@gscdump/lakehouse 0.37.7 → 0.38.0

package/dist/_chunks/libs/fzstd.mjs

@@ -1,4 +1,8 @@
-var ab = ArrayBuffer, u8 = Uint8Array, u16 = Uint16Array, i16 = Int16Array, i32 = Int32Array;
+var ab = ArrayBuffer;
+var u8 = Uint8Array;
+var u16 = Uint16Array;
+var i16 = Int16Array;
+var i32 = Int32Array;
 var slc = function(v, s, e) {
 	if (u8.prototype.slice) return u8.prototype.slice.call(v, s, e);
 	if (s == null || s < 0) s = 0;

package/dist/_chunks/libs/hyparquet-writer.d.mts

@@ -0,0 +1,23 @@
+interface Writer$1 {
+  buffer: ArrayBuffer;
+  view: DataView;
+  offset: number; // total bytes written
+  ensure(size: number): void;
+  flush?(): void | Promise<void>;
+  finish(): void | Promise<void>;
+  getBuffer(): ArrayBuffer;
+  getBytes(): Uint8Array;
+  appendUint8(value: number): void;
+  appendUint32(value: number): void;
+  appendInt32(value: number): void;
+  appendInt64(value: bigint): void;
+  appendFloat32(value: number): void;
+  appendFloat64(value: number): void;
+  appendBuffer(buffer: ArrayBuffer): void;
+  appendBytes(value: Uint8Array): void;
+  appendVarInt(value: number): void;
+  appendVarBigInt(value: bigint): void;
+  appendZigZag(value: number | bigint): void;
+}
+type Writer = Writer$1;
+export { Writer };

package/dist/_chunks/libs/icebird.d.mts

@@ -1,5 +1,5 @@
 import { AsyncBuffer } from "./hyparquet.mjs";
-import { Writer } from "hyparquet-writer/src/types.js";
+import { Writer } from "./hyparquet-writer.mjs";
 interface WriterOptions {
   /**
    * If `'*'`, the writer must create the object only if it does not already
@@ -24,6 +24,8 @@ interface RestCatalogContext {
   defaults: Record<string, string>;
   overrides: Record<string, string>;
   requestInit?: RequestInit;
+  /** Optional per-request auth hook (e.g. SigV4 signing). Called after merging requestInit. */
+  signRequest?: (url: string, init?: RequestInit) => Promise<RequestInit>;
 }
 interface FileCatalog {
   type: 'file';
@@ -140,7 +142,8 @@ interface Snapshot {
   manifests?: Manifest[];
   summary: {
     // spec: "value of these fields should be of string type"
-    operation: string; // 'spark.app.id'?: string
+    operation: string;
+    // 'spark.app.id'?: string
     'added-data-files'?: string;
     'added-records'?: string;
     'deleted-data-files'?: string;
@@ -189,9 +192,6 @@ interface EncryptionKey {
   'key-id': string;
   'key-metadata': string;
 }
-/**
- * Iceberg REST `TableRequirement`s recognized by `checkRequirements`.
- */
 interface MetadataLog {
   'timestamp-ms': number;
   'metadata-file': string;
@@ -210,7 +210,8 @@ interface Manifest {
   added_rows_count: bigint;
   existing_rows_count: bigint;
   deleted_rows_count: bigint;
-  partitions?: FieldSummary[]; // key_metadata?: unknown
+  partitions?: FieldSummary[];
+  // key_metadata?: unknown
   first_row_id?: bigint | number;
 }
 interface ManifestEntry {
@@ -239,7 +240,8 @@ interface DataFile {
   null_value_counts?: Record<number, bigint>;
   nan_value_counts?: Record<number, bigint>;
   lower_bounds?: Record<number, unknown>;
-  upper_bounds?: Record<number, unknown>; // key_metadata?: string
+  upper_bounds?: Record<number, unknown>;
+  // key_metadata?: string
   split_offsets?: bigint[];
   equality_ids?: number[];
   sort_order_id?: number;
@@ -248,82 +250,6 @@ interface DataFile {
   content_offset?: bigint;
   content_size_in_bytes?: bigint;
 }
-/**
- * Build a SigV4-signing `Resolver` for private S3-compatible buckets (AWS S3,
- * Cloudflare R2, MinIO, etc.). Signs every request with AWS Signature V4
- * using static credentials. Works in browsers and Node via the Web Crypto API.
- *
- * Credentials are taken as inputs; profile/STS/IMDS chains are out of scope.
- * For Iceberg REST catalogs that vend per-table credentials (R2, AWS Glue),
- * pass the `s3.*` keys from `restCatalogLoadCredentials` or `LoadTable.config`.
- *
- * Accepts paths as `s3://bucket/key`, `s3a://bucket/key`, or full https URLs.
- *
- * @param {object} options
- * @param {string} options.accessKeyId
- * @param {string} options.secretAccessKey
- * @param {string} [options.sessionToken] - For temporary credentials (STS/vended).
- * @param {string} options.region - e.g. 'us-east-1', or 'auto' for R2.
- * @param {string} [options.endpoint] - HTTPS endpoint root for non-AWS providers
- *   (e.g. `https://<account>.r2.cloudflarestorage.com`). Defaults to AWS S3.
- * @param {boolean} [options.pathStyle] - When true, URLs are
- *   `<endpoint>/<bucket>/<key>`; when false (default), virtual-hosted-style
- *   `<bucket>.<endpoint-host>/<key>`. R2 requires true.
- * @returns {Resolver}
- */
-declare function s3SignedResolver({
-  accessKeyId,
-  secretAccessKey,
-  sessionToken,
-  region,
-  endpoint,
-  pathStyle
-}: {
-  accessKeyId: string;
-  secretAccessKey: string;
-  sessionToken?: string | undefined;
-  region: string;
-  endpoint?: string | undefined;
-  pathStyle?: boolean | undefined;
-}): Resolver;
-/**
- * Returns manifest entries for a snapshot. Defaults to the current snapshot;
- * pass `snapshotId` to time-travel to a prior snapshot in the metadata's
- * snapshot log.
- *
- * @import {Resolver, TableMetadata, Manifest, ManifestEntry} from '../src/types.js'
- * @typedef {{ url: string, entries: ManifestEntry[] }[]} ManifestList
- * @param {object} options
- * @param {TableMetadata} options.metadata
- * @param {Resolver} [options.resolver]
- * @param {number | bigint} [options.snapshotId] - Optional snapshot id; defaults to `current-snapshot-id`.
- * @returns {Promise<ManifestList>}
- */
-declare function icebergManifests({
-  metadata,
-  resolver,
-  snapshotId,
-  partitionFilter
-}: {
-  metadata: TableMetadata;
-  resolver?: Resolver | undefined;
-  snapshotId?: number | bigint | undefined;
-  partitionFilter?: ManifestPartitionFilter | undefined;
-}): Promise<ManifestList>;
-/**
- * Predicate applied to each manifest's manifest-list `partitions` field-summary
- * array before entry fetch. Return `false` to skip the manifest's entry fetch.
- */
-type ManifestPartitionFilter = (partitions: Manifest['partitions'], partitionSpecId: number, manifest: Manifest) => boolean;
-/**
- * Returns manifest entries for a snapshot. Defaults to the current snapshot;
- * pass `snapshotId` to time-travel to a prior snapshot in the metadata's
- * snapshot log.
- */
-type ManifestList = {
-  url: string;
-  entries: ManifestEntry[];
-}[];
 /**
  * Append rows to a table in one call: load metadata, stage the parquet writes
  * + manifest + new snapshot, commit through the catalog.
@@ -338,24 +264,15 @@ type ManifestList = {
  * @param {number} [options.sortOrderId] - Sort order id to apply; defaults to the table default.
  * @returns {Promise<TableMetadata>}
  */
-declare function icebergAppend({
-  catalog,
-  namespace,
-  table,
-  tableUrl,
-  resolver,
-  records,
-  sortOrderId,
-  snapshotProperties
-}: {
+declare function icebergAppend({ catalog, namespace, table, tableUrl, resolver, records, sortOrderId, snapshotProperties }: {
   catalog: Catalog;
-  namespace?: string | string[] | undefined;
-  table?: string | undefined;
-  tableUrl?: string | undefined;
-  resolver?: Resolver | undefined;
+  namespace?: string | string[];
+  table?: string;
+  tableUrl?: string;
+  resolver?: Resolver;
   records: Record<string, any>[];
-  sortOrderId?: number | undefined;
-  snapshotProperties?: Record<string, string> | undefined;
+  sortOrderId?: number;
+  snapshotProperties?: Record<string, string>;
 }): Promise<TableMetadata>;
 /**
  * Create a new table. REST: delegates to the catalog's create endpoint.
@@ -375,28 +292,17 @@ declare function icebergAppend({
  * @param {boolean} [options.stageCreate] - REST catalog only.
  * @returns {Promise<TableMetadata>}
  */
-declare function icebergCreateTable({
-  catalog,
-  namespace,
-  table,
-  tableUrl,
-  schema,
-  partitionSpec,
-  sortOrder,
-  properties,
-  formatVersion,
-  stageCreate
-}: {
+declare function icebergCreateTable({ catalog, namespace, table, tableUrl, schema, partitionSpec, sortOrder, properties, formatVersion, stageCreate }: {
   catalog: Catalog;
-  namespace?: string | string[] | undefined;
-  table?: string | undefined;
-  tableUrl?: string | undefined;
-  schema?: Schema | undefined;
-  partitionSpec?: PartitionSpec | undefined;
-  sortOrder?: SortOrder | undefined;
-  properties?: Record<string, string> | undefined;
-  formatVersion?: 2 | 3 | undefined;
-  stageCreate?: boolean | undefined;
+  namespace?: string | string[];
+  table?: string;
+  tableUrl?: string;
+  schema?: Schema;
+  partitionSpec?: PartitionSpec;
+  sortOrder?: SortOrder;
+  properties?: Record<string, string>;
+  formatVersion?: 2 | 3;
+  stageCreate?: boolean;
 }): Promise<TableMetadata>;
 /**
  * Drop a table. REST: delegates to the catalog's drop endpoint, forwarding
@@ -413,20 +319,13 @@ declare function icebergCreateTable({
  * @param {boolean} [options.purgeRequested] - REST: forwarded to the server. File: also delete `data/`.
  * @returns {Promise<void>}
  */
-declare function icebergDropTable({
-  catalog,
-  namespace,
-  table,
-  tableUrl,
-  lister,
-  purgeRequested
-}: {
+declare function icebergDropTable({ catalog, namespace, table, tableUrl, lister, purgeRequested }: {
   catalog: Catalog;
-  namespace?: string | string[] | undefined;
-  table?: string | undefined;
-  tableUrl?: string | undefined;
-  lister?: Lister | undefined;
-  purgeRequested?: boolean | undefined;
+  namespace?: string | string[];
+  table?: string;
+  tableUrl?: string;
+  lister?: Lister;
+  purgeRequested?: boolean;
 }): Promise<void>;
 /**
  * Iceberg REST Catalog client.
@@ -447,16 +346,14 @@ declare function icebergDropTable({
  * @param {string} options.url - catalog base URL, with or without trailing slash
  * @param {string} [options.warehouse] - optional warehouse query param sent to /v1/config
  * @param {RequestInit} [options.requestInit] - fetch options (e.g. Authorization header)
+ * @param {(url: string, init?: RequestInit) => Promise<RequestInit>} [options.signRequest] - per-request auth hook
  * @returns {Promise<RestCatalogContext>}
  */
-declare function restCatalogConnect({
-  url,
-  warehouse,
-  requestInit
-}: {
+declare function restCatalogConnect({ url, warehouse, requestInit, signRequest }: {
   url: string;
-  warehouse?: string | undefined;
-  requestInit?: RequestInit | undefined;
+  warehouse?: string;
+  requestInit?: RequestInit;
+  signRequest?: (url: string, init?: RequestInit) => Promise<RequestInit>;
 }): Promise<RestCatalogContext>;
 /**
  * List tables within a namespace.
@@ -467,9 +364,7 @@ declare function restCatalogConnect({
  * @param {string | string[]} options.namespace
  * @returns {Promise<TableIdentifier[]>}
  */
-declare function restCatalogListTables(ctx: RestCatalogContext, {
-  namespace
-}: {
+declare function restCatalogListTables(ctx: RestCatalogContext, { namespace }: {
   namespace: string | string[];
 }): Promise<TableIdentifier[]>;
 /**
@@ -485,10 +380,7 @@ declare function restCatalogListTables(ctx: RestCatalogContext, {
  * @param {string} options.table
  * @returns {Promise<LoadTableResponse>}
  */
-declare function restCatalogLoadTable(ctx: RestCatalogContext, {
-  namespace,
-  table
-}: {
+declare function restCatalogLoadTable(ctx: RestCatalogContext, { namespace, table }: {
   namespace: string | string[];
   table: string;
 }): Promise<LoadTableResponse>;
@@ -502,12 +394,9 @@ declare function restCatalogLoadTable(ctx: RestCatalogContext, {
  * @param {Record<string, string>} [options.properties]
  * @returns {Promise<{namespace: string[], properties: Record<string, string>}>}
  */
-declare function restCatalogCreateNamespace(ctx: RestCatalogContext, {
-  namespace,
-  properties
-}: {
+declare function restCatalogCreateNamespace(ctx: RestCatalogContext, { namespace, properties }: {
   namespace: string | string[];
-  properties?: Record<string, string> | undefined;
+  properties?: Record<string, string>;
 }): Promise<{
   namespace: string[];
   properties: Record<string, string>;
@@ -546,4 +435,66 @@ declare function restCatalogCreateNamespace(ctx: RestCatalogContext, {
  * @returns {Resolver}
  */
 declare function cachingResolver(base: Resolver): Resolver;
+/**
+ * @import {Resolver} from '../src/types.js'
+ */
+/**
+ * Build a SigV4-signing `Resolver` for private S3-compatible buckets (AWS S3,
+ * Cloudflare R2, MinIO, etc.). Signs every request with AWS Signature V4
+ * using static credentials. Works in browsers and Node via the Web Crypto API.
+ *
+ * Credentials are taken as inputs; profile/STS/IMDS chains are out of scope.
+ * For Iceberg REST catalogs that vend per-table credentials (R2, AWS Glue),
+ * pass the `s3.*` keys from `restCatalogLoadCredentials` or `LoadTable.config`.
+ *
+ * Accepts paths as `s3://bucket/key`, `s3a://bucket/key`, or full https URLs.
+ *
+ * @param {object} options
+ * @param {string} options.accessKeyId
+ * @param {string} options.secretAccessKey
+ * @param {string} [options.sessionToken] - For temporary credentials (STS/vended).
+ * @param {string} options.region - e.g. 'us-east-1', or 'auto' for R2.
+ * @param {string} [options.endpoint] - HTTPS endpoint root for non-AWS providers
+ *   (e.g. `https://<account>.r2.cloudflarestorage.com`). Defaults to AWS S3.
+ * @param {boolean} [options.pathStyle] - When true, URLs are
+ *   `<endpoint>/<bucket>/<key>`; when false (default), virtual-hosted-style
+ *   `<bucket>.<endpoint-host>/<key>`. R2 requires true.
+ * @returns {Resolver}
+ */
+declare function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region, endpoint, pathStyle }: {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  region: string;
+  endpoint?: string;
+  pathStyle?: boolean;
+}): Resolver;
+type ManifestList = {
+  url: string;
+  entries: ManifestEntry[];
+}[];
+/**
+ * Predicate applied to each manifest's manifest-list `partitions` field-summary
+ * array before entry fetch. Return `false` to skip the manifest's entry fetch.
+ */
+type ManifestPartitionFilter = (partitions: Manifest['partitions'], partitionSpecId: number, manifest: Manifest) => boolean;
+/**
+ * Returns manifest entries for a snapshot. Defaults to the current snapshot;
+ * pass `snapshotId` to time-travel to a prior snapshot in the metadata's
+ * snapshot log.
+ *
+ * @import {Resolver, TableMetadata, Manifest, ManifestEntry} from '../src/types.js'
+ * @typedef {{ url: string, entries: ManifestEntry[] }[]} ManifestList
+ * @param {object} options
+ * @param {TableMetadata} options.metadata
+ * @param {Resolver} [options.resolver]
+ * @param {number | bigint} [options.snapshotId] - Optional snapshot id; defaults to `current-snapshot-id`.
+ * @returns {Promise<ManifestList>}
+ */
+declare function icebergManifests({ metadata, resolver, snapshotId, partitionFilter }: {
+  metadata: TableMetadata;
+  resolver?: Resolver;
+  snapshotId?: number | bigint;
+  partitionFilter?: ManifestPartitionFilter;
+}): Promise<ManifestList>;
 export { cachingResolver, icebergAppend, icebergCreateTable, icebergDropTable, icebergManifests, restCatalogConnect, restCatalogCreateNamespace, restCatalogListTables, restCatalogLoadTable, s3SignedResolver };

package/dist/_chunks/libs/icebird.mjs

@@ -103,7 +103,23 @@ function readType(reader, type) {
 			for (let i = 0; i < count; i++) arr.push(readType(reader, type.items));
 		}
 		return arr;
-	} else if (typeof type === "object" && type.logicalType) if (type.logicalType === "date" && type.type === "int") {
+	} else if (typeof type === "object" && type.type === "map") {
+		const map = {};
+		while (true) {
+			let count = readZigZag(reader);
+			if (count === 0) break;
+			if (count < 0) {
+				count = -count;
+				readZigZag(reader);
+			}
+			for (let i = 0; i < count; i++) {
+				const key = readType(reader, "string");
+				map[key] = readType(reader, type.values);
+			}
+		}
+		return map;
+	} else if (typeof type === "object" && type.type === "enum") return type.symbols[readZigZag(reader)];
+	else if (typeof type === "object" && "logicalType" in type && type.logicalType) if (type.logicalType === "date" && type.type === "int") {
 		const value = readZigZag(reader);
 		return /* @__PURE__ */ new Date(value * 864e5);
 	} else if (type.logicalType === "time-millis" && type.type === "int") return readZigZag(reader);
@@ -152,7 +168,8 @@ function readType(reader, type) {
 		const text = new TextDecoder().decode(bytes);
 		reader.offset += length;
 		return text;
-	} else throw new Error(`unsupported type: ${type}`);
+	} else if (typeof type === "object" && typeof type.type === "string") return readType(reader, type.type);
+	else throw new Error(`unsupported type: ${JSON.stringify(type)}`);
 }
 function readFixed(reader, size) {
 	const bytes = new Uint8Array(reader.view.buffer, reader.view.byteOffset + reader.offset, size);
@@ -638,23 +655,27 @@ function metadataFilePreference(file, paddedVersion) {
 	if (file.startsWith(`${paddedVersion}-`) && file.endsWith(".metadata.json.gz")) return 5;
 	return 6;
 }
-async function restCatalogConnect({ url, warehouse, requestInit }) {
+async function restCatalogConnect({ url, warehouse, requestInit, signRequest }) {
 	const base = url.replace(/\/$/, "");
 	const configUrl = warehouse ? `${base}/v1/config?warehouse=${encodeURIComponent(warehouse)}` : `${base}/v1/config`;
-	const res = await fetch(configUrl, requestInit);
+	let init = requestInit;
+	if (signRequest) init = await signRequest(configUrl, init);
+	const res = await fetch(configUrl, init);
 	if (!res.ok) await throwRestError(res);
 	const body = parseIcebergJson(await res.text());
 	const defaults = body.defaults ?? {};
 	const overrides = body.overrides ?? {};
 	const prefix = overrides.prefix ?? defaults.prefix ?? "";
-	return Object.freeze({
+	const ctx = {
 		type: "rest",
 		url: base,
 		prefix: typeof prefix === "string" ? prefix : "",
 		defaults,
 		overrides,
 		requestInit
-	});
+	};
+	if (signRequest) ctx.signRequest = signRequest;
+	return Object.freeze(ctx);
 }
 function restCatalogListTables(ctx, { namespace }) {
 	const ns = encodeNamespace(namespace);
@@ -735,7 +756,8 @@ function encodeNamespace(namespace) {
 async function restFetch(ctx, path, init) {
 	const prefixSegment = ctx.prefix ? `${ctx.prefix.replace(/^\/|\/$/g, "")}/` : "";
 	const fullUrl = `${ctx.url}/v1/${prefixSegment}${path}`;
-	const merged = mergeRequestInit(ctx.requestInit, init);
+	let merged = mergeRequestInit(ctx.requestInit, init);
+	if (ctx.signRequest) merged = await ctx.signRequest(fullUrl, merged);
 	const res = await fetch(fullUrl, merged);
 	if (!res.ok) await throwRestError(res);
 	return res;
@@ -1843,7 +1865,7 @@ function writeType(writer, schema, value) {
 	if (Array.isArray(schema)) {
 		const unionIndex = schema.findIndex((s) => {
 			if (Array.isArray(s)) throw new Error("nested unions not supported");
-			const tag = typeof s === "string" ? s : s.type === "record" || s.type === "array" || s.type === "fixed" ? s.type : s.logicalType;
+			const tag = typeof s === "string" ? s : s.type === "record" || s.type === "array" || s.type === "fixed" ? s.type : "logicalType" in s && s.logicalType ? s.logicalType : s.type;
 			if (value == null) return tag === "null";
 			if (tag === "boolean") return typeof value === "boolean";
 			if (tag === "int") return typeof value === "number" && Number.isInteger(value);
@@ -3552,6 +3574,74 @@ function isCommitConflict(err) {
 	return status === 412 || status === 409;
 }
 const enc = new TextEncoder();
+async function signRequest(method, url, body, { accessKeyId, secretAccessKey, sessionToken, region, service, extraHeaders = {} }) {
+	const u = new URL(url);
+	const xAmzDate = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]|\.\d{3}/g, "");
+	const dStamp = xAmzDate.slice(0, 8);
+	const payloadHash = body !== void 0 ? await sha256hex(body) : await sha256hex("");
+	const lc = {};
+	for (const [k, v] of Object.entries(extraHeaders)) lc[k.toLowerCase()] = String(v);
+	lc["host"] = u.host;
+	lc["x-amz-date"] = xAmzDate;
+	lc["x-amz-content-sha256"] = payloadHash;
+	if (sessionToken) lc["x-amz-security-token"] = sessionToken;
+	const sortedKeys = Object.keys(lc).sort();
+	const canonicalHeaders = sortedKeys.map((k) => `${k}:${lc[k].trim().replace(/\s+/g, " ")}\n`).join("");
+	const signedHeaders = sortedKeys.join(";");
+	const doubleEncodePath = service !== "s3";
+	const canonicalRequest = [
+		method,
+		u.pathname.split("/").map((seg) => doubleEncodePath ? encodeRfc3986(seg) : encodeRfc3986(decodeURIComponent(seg))).join("/"),
+		[...u.searchParams.entries()].sort((a, b) => {
+			if (a[0] !== b[0]) return a[0] < b[0] ? -1 : 1;
+			return a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0;
+		}).map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join("&"),
+		canonicalHeaders,
+		signedHeaders,
+		payloadHash
+	].join("\n");
+	const credentialScope = `${dStamp}/${region}/${service}/aws4_request`;
+	const stringToSign = [
+		"AWS4-HMAC-SHA256",
+		xAmzDate,
+		credentialScope,
+		await sha256hex(canonicalRequest)
+	].join("\n");
+	const signature = bytesToHex(await hmac(await deriveSigningKey(secretAccessKey, dStamp, region, service), stringToSign));
+	const out = {};
+	for (const [k, v] of Object.entries(lc)) {
+		if (k === "host") continue;
+		out[k] = v;
+	}
+	out["Authorization"] = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+	return out;
+}
+async function sha256hex(data) {
+	const bytes = typeof data === "string" ? enc.encode(data) : data;
+	const hash = await crypto.subtle.digest("SHA-256", bytes);
+	return bytesToHex(new Uint8Array(hash));
+}
+async function hmac(key, data) {
+	const keyBytes = typeof key === "string" ? enc.encode(key) : key;
+	const dataBytes = typeof data === "string" ? enc.encode(data) : data;
+	const cryptoKey = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const sig = await crypto.subtle.sign("HMAC", cryptoKey, dataBytes);
+	return new Uint8Array(sig);
+}
+async function deriveSigningKey(secret, dateStamp, region, service) {
+	return await hmac(await hmac(await hmac(await hmac(`AWS4${secret}`, dateStamp), region), service), "aws4_request");
+}
+function encodeRfc3986(str) {
+	return encodeURIComponent(str).replace(/[!*'()]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+}
+function bytesToHex(bytes) {
+	let s = "";
+	for (const b of bytes) s += b.toString(16).padStart(2, "0");
+	return s;
+}
 function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region, endpoint, pathStyle = false }) {
 	const ep = endpoint ? new URL(endpoint.replace(/\/$/, "") + "/") : void 0;
 	function toHttps(url) {
@@ -3565,55 +3655,25 @@ function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region,
 			if (pathStyle) return `${ep.origin}${ep.pathname}${bucket}/${key}`;
 			return `${ep.protocol}//${bucket}.${ep.host}/${key}`;
 		}
+		if (region && region !== "us-east-1" && region !== "auto") return `https://${bucket}.s3.${region}.amazonaws.com/${key}`;
 		return `https://${bucket}.s3.amazonaws.com/${key}`;
 	}
-	async function signRequest(method, url, body, extra = {}) {
-		const u = new URL(url);
-		const xAmzDate = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]|\.\d{3}/g, "");
-		const dStamp = xAmzDate.slice(0, 8);
-		const payloadHash = body !== void 0 ? await sha256hex(body) : await sha256hex("");
-		const lc = {};
-		for (const [k, v] of Object.entries(extra)) lc[k.toLowerCase()] = String(v);
-		lc["host"] = u.host;
-		lc["x-amz-date"] = xAmzDate;
-		lc["x-amz-content-sha256"] = payloadHash;
-		if (sessionToken) lc["x-amz-security-token"] = sessionToken;
-		const sortedKeys = Object.keys(lc).sort();
-		const canonicalHeaders = sortedKeys.map((k) => `${k}:${lc[k].trim().replace(/\s+/g, " ")}\n`).join("");
-		const signedHeaders = sortedKeys.join(";");
-		const canonicalRequest = [
-			method,
-			u.pathname.split("/").map((seg) => encodeRfc3986(decodeURIComponent(seg))).join("/"),
-			[...u.searchParams.entries()].sort((a, b) => {
-				if (a[0] !== b[0]) return a[0] < b[0] ? -1 : 1;
-				return a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0;
-			}).map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join("&"),
-			canonicalHeaders,
-			signedHeaders,
-			payloadHash
-		].join("\n");
-		const credentialScope = `${dStamp}/${region}/s3/aws4_request`;
-		const stringToSign = [
-			"AWS4-HMAC-SHA256",
-			xAmzDate,
-			credentialScope,
-			await sha256hex(canonicalRequest)
-		].join("\n");
-		const signature = bytesToHex(await hmac(await deriveSigningKey(secretAccessKey, dStamp, region, "s3"), stringToSign));
-		const out = {};
-		for (const [k, v] of Object.entries(lc)) {
-			if (k === "host") continue;
-			out[k] = v;
-		}
-		out["Authorization"] = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
-		return out;
+	function signRequest$1(method, url, body, extra = {}) {
+		return signRequest(method, url, body, {
+			accessKeyId,
+			secretAccessKey,
+			sessionToken,
+			region,
+			service: "s3",
+			extraHeaders: extra
+		});
 	}
 	return {
 		async reader(path, byteLength) {
 			const url = toHttps(path);
 			let len = byteLength;
 			if (len === void 0) {
-				const headers = await signRequest("HEAD", url);
+				const headers = await signRequest$1("HEAD", url);
 				const res = await fetch(url, {
 					method: "HEAD",
 					headers
@@ -3627,7 +3687,7 @@ function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region,
 				byteLength: fileLength,
 				async slice(start, end) {
 					const range = `bytes=${start}-${(end ?? fileLength) - 1}`;
-					const headers = await signRequest("GET", url, void 0, { range });
+					const headers = await signRequest$1("GET", url, void 0, { range });
 					const res = await fetch(url, {
 						method: "GET",
 						headers
@@ -3644,7 +3704,7 @@ function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region,
 				const body = w.getBytes().slice();
 				const extra = {};
 				if (options?.ifNoneMatch) extra["if-none-match"] = options.ifNoneMatch;
-				const headers = await signRequest("PUT", url, body, extra);
+				const headers = await signRequest$1("PUT", url, body, extra);
 				const res = await fetch(url, {
 					method: "PUT",
 					headers,
@@ -3660,7 +3720,7 @@ function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region,
 		},
 		async deleter(path) {
 			const url = toHttps(path);
-			const headers = await signRequest("DELETE", url);
+			const headers = await signRequest$1("DELETE", url);
 			const res = await fetch(url, {
 				method: "DELETE",
 				headers
@@ -3669,32 +3729,6 @@ function s3SignedResolver({ accessKeyId, secretAccessKey, sessionToken, region,
 		}
 	};
 }
-async function sha256hex(data) {
-	const bytes = typeof data === "string" ? enc.encode(data) : data;
-	const hash = await crypto.subtle.digest("SHA-256", bytes);
-	return bytesToHex(new Uint8Array(hash));
-}
-async function hmac(key, data) {
-	const keyBytes = typeof key === "string" ? enc.encode(key) : key;
-	const dataBytes = typeof data === "string" ? enc.encode(data) : data;
-	const cryptoKey = await crypto.subtle.importKey("raw", keyBytes, {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const sig = await crypto.subtle.sign("HMAC", cryptoKey, dataBytes);
-	return new Uint8Array(sig);
-}
-async function deriveSigningKey(secret, dateStamp, region, service) {
-	return await hmac(await hmac(await hmac(await hmac(`AWS4${secret}`, dateStamp), region), service), "aws4_request");
-}
-function encodeRfc3986(str) {
-	return encodeURIComponent(str).replace(/[!*'()]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
-}
-function bytesToHex(bytes) {
-	let s = "";
-	for (const b of bytes) s += b.toString(16).padStart(2, "0");
-	return s;
-}
 (() => {
 	if (typeof setImmediate === "function") return () => new Promise((resolve) => setImmediate(resolve));
 	if (typeof MessageChannel !== "undefined") {
@@ -3711,4 +3745,5 @@ function bytesToHex(bytes) {
 	}
 	return () => new Promise((resolve) => setTimeout(resolve, 0));
 })();
+new TextEncoder();
 export { cachingResolver, icebergAppend, icebergCreateTable, icebergDropTable, icebergManifests, restCatalogConnect, restCatalogCreateNamespace, restCatalogListTables, restCatalogLoadTable, s3SignedResolver };

package/dist/_chunks/libs/ioredis.d.mts

@@ -1 +1,2 @@
-export { };
+/// <reference types="node" />
+import "./denque.mjs";

package/dist/_chunks/libs/unstorage.d.mts

@@ -1,3 +1,7 @@
+import "./db0.mjs";
+import "./chokidar.mjs";
+import "./lru-cache.mjs";
+import "./ioredis.mjs";
 type StorageValue = null | string | number | boolean | object;
 type WatchEvent = "update" | "remove";
 type WatchCallback = (event: WatchEvent, key: string) => any;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gscdump/lakehouse",
   "type": "module",
-  "version": "0.37.7",
+  "version": "0.38.0",
   "description": "Dataset-agnostic Iceberg lakehouse layer + dataset registry for R2 Data Catalog producers (ADR-0021).",
   "author": {
     "name": "Harlan Wilton",
@@ -46,11 +46,11 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@types/node": "^26.1.0",
+    "@types/node": "^26.1.1",
     "hyparquet": "^1.26.2",
-    "icebird": "^0.8.13",
+    "icebird": "^0.8.15",
     "unstorage": "^1.17.5",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "dev": "obuild --stub",