@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/src/state/gcs.ts

@@ -1,254 +1,7 @@
 /**
- * Google Cloud Storage for a gcs backend's state, over its JSON API with
- * `fetch` and `node:crypto`: an object's text and generation, a write, a
- * write only when there is no object (the lock), and a delete.
- *
- * The identity, first match wins: a bearer token (`access_token`, or
- * GOOGLE_OAUTH_ACCESS_TOKEN), else a credentials file or its JSON:
- *
- *   external_account  the job's OIDC token, traded at Google's STS, then the
- *                     service account it impersonates.
- *   service_account   a key: requests carry a self-signed JWT.
- *
- * With `impersonate_service_account`, every request carries that service
- * account's token, which the identity asks IAM for.
- *
- * Lifted from terragucci's `report/gcs.ts` (c493e0e), without signed URLs,
- * version listing and the re-plan's traded tokens.
+ * The Google Cloud Storage client a gcs backend's state uses: chant core's
+ * (#4554, `@intentius/chant/object-store`), over the JSON API with `fetch`
+ * and `node:crypto`. Writes are conditional on a generation
+ * (`ifGenerationMatch`); a lost write is a 412, a StoreConflict.
  */
-import { createSign } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { defaultFetch, encodeStrict, StoreConflict, StoreError, type StoreFetch } from "./object-store";
-
-export const GCS_ENDPOINT = "https://storage.googleapis.com";
-/** IAM Credentials, where a token for an impersonated service account comes from. */
-export const IAM_CREDENTIALS = "https://iamcredentials.googleapis.com";
-const CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";
-const READ_WRITE = "https://www.googleapis.com/auth/devstorage.read_write";
-
-export interface GcsTarget {
-  bucket: string;
-  /** The JSON API's address, no trailing slash. Default https://storage.googleapis.com. */
-  endpoint: string;
-  /** The credentials file, read at the first request. */
-  credentialsFile?: string;
-  /** The credentials as JSON: a gcs backend's `credentials` given inline. */
-  credentialsJson?: string;
-  /** A bearer token used as it is. */
-  accessToken?: string;
-  /** The service account every request acts as, through IAM's generateAccessToken. */
-  impersonate?: string;
-  /** IAM Credentials' address, no trailing slash. */
-  iamEndpoint?: string;
-}
-
-interface ExternalAccount {
-  type: "external_account";
-  audience: string;
-  subject_token_type: string;
-  token_url: string;
-  service_account_impersonation_url?: string;
-  credential_source: { file?: string; url?: string; headers?: Record<string, string>; format?: { type?: string; subject_token_field_name?: string } };
-}
-
-interface ServiceAccountKey {
-  type: "service_account";
-  client_email: string;
-  private_key: string;
-  private_key_id?: string;
-}
-
-type Credentials = ExternalAccount | ServiceAccountKey;
-
-const b64url = (b: string | Buffer): string => Buffer.from(b).toString("base64url");
-
-/** A JWT the key signs for itself, which Google's APIs take as an access token for the scope it names. */
-export function selfSignedJwt(key: ServiceAccountKey, now: Date): string {
-  const iat = Math.floor(now.getTime() / 1000);
-  const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT", ...(key.private_key_id ? { kid: key.private_key_id } : {}) }));
-  const body = b64url(JSON.stringify({ iss: key.client_email, sub: key.client_email, scope: READ_WRITE, iat, exp: iat + 3600 }));
-  return `${head}.${body}.${createSign("RSA-SHA256").update(`${head}.${body}`).sign(key.private_key).toString("base64url")}`;
-}
-
-/** Google's error message, or the start of the body. */
-const why = (text: string): string => {
-  try {
-    const j = JSON.parse(text) as { error?: string | { message?: string }; error_description?: string };
-    if (typeof j.error === "object" && j.error?.message) return j.error.message;
-    if (typeof j.error === "string") return [j.error, j.error_description].filter(Boolean).join(": ");
-  } catch {
-    // Not JSON.
-  }
-  return text.slice(0, 300);
-};
-
-type Token = { token: string; expires: number };
-
-export class GcsClient {
-  private creds?: Credentials;
-  private token?: Promise<Token>;
-
-  constructor(readonly target: GcsTarget, private readonly fetchFn: StoreFetch = defaultFetch, private readonly readFile: (file: string) => string = (f) => readFileSync(f, "utf-8")) {}
-
-  private where(key: string): string {
-    return `gs://${this.target.bucket}/${key}`;
-  }
-
-  private credentials(): Credentials {
-    if (this.creds) return this.creds;
-    const source = this.target.credentialsFile ?? "the backend's credentials";
-    let c: Partial<Credentials>;
-    try {
-      c = JSON.parse(this.target.credentialsJson ?? this.readFile(this.target.credentialsFile ?? "")) as Partial<Credentials>;
-    } catch (e) {
-      throw new StoreError(`cannot read the credentials in ${source}: ${(e as Error).message}`);
-    }
-    if (c.type === "external_account" && c.token_url && c.audience && c.credential_source && (c.credential_source.file || c.credential_source.url)) return (this.creds = c as ExternalAccount);
-    if (c.type === "service_account" && c.client_email && c.private_key) return (this.creds = c as ServiceAccountKey);
-    throw new StoreError(`${source} is not an external_account file with a credential_source file or url, nor a service_account key`);
-  }
-
-  private async post(url: string, headers: Record<string, string>, body: string, what: string): Promise<Record<string, unknown>> {
-    const res = await this.fetchFn(url, { method: "POST", headers, body });
-    const text = await res.text();
-    if (!res.ok) throw new StoreError(`${what}: ${res.status} ${why(text)}`);
-    try {
-      return JSON.parse(text) as Record<string, unknown>;
-    } catch {
-      throw new StoreError(`${what}: the answer is not JSON`);
-    }
-  }
-
-  /** The job's OIDC token, from the file or URL the credentials name. */
-  private async subjectToken(c: ExternalAccount): Promise<string> {
-    const src = c.credential_source;
-    let text: string;
-    if (src.file) {
-      try {
-        text = this.readFile(src.file);
-      } catch (e) {
-        throw new StoreError(`cannot read the OIDC token in ${src.file}: ${(e as Error).message}`);
-      }
-    } else {
-      const res = await this.fetchFn(src.url!, { method: "GET", headers: src.headers ?? {} });
-      text = await res.text();
-      if (!res.ok) throw new StoreError(`the OIDC token at ${src.url!.split("?")[0]}: ${res.status} ${why(text)}`);
-    }
-    const field = src.format?.type === "json" ? src.format.subject_token_field_name : undefined;
-    let token = text.trim();
-    if (field) {
-      try {
-        token = String((JSON.parse(text) as Record<string, unknown>)[field] ?? "");
-      } catch {
-        throw new StoreError(`the job's OIDC token is not JSON with ${field}`);
-      }
-    }
-    if (!token) throw new StoreError("the job's OIDC token is empty");
-    return token;
-  }
-
-  private async impersonateWith(url: string, bearer: string, sa: string): Promise<Token> {
-    const r = await this.post(url, { "content-type": "application/json", authorization: `Bearer ${bearer}` }, JSON.stringify({ scope: [CLOUD_PLATFORM], lifetime: "3600s" }), `impersonating ${sa}`);
-    if (typeof r.accessToken !== "string") throw new StoreError(`IAM answered the impersonation of ${sa} without a token`);
-    const at = typeof r.expireTime === "string" ? Date.parse(r.expireTime) : NaN;
-    return { token: r.accessToken, expires: Number.isNaN(at) ? Date.now() + 3600_000 : at };
-  }
-
-  /** STS's federated token, then the impersonated service account's, when the credentials name one. */
-  private async exchange(c: ExternalAccount): Promise<Token> {
-    const sts = await this.post(
-      c.token_url,
-      { "content-type": "application/x-www-form-urlencoded" },
-      new URLSearchParams({
-        grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
-        audience: c.audience,
-        scope: CLOUD_PLATFORM,
-        requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
-        subject_token: await this.subjectToken(c),
-        subject_token_type: c.subject_token_type,
-      }).toString(),
-      `Google STS refused the OIDC token for ${c.audience}`,
-    );
-    if (typeof sts.access_token !== "string") throw new StoreError("Google STS answered without a token");
-    const fed = { token: sts.access_token, expires: Date.now() + Number(sts.expires_in ?? 3600) * 1000 };
-    if (!c.service_account_impersonation_url) return fed;
-    return this.impersonateWith(c.service_account_impersonation_url, fed.token, "the service account");
-  }
-
-  /** The identity's own token: the one the target gives, a key's self-signed JWT, or STS's for the OIDC token. */
-  private async own(): Promise<Token> {
-    if (this.target.accessToken) return { token: this.target.accessToken, expires: Date.now() + 3600_000 };
-    const c = this.credentials();
-    return c.type === "service_account" ? { token: selfSignedJwt(c, new Date()), expires: Date.now() + 3600_000 } : this.exchange(c);
-  }
-
-  /** An access token: once per client, again a minute before it expires. */
-  private async bearer(): Promise<string> {
-    const sa = this.target.impersonate;
-    const fresh = async (): Promise<Token> => {
-      if (!sa) return this.own();
-      const base = await this.own();
-      return this.impersonateWith(`${(this.target.iamEndpoint ?? IAM_CREDENTIALS).replace(/\/+$/, "")}/v1/projects/-/serviceAccounts/${encodeURIComponent(sa)}:generateAccessToken`, base.token, sa);
-    };
-    const again = (): Promise<Token> =>
-      (this.token = fresh().catch((e: unknown) => {
-        this.token = undefined;
-        throw e;
-      }));
-    let held = await (this.token ?? again());
-    if (held.expires - Date.now() < 60_000) held = await again();
-    return held.token;
-  }
-
-  private objectUrl(key: string): string {
-    return `${this.target.endpoint}/storage/v1/b/${encodeURIComponent(this.target.bucket)}/o/${encodeStrict(key)}`;
-  }
-
-  /** Write an object; with `ifGenerationMatch`, only when the object still has that generation (`0`: there is none), else StoreConflict. */
-  async put(key: string, body: string, contentType: string, ifGenerationMatch?: string): Promise<void> {
-    const t = this.target;
-    const url = `${t.endpoint}/upload/storage/v1/b/${encodeURIComponent(t.bucket)}/o?uploadType=media&name=${encodeStrict(key)}${ifGenerationMatch !== undefined ? `&ifGenerationMatch=${encodeStrict(ifGenerationMatch)}` : ""}`;
-    const res = await this.fetchFn(url, { method: "POST", headers: { "content-type": contentType, authorization: `Bearer ${await this.bearer()}` }, body });
-    if (res.status === 412) throw new StoreConflict(`PUT ${this.where(key)}: 412, it changed since it was read`);
-    if (!res.ok) throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-  }
-
-  async get(key: string): Promise<string | undefined> {
-    const res = await this.fetchFn(`${this.objectUrl(key)}?alt=media`, { method: "GET", headers: { authorization: `Bearer ${await this.bearer()}` } });
-    if (res.status === 404) return undefined;
-    if (!res.ok) throw new StoreError(`GET ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-    return res.text();
-  }
-
-  /** An object's metadata and never its body: whether it is there, and its generation. */
-  async head(key: string): Promise<{ exists: boolean; generation?: string }> {
-    const res = await this.fetchFn(this.objectUrl(key), { method: "GET", headers: { authorization: `Bearer ${await this.bearer()}` } });
-    const text = await res.text();
-    if (res.status === 404) return { exists: false };
-    if (!res.ok) throw new StoreError(`GET ${this.where(key)} metadata: ${res.status} ${why(text)}`);
-    let g: unknown;
-    try {
-      g = (JSON.parse(text) as { generation?: unknown }).generation;
-    } catch {
-      // Metadata that is not JSON: no generation.
-    }
-    return { exists: true, ...(g !== undefined && g !== null && g !== "" ? { generation: String(g) } : {}) };
-  }
-
-  /** Write an object only when there is none (ifGenerationMatch=0): true when this write made it, false when one was there. */
-  async putIfAbsent(key: string, body: string, contentType: string): Promise<boolean> {
-    try {
-      await this.put(key, body, contentType, "0");
-      return true;
-    } catch (e) {
-      if (e instanceof StoreConflict) return false;
-      throw e;
-    }
-  }
-
-  /** Delete an object's live generation. One that is not there is deleted already. */
-  async remove(key: string): Promise<void> {
-    const res = await this.fetchFn(this.objectUrl(key), { method: "DELETE", headers: { authorization: `Bearer ${await this.bearer()}` } });
-    if (!res.ok && res.status !== 404) throw new StoreError(`DELETE ${this.where(key)}: ${res.status} ${why(await res.text())}`);
-  }
-}
+export { GCS_ENDPOINT, GcsClient, IAM_CREDENTIALS, selfSignedJwt, type GcsTarget } from "@intentius/chant/object-store";

package/src/state/object-store.ts

@@ -1,35 +1,7 @@
 /**
  * What the state stores share: the fetch they call, their errors, and how a
- * key goes into a URL. Lifted from terragucci's `report/object-store.ts`
- * (c493e0e), cut to what a state's lock and write need.
+ * key goes into a URL. Since #4554 these are chant core's object-store
+ * definitions (`@intentius/chant/object-store`), so a store error thrown by
+ * a core client is the one a state caller catches.
  */
-
-export type StoreFetch = (url: string, init: { method: string; headers: Record<string, string>; body?: string | Uint8Array }) => Promise<{
-  ok: boolean;
-  status: number;
-  text(): Promise<string>;
-  /** A store that sends no headers (or a test's fake) gets no conditional writes. */
-  headers?: { get(name: string): string | null };
-}>;
-
-export class StoreError extends Error {}
-
-/** A conditional write that lost: the object changed (412) or another write to it was in flight (409). */
-export class StoreConflict extends StoreError {}
-
-/** A condition on a write: the version the object must still have, or `*` for "there is no object yet". */
-export type StoreCondition = { ifMatch: string } | { ifNoneMatch: "*" };
-
-/** A key as a URL path: each segment percent-encoded the strict way (RFC 3986), the slashes kept. */
-export const encodePath = (key: string): string => key.split("/").map(encodeStrict).join("/");
-
-export const encodeStrict = (v: string): string => encodeURIComponent(v).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
-
-/** The first value of an XML element, unescaped. Enough for the small answers these stores send. */
-export const xmlText = (xml: string, tag: string): string | undefined => {
-  const m = new RegExp(`<${tag}>([^<]*)</${tag}>`).exec(xml);
-  return m?.[1]!.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&").trim();
-};
-
-/** The global fetch, as a StoreFetch. */
-export const defaultFetch: StoreFetch = (url, init) => fetch(url, init as RequestInit);
+export { defaultFetch, encodePath, encodeStrict, StoreConflict, StoreError, xmlText, type StoreCondition, type StoreFetch } from "@intentius/chant/object-store";

package/src/state/s3.ts

@@ -1,193 +1,21 @@
 /**
- * The little of S3 a state's lock and write need: get, put, put only when
- * absent, head and delete one object, signed with AWS Signature Version 4
- * from `node:crypto`. Any S3-compatible store answers it (S3, MinIO, floci).
- * With no static keys, a role is assumed with the job's OIDC token through
- * STS AssumeRoleWithWebIdentity. `fetch` is injectable so the signing is
- * tested against recorded requests.
- *
- * Lifted from terragucci's `report/s3.ts` (c493e0e), without presigning,
- * version listing and the re-plan's traded credentials.
+ * The S3 client a state's lock and write use: chant core's (#4554,
+ * `@intentius/chant/object-store`), which signs with chant's one AWS
+ * signer. Get, put, put only when absent, head and delete one object; with
+ * no static keys, a role is assumed with the job's OIDC token through STS
+ * AssumeRoleWithWebIdentity.
  */
-import { createHash, createHmac } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { defaultFetch, encodePath, encodeStrict, StoreError, xmlText, type StoreFetch } from "./object-store";
+import { s3FromEnv as coreS3FromEnv, type S3Target } from "@intentius/chant/object-store";
 
-export interface S3Credentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  sessionToken?: string;
-}
-
-/** A role to assume with the job's OIDC token, the way the AWS SDKs read `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE`. */
-export interface S3WebIdentity {
-  roleArn: string;
-  tokenFile: string;
-  sessionName: string;
-  /** STS's address, https://host[:port], no path. */
-  endpoint: string;
-}
-
-export interface S3Location {
-  bucket: string;
-  /** https://host[:port], no path. Default: AWS's regional endpoint. */
-  endpoint?: string;
-  region: string;
-}
-
-export type S3Target = S3Location & (S3Credentials | { webIdentity: S3WebIdentity });
+export { assumeRoleWithWebIdentity, S3Client, sign, type S3Credentials, type S3Location, type S3Target, type S3WebIdentity } from "@intentius/chant/object-store";
 
 /**
  * The target for `bucket` from the AWS environment variables. Credentials,
  * first match wins: static keys in `AWS_ACCESS_KEY_ID` and
  * `AWS_SECRET_ACCESS_KEY`; `AWS_ROLE_ARN` assumed with the token in
- * `AWS_WEB_IDENTITY_TOKEN_FILE`.
+ * `AWS_WEB_IDENTITY_TOKEN_FILE`, in a session named `chant-state` unless
+ * AWS_ROLE_SESSION_NAME names one.
  */
 export function s3FromEnv(where: { bucket: string; endpoint?: string }, env: NodeJS.ProcessEnv = process.env): S3Target {
-  const endpoint = where.endpoint ?? env.AWS_ENDPOINT_URL_S3 ?? env.AWS_ENDPOINT_URL;
-  const region = env.AWS_REGION || env.AWS_DEFAULT_REGION || "us-east-1";
-  const at = { bucket: where.bucket, ...(endpoint ? { endpoint: endpoint.replace(/\/+$/, "") } : {}), region };
-  const accessKeyId = env.AWS_ACCESS_KEY_ID;
-  const secretAccessKey = env.AWS_SECRET_ACCESS_KEY;
-  if (accessKeyId && secretAccessKey) return { ...at, accessKeyId, secretAccessKey, ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}) };
-  const tokenFile = env.AWS_WEB_IDENTITY_TOKEN_FILE;
-  if (env.AWS_ROLE_ARN && tokenFile) {
-    return {
-      ...at,
-      webIdentity: {
-        roleArn: env.AWS_ROLE_ARN,
-        tokenFile,
-        sessionName: env.AWS_ROLE_SESSION_NAME || "chant-state",
-        endpoint: (env.AWS_ENDPOINT_URL_STS || env.AWS_ENDPOINT_URL || `https://sts.${region}.amazonaws.com`).replace(/\/+$/, ""),
-      },
-    };
-  }
-  throw new StoreError("set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE");
-}
-
-/** STS AssumeRoleWithWebIdentity. The request carries the token and is not signed. */
-export async function assumeRoleWithWebIdentity(w: S3WebIdentity, fetchFn: StoreFetch, readToken: (file: string) => string = (f) => readFileSync(f, "utf-8")): Promise<S3Credentials & { expiration?: Date }> {
-  let token: string;
-  try {
-    token = readToken(w.tokenFile).trim();
-  } catch (e) {
-    throw new StoreError(`cannot read the OIDC token in ${w.tokenFile}: ${(e as Error).message}`);
-  }
-  if (!token) throw new StoreError(`the OIDC token file ${w.tokenFile} is empty`);
-  const body = new URLSearchParams({ Action: "AssumeRoleWithWebIdentity", Version: "2011-06-15", RoleArn: w.roleArn, RoleSessionName: w.sessionName, WebIdentityToken: token }).toString();
-  const res = await fetchFn(`${w.endpoint}/`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded; charset=utf-8", accept: "application/xml" }, body });
-  const xml = await res.text();
-  if (!res.ok) {
-    const why = [xmlText(xml, "Code"), xmlText(xml, "Message")].filter(Boolean).join(": ") || xml.slice(0, 300);
-    throw new StoreError(`AssumeRoleWithWebIdentity for ${w.roleArn}: ${res.status} ${why}`);
-  }
-  const accessKeyId = xmlText(xml, "AccessKeyId");
-  const secretAccessKey = xmlText(xml, "SecretAccessKey");
-  const sessionToken = xmlText(xml, "SessionToken");
-  if (!accessKeyId || !secretAccessKey || !sessionToken) throw new StoreError(`AssumeRoleWithWebIdentity for ${w.roleArn} answered without credentials`);
-  const expires = xmlText(xml, "Expiration");
-  return { accessKeyId, secretAccessKey, sessionToken, ...(expires && !Number.isNaN(Date.parse(expires)) ? { expiration: new Date(expires) } : {}) };
-}
-
-const sha256 = (b: string | Uint8Array): string => createHash("sha256").update(b).digest("hex");
-const hmac = (key: string | Buffer, s: string): Buffer => createHmac("sha256", key).update(s).digest();
-
-/** Signature Version 4 headers for a request; its query string, if any, is signed in canonical order. `extra` headers are signed too. */
-export function sign(t: Pick<S3Location, "region"> & S3Credentials, method: string, rawUrl: string, extra: Record<string, string>, payload: string, now: Date, service = "s3"): Record<string, string> {
-  const url = new URL(rawUrl);
-  const amzDate = now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
-  const day = amzDate.slice(0, 8);
-  const headers: Record<string, string> = {
-    host: url.host,
-    "x-amz-content-sha256": payload,
-    "x-amz-date": amzDate,
-    ...Object.fromEntries(Object.entries(extra).map(([k, v]) => [k.toLowerCase(), v])),
-    ...(t.sessionToken ? { "x-amz-security-token": t.sessionToken } : {}),
-  };
-  const names = Object.keys(headers).sort();
-  const query = [...url.searchParams].map(([k, v]) => `${encodeStrict(k)}=${encodeStrict(v)}`).sort().join("&");
-  const canonical = [method, url.pathname, query, ...names.map((n) => `${n}:${headers[n]!.trim()}`), "", names.join(";"), payload].join("\n");
-  const scope = `${day}/${t.region}/${service}/aws4_request`;
-  const toSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256(canonical)].join("\n");
-  const key4 = hmac(hmac(hmac(hmac(`AWS4${t.secretAccessKey}`, day), t.region), service), "aws4_request");
-  const signature = createHmac("sha256", key4).update(toSign).digest("hex");
-  const { host: _host, ...sent } = headers;
-  return { ...sent, authorization: `AWS4-HMAC-SHA256 Credential=${t.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}` };
-}
-
-/** The address of `key` in the bucket: path-style on a custom endpoint, virtual-hosted on AWS. */
-const objectUrl = (t: S3Location, key: string): string => `${t.endpoint ? `${t.endpoint}/${t.bucket}` : `https://${t.bucket}.s3.${t.region}.amazonaws.com`}/${encodePath(key)}`;
-
-export class S3Client {
-  private creds?: Promise<S3Credentials & { expiration?: Date }>;
-
-  constructor(readonly target: S3Target, private readonly fetchFn: StoreFetch = defaultFetch) {}
-
-  private where(key: string): string {
-    return `s3://${this.target.bucket}/${key}`;
-  }
-
-  /** Static keys as given; a web identity's keys once per client, again a minute before they expire. */
-  private async signer(): Promise<S3Location & S3Credentials> {
-    const t = this.target;
-    if (!("webIdentity" in t)) return t;
-    const assume = (): Promise<S3Credentials & { expiration?: Date }> =>
-      (this.creds = assumeRoleWithWebIdentity(t.webIdentity, this.fetchFn).catch((e: unknown) => {
-        this.creds = undefined;
-        throw e;
-      }));
-    let held = await (this.creds ?? assume());
-    if (held.expiration && held.expiration.getTime() - Date.now() < 60_000) held = await assume();
-    const { accessKeyId, secretAccessKey, sessionToken } = held;
-    return { bucket: t.bucket, ...(t.endpoint ? { endpoint: t.endpoint } : {}), region: t.region, accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
-  }
-
-  private async request(method: string, key: string, body: string, extra: Record<string, string> = {}) {
-    const t = await this.signer();
-    const url = objectUrl(t, key);
-    return this.fetchFn(url, { method, headers: sign(t, method, url, extra, sha256(body), new Date()), ...(method === "PUT" ? { body } : {}) });
-  }
-
-  /** Write an object, unconditionally. */
-  async put(key: string, body: string, contentType: string): Promise<void> {
-    const res = await this.request("PUT", key, body, { "content-type": contentType });
-    if (!res.ok) throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${(await res.text()).slice(0, 300)}`);
-  }
-
-  /** The object's text, or undefined when there is none. */
-  async get(key: string): Promise<string | undefined> {
-    const res = await this.request("GET", key, "");
-    if (res.status === 404) return undefined;
-    if (!res.ok) throw new StoreError(`GET ${this.where(key)}: ${res.status} ${(await res.text()).slice(0, 300)}`);
-    return res.text();
-  }
-
-  /** The object's metadata and never its body: whether it exists, its ETag and its version id. */
-  async head(key: string): Promise<{ exists: boolean; etag?: string; versionId?: string }> {
-    const res = await this.request("HEAD", key, "");
-    if (res.status === 404) return { exists: false };
-    if (!res.ok) throw new StoreError(`HEAD ${this.where(key)}: ${res.status}`);
-    const etag = res.headers?.get("etag") ?? undefined;
-    const version = res.headers?.get("x-amz-version-id") ?? undefined;
-    return { exists: true, ...(etag ? { etag } : {}), ...(version && version !== "null" ? { versionId: version } : {}) };
-  }
-
-  /**
-   * Write an object only when there is none (If-None-Match: *): true when
-   * this write made it, false when one was there. A store that refuses the
-   * condition fails the write: a lock is never taken unconditionally.
-   */
-  async putIfAbsent(key: string, body: string, contentType: string): Promise<boolean> {
-    const res = await this.request("PUT", key, body, { "content-type": contentType, "if-none-match": "*" });
-    if (res.status === 412 || res.status === 409) return false;
-    if (res.status === 501) throw new StoreError(`PUT ${this.where(key)}: the store does not take a conditional write (501)`);
-    if (!res.ok) throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${(await res.text()).slice(0, 300)}`);
-    return true;
-  }
-
-  /** Delete an object. One that is not there is deleted already. */
-  async remove(key: string): Promise<void> {
-    const res = await this.request("DELETE", key, "");
-    if (!res.ok && res.status !== 404) throw new StoreError(`DELETE ${this.where(key)}: ${res.status} ${(await res.text()).slice(0, 300)}`);
-  }
+  return coreS3FromEnv({ ...where, sessionName: "chant-state", setting: "the state bucket" }, env);
 }

package/src/state/store.ts

@@ -99,7 +99,7 @@ function s3Store(o: S3State, fetchFn?: StoreFetch): StateStore {
     lock: (info) => client.putIfAbsent(lockKey, info, JSON_TYPE),
     unlock: () => client.remove(lockKey),
     readBeside: (suffix) => client.get(`${o.key}${suffix}`),
-    writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+    writeBeside: async (suffix, body) => void (await client.put(`${o.key}${suffix}`, body, JSON_TYPE)),
     removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
     besideLocation: (suffix) => `s3://${o.bucket}/${o.key}${suffix}`,
     adopt: () => {},
@@ -122,7 +122,7 @@ function gcsStore(o: GcsState, fetchFn?: StoreFetch): StateStore {
     lock: (info) => client.putIfAbsent(o.lock, info, JSON_TYPE),
     unlock: () => client.remove(o.lock),
     readBeside: (suffix) => client.get(`${o.key}${suffix}`),
-    writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+    writeBeside: async (suffix, body) => void (await client.put(`${o.key}${suffix}`, body, JSON_TYPE)),
     removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
     besideLocation: (suffix) => `gs://${o.bucket}/${o.key}${suffix}`,
     adopt: () => {},