@hasna/instructions 0.6.1 → 0.7.1

package/dist/chunks/index-fpeyzn3n.js

@@ -0,0 +1,186 @@
+// @bun
+// src/lib/raw-store-root.ts
+import { resolve as resolve2 } from "path";
+
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function configDir(options) {
+  return pathsResolverResolve("config", options);
+}
+var HASNA_CONFIGS_HOME_ENV = "HASNA_CONFIGS_HOME";
+function homeDir(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir();
+}
+function legacyStoreHome(env = process.env) {
+  return resolve(join(homeDir(env), ".hasna", "instructions"));
+}
+function resolverStoreHome(env = process.env) {
+  return configDir({ app: "configs", env, home: env.HOME || env.USERPROFILE || homedir() });
+}
+function adoptResolverStoreHome(resolved, env = process.env) {
+  const override = env.HASNA_CONFIG_HOME;
+  if (typeof override === "string" && override.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, "instructions.db"));
+}
+function exactStoreHome(env = process.env) {
+  const v = env[HASNA_CONFIGS_HOME_ENV];
+  return v && v.trim() ? v.trim() : undefined;
+}
+function getConfigsStoreHome(env = process.env) {
+  const exact = exactStoreHome(env);
+  if (exact)
+    return resolve(exact);
+  const resolved = resolverStoreHome(env);
+  return adoptResolverStoreHome(resolved, env) ? resolve(resolved) : legacyStoreHome(env);
+}
+
+// src/lib/raw-store-root.ts
+function getRawStoreRoot(env = process.env) {
+  return resolve2(getConfigsStoreHome(env));
+}
+
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/transport.js
+import { createRequire } from "module";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+
+// src/lib/local-opt-in.ts
+var INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_INSTRUCTIONS_LOCAL"];
+function instructionsLocalModeNotice() {
+  return `instructions: local mode \u2014 ${INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 selects the on-box SQLite store, ` + `and no hosted authority was configured. Set HASNA_INSTRUCTIONS_API_KEY (or add the Keychain item ` + `hasna.credentials.instructions.api-key, or write ~/.hasna/instructions/config/credentials) to go hosted.`;
+}
+function isInstructionsLocalOptIn(env = process.env) {
+  return INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() === "1");
+}
+function instructionsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("instructions");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("instructions"),
+    credentialPointerEnvKey("instructions"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasInstructionsEnvAuthorityIntent(env = process.env) {
+  return instructionsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsInstructionsLocalStore(env = process.env) {
+  return !hasInstructionsEnvAuthorityIntent(env) && isInstructionsLocalOptIn(env);
+}
+function instructionsResolverEnv(env) {
+  const blanks = instructionsAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env;
+  const next = { ...env };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientInstructionsEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function instructionsResolverInputs(env, credentials = {}) {
+  const normalised = instructionsResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientInstructionsEnv(env);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
+
+export { getRawStoreRoot, clientTransportEnvKeys, INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS, instructionsLocalModeNotice, hasInstructionsEnvAuthorityIntent, selectsInstructionsLocalStore, instructionsResolverInputs };

package/dist/chunks/{index-9p9gn7gh.js → index-jg8ptcwh.js}

@@ -1,10 +1,11 @@
 // @bun
 import {
   applyConfigsWithReport,
+  compactPathForConfigHome,
   expandPath,
   getConfigHome,
   normalizeTargetPath
-} from "./index-axhwg61p.js";
+} from "./index-ypcef3a2.js";
 import {
   applyTransform,
   detectMachineContext,
@@ -12,7 +13,7 @@ import {
   resolveConfigStore,
   retiredOrUnsupportedAgentReason,
   templateizeMachineContent
-} from "./index-v7dkb384.js";
+} from "./index-aj66f6xr.js";
 import {
   isSecretVarName,
   redactContent,
@@ -26,7 +27,6 @@ import { basename, extname, join as join2 } from "path";
 // src/lib/sync-dir.ts
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { join, relative } from "path";
-import { homedir } from "os";
 var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
@@ -38,7 +38,6 @@ async function syncFromDir(dir, opts = {}) {
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
   const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join(absDir, f)).filter((f) => statSync(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -51,7 +50,7 @@ async function syncFromDir(dir, opts = {}) {
         result.skipped.push(file + " (too large)");
         continue;
       }
-      const targetPath = file.replace(home, "~");
+      const targetPath = compactPathForConfigHome(file);
       const redacted = redactContent(content, redactFormatForTarget(targetPath, detectFormat(file)));
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
@@ -73,9 +72,8 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir();
   const absDir = expandPath(dir);
-  const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
+  const normalized = dir.startsWith("~/") ? dir : compactPathForConfigHome(absDir);
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   for (const config of configs) {

package/dist/chunks/index-mvckkf15.js

@@ -0,0 +1,363 @@
+// @bun
+// src/storage/s3-object-store.ts
+import { createHash, createHmac } from "crypto";
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+var VERSION_ID_PATTERN = /^[^\u0000-\u001f\u007f]{1,1024}$/;
+var CONDITIONAL_CREATE_ATTEMPTS = 3;
+var DEFAULT_EXISTS_DEADLINE_MS = 5000;
+var DEFAULT_BYTES_DEADLINE_MS = 15000;
+var DEFAULT_STAT_DEADLINE_MS = 5000;
+var DEFAULT_VERSIONED_READ_DEADLINE_MS = 15000;
+var DEFAULT_CONDITIONAL_CREATE_ATTEMPT_DEADLINE_MS = 15000;
+var DEFAULT_EXISTENCE_RECONCILIATION_DEADLINE_MS = 5000;
+var MAX_OPERATION_DEADLINE_MS = 60000;
+var EMPTY_SHA256 = createHash("sha256").update("").digest("hex");
+function resolveOperationDeadlineMs(value, fallback, label) {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0 || resolved > MAX_OPERATION_DEADLINE_MS) {
+    throw new Error(`${label} must be an integer between 1 and ${MAX_OPERATION_DEADLINE_MS} milliseconds`);
+  }
+  return resolved;
+}
+async function runWithDeadline(operation, deadlineMs, onDeadline) {
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      try {
+        onDeadline?.();
+      } finally {
+        reject(new Error("Instructions S3 operation deadline exceeded"));
+      }
+    }, deadlineMs);
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(operation), deadline]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+}
+function assertSafeInstructionsObjectKey(key) {
+  if (!key || key.length > 1024 || key.startsWith("/") || key.endsWith("/") || key.includes("\\") || CONTROL_CHARACTERS.test(key)) {
+    throw new Error("Instructions S3 object key is invalid");
+  }
+  for (const segment of key.split("/")) {
+    if (!segment || segment === "." || segment === "..") {
+      throw new Error("Instructions S3 object key contains an unsafe path segment");
+    }
+  }
+}
+function assertSafeInstructionsObjectVersionId(versionId) {
+  if (!VERSION_ID_PATTERN.test(versionId) || versionId.trim() !== versionId) {
+    throw new Error("Instructions S3 object version id is invalid");
+  }
+}
+function createInstructionsS3ObjectStore(config, createClient = (options) => new Bun.S3Client(options), requestFetch = fetch, deadlines = {}) {
+  const existsDeadlineMs = resolveOperationDeadlineMs(deadlines.existsDeadlineMs, DEFAULT_EXISTS_DEADLINE_MS, "Instructions S3 exists deadline");
+  const bytesDeadlineMs = resolveOperationDeadlineMs(deadlines.bytesDeadlineMs, DEFAULT_BYTES_DEADLINE_MS, "Instructions S3 bytes deadline");
+  const statDeadlineMs = resolveOperationDeadlineMs(deadlines.statDeadlineMs, DEFAULT_STAT_DEADLINE_MS, "Instructions S3 stat deadline");
+  const versionedReadDeadlineMs = resolveOperationDeadlineMs(deadlines.versionedReadDeadlineMs, DEFAULT_VERSIONED_READ_DEADLINE_MS, "Instructions S3 versioned read deadline");
+  const conditionalCreateAttemptDeadlineMs = resolveOperationDeadlineMs(deadlines.conditionalCreateAttemptDeadlineMs, DEFAULT_CONDITIONAL_CREATE_ATTEMPT_DEADLINE_MS, "Instructions S3 conditional create attempt deadline");
+  const existenceReconciliationDeadlineMs = resolveOperationDeadlineMs(deadlines.existenceReconciliationDeadlineMs, DEFAULT_EXISTENCE_RECONCILIATION_DEADLINE_MS, "Instructions S3 existence reconciliation deadline");
+  const client = createClient({
+    bucket: config.bucket,
+    region: config.region,
+    ...config.endpoint ? { endpoint: config.endpoint } : {},
+    ...config.credentials ? {
+      accessKeyId: config.credentials.accessKeyId,
+      secretAccessKey: config.credentials.secretAccessKey,
+      ...config.credentials.sessionToken ? { sessionToken: config.credentials.sessionToken } : {}
+    } : {},
+    ...config.forcePathStyle ? { virtualHostedStyle: false } : {}
+  });
+  return {
+    async putIfAbsent(key, bytes, options) {
+      assertSafeInstructionsObjectKey(key);
+      let credentials;
+      try {
+        credentials = resolveRequestCredentials(config);
+      } catch {
+        throw new Error("Instructions S3 conditional object creation failed");
+      }
+      for (let attempt = 1;attempt <= CONDITIONAL_CREATE_ATTEMPTS; attempt += 1) {
+        let response;
+        const controller = new AbortController;
+        try {
+          const signed = signConditionalCreateRequest(config, key, bytes, options.contentType, credentials, new Date);
+          response = await runWithDeadline(() => requestFetch(signed.url, {
+            method: "PUT",
+            headers: signed.headers,
+            body: Uint8Array.from(bytes),
+            redirect: "error",
+            signal: controller.signal
+          }), conditionalCreateAttemptDeadlineMs, () => controller.abort());
+        } catch {
+          let exists = false;
+          try {
+            exists = await runWithDeadline(() => client.file(key).exists(), existenceReconciliationDeadlineMs);
+          } catch {}
+          if (exists)
+            return { status: "existing" };
+          if (attempt < CONDITIONAL_CREATE_ATTEMPTS)
+            continue;
+          throw new Error("Instructions S3 conditional object creation failed");
+        }
+        if (response.ok) {
+          const versionId = cleanResponseVersionId(response.headers.get("x-amz-version-id"));
+          response.body?.cancel().catch(() => {
+            return;
+          });
+          return { status: "created", ...versionId ? { versionId } : {} };
+        }
+        response.body?.cancel().catch(() => {
+          return;
+        });
+        if (response.status === 412)
+          return { status: "existing" };
+        if (response.status === 409 && attempt < CONDITIONAL_CREATE_ATTEMPTS)
+          continue;
+        if (response.status === 409) {
+          throw new Error("Instructions S3 conditional object creation remained conflicted");
+        }
+        throw new Error(`Instructions S3 conditional object creation failed with status ${response.status}`);
+      }
+      throw new Error("Instructions S3 conditional object creation failed");
+    },
+    async get(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId) {
+        return readExactVersion(config, key, options.versionId, "GET", requestFetch, versionedReadDeadlineMs).then((result) => result?.bytes);
+      }
+      try {
+        const file = client.file(key);
+        const exists = await runWithDeadline(() => file.exists(), existsDeadlineMs);
+        if (!exists)
+          return;
+        return Uint8Array.from(await runWithDeadline(() => file.bytes(), bytesDeadlineMs));
+      } catch {
+        throw new Error("Instructions S3 get operation failed");
+      }
+    },
+    async head(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId) {
+        return readExactVersion(config, key, options.versionId, "HEAD", requestFetch, versionedReadDeadlineMs).then((result) => result?.metadata);
+      }
+      try {
+        const file = client.file(key);
+        const exists = await runWithDeadline(() => file.exists(), existsDeadlineMs);
+        if (!exists)
+          return;
+        const stat = await runWithDeadline(() => file.stat(), statDeadlineMs);
+        return {
+          size: stat.size,
+          ...stat.etag ? { etag: stat.etag } : {},
+          ...stat.type ? { contentType: stat.type } : {},
+          ...stat.lastModified ? { lastModified: stat.lastModified } : {}
+        };
+      } catch {
+        throw new Error("Instructions S3 head operation failed");
+      }
+    }
+  };
+}
+async function readExactVersion(config, key, versionId, method, requestFetch, deadlineMs) {
+  assertSafeInstructionsObjectVersionId(versionId);
+  const credentials = resolveRequestCredentials(config);
+  const controller = new AbortController;
+  try {
+    const signed = signVersionedRequest(config, key, versionId, method, credentials, new Date);
+    const response = await runWithDeadline(() => requestFetch(signed.url, {
+      method,
+      headers: signed.headers,
+      redirect: "error",
+      signal: controller.signal
+    }), deadlineMs, () => controller.abort());
+    if (response.status === 404) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      return;
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      throw new Error("versioned S3 request failed");
+    }
+    const observedVersionId = cleanResponseVersionId(response.headers.get("x-amz-version-id"));
+    if (observedVersionId !== versionId) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      throw new Error("versioned S3 response authority mismatch");
+    }
+    const bytes = method === "GET" ? new Uint8Array(await response.arrayBuffer()) : new Uint8Array;
+    const contentLength = response.headers.get("content-length");
+    const parsedSize = contentLength === null ? bytes.byteLength : Number(contentLength);
+    if (!Number.isSafeInteger(parsedSize) || parsedSize < 0)
+      throw new Error("invalid S3 content length");
+    const lastModifiedValue = response.headers.get("last-modified");
+    const lastModified = lastModifiedValue ? new Date(lastModifiedValue) : undefined;
+    if (lastModified && !Number.isFinite(lastModified.getTime()))
+      throw new Error("invalid S3 last modified timestamp");
+    return {
+      bytes,
+      metadata: {
+        size: parsedSize,
+        versionId: observedVersionId,
+        ...response.headers.get("etag") ? { etag: response.headers.get("etag") } : {},
+        ...response.headers.get("content-type") ? { contentType: response.headers.get("content-type") } : {},
+        ...lastModified ? { lastModified } : {}
+      }
+    };
+  } catch {
+    throw new Error(`Instructions S3 ${method === "GET" ? "get" : "head"} operation failed`);
+  }
+}
+function resolveRequestCredentials(config) {
+  if (config.credentials)
+    return config.credentials;
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const sessionToken = process.env.AWS_SESSION_TOKEN?.trim();
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Instructions S3 signed requests require explicit or AWS environment credentials");
+  }
+  return { accessKeyId, secretAccessKey, ...sessionToken ? { sessionToken } : {} };
+}
+function signVersionedRequest(config, key, versionId, method, credentials, now) {
+  const url = buildObjectUrl(config, key);
+  url.searchParams.set("versionId", versionId);
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const shortDate = amzDate.slice(0, 8);
+  const headers = new Headers({
+    host: url.host,
+    "x-amz-content-sha256": EMPTY_SHA256,
+    "x-amz-date": amzDate,
+    ...credentials.sessionToken ? { "x-amz-security-token": credentials.sessionToken } : {}
+  });
+  const canonicalQuery = `versionId=${awsEncode(versionId)}`;
+  authorizeRequest(method, url, canonicalQuery, headers, EMPTY_SHA256, credentials, config.region, shortDate, amzDate);
+  return { url: url.toString(), headers };
+}
+function signConditionalCreateRequest(config, key, bytes, contentType, credentials, now) {
+  const url = buildObjectUrl(config, key);
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const shortDate = amzDate.slice(0, 8);
+  const payloadHash = createHash("sha256").update(bytes).digest("hex");
+  const headers = new Headers({
+    "content-md5": createHash("md5").update(bytes).digest("base64"),
+    "content-type": contentType,
+    host: url.host,
+    "if-none-match": "*",
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+    ...credentials.sessionToken ? { "x-amz-security-token": credentials.sessionToken } : {}
+  });
+  authorizeRequest("PUT", url, "", headers, payloadHash, credentials, config.region, shortDate, amzDate);
+  return { url: url.toString(), headers };
+}
+function authorizeRequest(method, url, canonicalQuery, headers, payloadHash, credentials, region, shortDate, amzDate) {
+  const signedHeaderNames = [];
+  headers.forEach((_value, name) => signedHeaderNames.push(name));
+  signedHeaderNames.sort();
+  const canonicalHeaders = signedHeaderNames.map((name) => `${name}:${headers.get(name).trim().replace(/\s+/g, " ")}
+`).join("");
+  const canonicalRequest = [
+    method,
+    url.pathname,
+    canonicalQuery,
+    canonicalHeaders,
+    signedHeaderNames.join(";"),
+    payloadHash
+  ].join(`
+`);
+  const scope = `${shortDate}/${region}/s3/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    createHash("sha256").update(canonicalRequest).digest("hex")
+  ].join(`
+`);
+  const dateKey = hmac(`AWS4${credentials.secretAccessKey}`, shortDate);
+  const regionKey = hmac(dateKey, region);
+  const serviceKey = hmac(regionKey, "s3");
+  const signingKey = hmac(serviceKey, "aws4_request");
+  const signature = createHmac("sha256", signingKey).update(stringToSign).digest("hex");
+  headers.set("authorization", `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaderNames.join(";")}, Signature=${signature}`);
+}
+function buildObjectUrl(config, key) {
+  const encodedKey = key.split("/").map(awsEncode).join("/");
+  if (config.endpoint) {
+    const endpoint = new URL(config.endpoint);
+    if (config.forcePathStyle)
+      endpoint.pathname = `/${awsEncode(config.bucket)}/${encodedKey}`;
+    else {
+      endpoint.hostname = `${config.bucket}.${endpoint.hostname}`;
+      endpoint.pathname = `/${encodedKey}`;
+    }
+    return endpoint;
+  }
+  return config.forcePathStyle ? new URL(`https://s3.${config.region}.amazonaws.com/${awsEncode(config.bucket)}/${encodedKey}`) : new URL(`https://${config.bucket}.s3.${config.region}.amazonaws.com/${encodedKey}`);
+}
+function awsEncode(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function hmac(key, value) {
+  return createHmac("sha256", key).update(value).digest();
+}
+function cleanResponseVersionId(value) {
+  const versionId = value?.trim();
+  if (!versionId || versionId === "null")
+    return;
+  assertSafeInstructionsObjectVersionId(versionId);
+  return versionId;
+}
+function memoryInstructionsObjectStore() {
+  const objects = new Map;
+  let nextVersion = 1;
+  return {
+    async putIfAbsent(key, bytes, options) {
+      assertSafeInstructionsObjectKey(key);
+      const existing = objects.get(key);
+      if (existing)
+        return { status: "existing", versionId: existing.versionId };
+      const versionId = `memory-v${nextVersion++}`;
+      objects.set(key, {
+        bytes: Uint8Array.from(bytes),
+        contentType: options.contentType,
+        lastModified: new Date,
+        versionId
+      });
+      return { status: "created", versionId };
+    },
+    async get(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId)
+        assertSafeInstructionsObjectVersionId(options.versionId);
+      const object = objects.get(key);
+      if (!object || options.versionId && options.versionId !== object.versionId)
+        return;
+      return Uint8Array.from(object.bytes);
+    },
+    async head(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId)
+        assertSafeInstructionsObjectVersionId(options.versionId);
+      const object = objects.get(key);
+      return object && (!options.versionId || options.versionId === object.versionId) ? {
+        size: object.bytes.byteLength,
+        contentType: object.contentType,
+        lastModified: new Date(object.lastModified),
+        versionId: object.versionId
+      } : undefined;
+    },
+    keys() {
+      return [...objects.keys()].sort();
+    }
+  };
+}
+
+export { assertSafeInstructionsObjectKey, assertSafeInstructionsObjectVersionId, createInstructionsS3ObjectStore, memoryInstructionsObjectStore };