA256(), oidNist(1));
 //#endregion
+//#region ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/legacy.js
+const SHA1_IV = Uint32Array.from([
+	1732584193,
+	4023233417,
+	2562383102,
+	271733878,
+	3285377520
+]);
+const p32 = Math.pow(2, 32);
+const K = Array.from({ length: 64 }, (_, i) => Math.floor(p32 * Math.abs(Math.sin(i + 1))));
+const MD5_IV = SHA1_IV.slice(0, 4);
+const MD5_W = new Uint32Array(16);
+const MD5_SHIFTS = (() => {
+	const S = [
+		[
+			7,
+			12,
+			17,
+			22
+		],
+		[
+			5,
+			9,
+			14,
+			20
+		],
+		[
+			4,
+			11,
+			16,
+			23
+		],
+		[
+			6,
+			10,
+			15,
+			21
+		]
+	];
+	return Uint8Array.from({ length: 64 }, (_, i) => S[Math.floor(i / 16)][i % 4]);
+})();
+var _MD5 = class extends HashMD {
+	A = MD5_IV[0] | 0;
+	B = MD5_IV[1] | 0;
+	C = MD5_IV[2] | 0;
+	D = MD5_IV[3] | 0;
+	constructor() {
+		super(64, 16, 8, true);
+	}
+	get() {
+		const { A, B, C, D } = this;
+		return [
+			A,
+			B,
+			C,
+			D
+		];
+	}
+	set(A, B, C, D) {
+		this.A = A | 0;
+		this.B = B | 0;
+		this.C = C | 0;
+		this.D = D | 0;
+	}
+	_cloneInto(to) {
+		(to ||= new this.constructor()).set(...this.get());
+		return this._cloneIntoMeta(to);
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) MD5_W[i] = view.getUint32(offset, true);
+		let { A, B, C, D } = this;
+		for (let i = 0; i < 64; i++) {
+			let F, g;
+			if (i < 16) {
+				F = Chi(B, C, D);
+				g = i;
+			} else if (i < 32) {
+				F = Chi(D, B, C);
+				g = (5 * i + 1) % 16;
+			} else if (i < 48) {
+				F = B ^ C ^ D;
+				g = (3 * i + 5) % 16;
+			} else {
+				F = C ^ (B | ~D);
+				g = 7 * i % 16;
+			}
+			F = F + A + K[i] + MD5_W[g];
+			A = D;
+			D = C;
+			C = B;
+			B = B + rotl(F, MD5_SHIFTS[i]);
+		}
+		A = A + this.A | 0;
+		B = B + this.B | 0;
+		C = C + this.C | 0;
+		D = D + this.D | 0;
+		this.set(A, B, C, D);
+	}
+	roundClean() {
+		clean(MD5_W);
+	}
+	destroy() {
+		this.destroyed = true;
+		this.set(0, 0, 0, 0);
+		clean(this.buffer);
+	}
+};
+const md5 = createHasher(() => new _MD5());
+//#endregion
 //#region src/internal/client/upload.ts
 const UPLOAD_PART_BYTE_LENGTH = 32 * 1024 * 1024;
 const STATUS_PAGE_LIMIT = 100;
@@ -2907,6 +3058,7 @@ async function uploadFileInternal(runtime, input, controls) {
 				uploadId: session.uploadId,
 				partNumber,
 				checksumSha256,
+				contentMd5: digests.partMd5s[index],
 				...validated.signal === void 0 ? {} : { signal: validated.signal }
 			});
 			const descriptor = descriptorResult.data;
@@ -2914,14 +3066,16 @@ async function uploadFileInternal(runtime, input, controls) {
 				status: descriptorResult.status,
 				requestId: descriptorResult.requestId
 			});
-			const etag = await putPart(runtime, descriptor, slicePart(validated.source, start, end, expectedByteLength), checksumSha256, validated.signal);
+			const etag = await putPart(runtime, descriptor, slicePart(validated.source, start, end, expectedByteLength), validated.signal);
 			revision = await recordPartWithReconciliation(controls, validated, session, partNumber, revision, expectedByteLength, etag, checksumSha256);
 			confirmedByteLength += expectedByteLength;
 			confirmedPartCount += 1;
 			emitProgress(validated.onProgress, "uploading", confirmedByteLength, validated.byteLength, confirmedPartCount, totalPartCount);
 		}
 		emitProgress(validated.onProgress, "completing", confirmedByteLength, validated.byteLength, confirmedPartCount, totalPartCount);
-		return await completeWithReconciliation(controls, validated, session, digests);
+		const completed = await completeWithReconciliation(controls, validated, session, digests);
+		if (completed.data.state === "verifying") emitProgress(validated.onProgress, "verifying", confirmedByteLength, validated.byteLength, confirmedPartCount, totalPartCount);
+		return completed;
 	} catch (error) {
 		if (validated.signal?.aborted && session) await bestEffortAbort(controls, validated.workspaceId, session.uploadId);
 		if (error instanceof DriveError) throw error;
@@ -2977,6 +3131,7 @@ async function readResumeState(controls, input, session, digests) {
 	if (session.mode === "presigned-multipart" && [
 		"completing",
 		"provider-completed",
+		"verifying",
 		"ready"
 	].includes(baseline.lifecycle) && confirmedParts.size !== session.partCount) throw new DriveError("invalid_response");
 	failForTerminalStatus(baseline.lifecycle, baselineRequestId);
@@ -3033,7 +3188,8 @@ async function completeWithReconciliation(controls, input, session, digests) {
 			idempotencyKey: input.completionIdempotencyKey,
 			...input.signal === void 0 ? {} : { signal: input.signal }
 		});
-		assertReadyMatchesInput(completed.data, session, input, digests, completed.requestId);
+		if (completed.data.state === "ready") assertReadyMatchesInput(completed.data, session, input, digests, completed.requestId);
+		else if (completed.data.itemId !== session.itemId || completed.data.versionId !== session.versionId || completed.data.uploadId !== session.uploadId || completed.data.totalByteLength !== input.byteLength) throw new DriveError("invalid_response");
 		return completed;
 	} catch (error) {
 		if (!isAmbiguousControlFailure(error) || input.signal?.aborted) throw error;
@@ -3054,6 +3210,7 @@ async function completeWithReconciliation(controls, input, session, digests) {
 async function hashSource(source, byteLength, partCount, signal) {
 	const fullHash = sha256.create();
 	const partChecksums = [];
+	const partMd5s = [];
 	for (let index = 0; index < partCount; index += 1) {
 		throwIfCallerAborted(signal);
 		const start = index * UPLOAD_PART_BYTE_LENGTH;
@@ -3070,13 +3227,15 @@ async function hashSource(source, byteLength, partCount, signal) {
 		const bytes = new Uint8Array(buffer);
 		fullHash.update(bytes);
 		partChecksums.push(toBase64(sha256(bytes)));
+		partMd5s.push(toBase64(md5(bytes)));
 	}
 	return Object.freeze({
 		callerDeclaredContentDigest: `sha256:${bytesToHex(fullHash.digest())}`,
-		partChecksums: Object.freeze(partChecksums)
+		partChecksums: Object.freeze(partChecksums),
+		partMd5s: Object.freeze(partMd5s)
 	});
 }
-async function putPart(runtime, descriptor, part, checksumSha256, callerSignal) {
+async function putPart(runtime, descriptor, part, callerSignal) {
 	const remainingMilliseconds = descriptor.expiresAtEpochMilliseconds - Date.now();
 	if (remainingMilliseconds < 1) throw new DriveError("invalid_response");
 	const operation = createOperationSignal(callerSignal, Math.min(runtime.timeoutMilliseconds, remainingMilliseconds));
@@ -3094,8 +3253,9 @@ async function putPart(runtime, descriptor, part, checksumSha256, callerSignal)
 		}), operation.signal);
 		if (!(response instanceof Response)) throw new DriveError("invalid_response");
 		const etag = response.headers.get("etag");
-		const responseChecksum = response.headers.get("x-amz-checksum-sha256");
-		if (response.status < 200 || response.status > 299 || !isEtag(etag) || responseChecksum !== checksumSha256) throw new DriveError("invalid_response", { status: response.status });
+		const md5Response = response.headers.get("content-md5");
+		const checksumMatches = md5Response === null || md5Response === descriptor.headers["content-md5"];
+		if (response.status < 200 || response.status > 299 || !isEtag(etag) || !checksumMatches) throw new DriveError("invalid_response", { status: response.status });
 		return etag;
 	} catch (error) {
 		if (operation.didTimeout()) throw new DriveError("timeout");
@@ -3131,7 +3291,7 @@ function failForTerminalStatus(lifecycle, requestId) {
 		status: 409,
 		...requestId === void 0 ? {} : { requestId }
 	});
-	if (lifecycle === "aborting" || lifecycle === "aborted") throw new DriveError("precondition_failed", {
+	if (lifecycle === "aborting" || lifecycle === "aborted" || lifecycle === "failed") throw new DriveError("precondition_failed", {
 		status: 409,
 		...requestId === void 0 ? {} : { requestId }
 	});