@midsummer-ai/sdk 0.0.0-stage → 0.1.0-next.1305

package/s3.mjs

@@ -0,0 +1,1003 @@
+import { a as checkMetadata, h as StorageError, l as checkUploadId, m as sha256, n as checkBucketName, o as checkPartNumber, r as checkKey, s as checkParts } from "./names-DfCBKupJ.mjs";
+import { streamsOf } from "./index.mjs";
+//#region src/s3.ts
+/**
+* Storage over the S3 protocol, so the tools and SDKs that speak it reach a Project's Buckets
+* unchanged. `s3(engine, options)` serves one HTTP request from any engine: the Stand-in under
+* `midsummer dev`, or the real Capability's engine on its server. S3 here is the protocol, not a
+* provider.
+*
+*   Bun.serve({ fetch: s3(standIn({ clock: Date.now }), { credentials, clock: Date.now }) })
+*   // aws --endpoint-url http://127.0.0.1:<port> s3 cp photo.png s3://avatars/ada.png
+*
+* Requests are signed with Signature Version 4, in the Authorization header or as a presigned URL;
+* `credentials` turns an access key id into its secret and what it may do. A Bucket is addressed in
+* the path (`/<bucket>/<key>`), or as the first label of one of `hosts` (`<bucket>.<host>/<key>`).
+*
+* Supported: ListBuckets (the key's own Buckets), HeadBucket, CreateBucket (confirms a Bucket the
+* key may use; Buckets are made by the platform), ListObjectsV2 and ListObjects, PutObject (plain
+* or aws-chunked bodies), GetObject and HeadObject with a Range and the conditional headers
+* (If-Match, If-None-Match, If-Modified-Since, If-Unmodified-Since), DeleteObject, DeleteObjects,
+* CopyObject and UploadPartCopy with their `x-amz-copy-source-if-*` conditions, multipart uploads
+* (Create, UploadPart, UploadPartCopy, Complete, Abort), presigned URLs for any of these, and a
+* Bucket's settings as they stand: GetBucketLocation, GetBucketVersioning (never enabled),
+* GetBucketCors, GetObjectTagging (an empty tag set), and DeleteObjectTagging,
+* DeleteBucketLifecycle and DeleteBucketTagging (there is nothing to delete). A Bucket whose writes
+* are paused gets `QuotaExceeded` for its writes.
+*
+* CORS is open to every origin, for every Bucket, and cannot be changed: a request is allowed by
+* its signature, never by a cookie, so a browser on any site holding a presigned URL, or signing
+* with a key, may use it, and a site with neither can do nothing. A preflight gets an unsigned reply,
+* as browsers send it.
+*
+* Refused with `NotImplemented` (501), as S3 refuses what a deployment does not offer, and as its
+* clients expect: anything that would keep a setting Storage does not keep. Tags (PutObjectTagging,
+* PutBucketTagging, `x-amz-tagging` on a put), lifecycle rules (PutBucketLifecycleConfiguration:
+* Objects are kept until deleted), CORS rules (PutBucketCors, DeleteBucketCors: always open, above),
+* versioning, ACLs and policies (a Storage Key's role is what grants), and every other setting.
+* Also ListParts and ListMultipartUploads, which the engine cannot list (a client keeps its own
+* parts, and an unfinished upload is removed by Abort), If-None-Match with an etag on a put (S3
+* takes only `*` there), and DeleteBucket (Buckets are made and deleted by the platform, with
+* `midsummer storage bucket`). The settings' GETs reply as S3 does for a Bucket that has none:
+* `NoSuchLifecycleConfiguration`, `NoSuchTagSet`, `NoSuchBucketPolicy`.
+*
+* An aws-chunked body is taken signed chunk by chunk (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD`, with or
+* without a signed trailer) or unsigned with a trailing checksum (`STREAMING-UNSIGNED-PAYLOAD-TRAILER`):
+* every chunk's signature, the trailer's, and a CRC32 or CRC32C trailing checksum are checked before
+* the Object is kept. Any other streaming mode, or another trailing checksum, is `NotImplemented`.
+*
+* Not yet: Content-MD5.
+*/
+const XMLNS = "http://s3.amazonaws.com/doc/2006-03-01/";
+const SKEW = 9e5;
+function s3(engine, options) {
+	const answer = async (request) => {
+		const url = new URL(request.url);
+		const host = (request.headers.get("host") ?? url.host).toLowerCase();
+		const base = options.base ?? "";
+		if (base && url.pathname !== base && !url.pathname.startsWith(`${base}/`)) return errorResponse(request, 404, "NoSuchBucket", "Nothing is served at this path", url.pathname);
+		const { bucket, key } = address(url.pathname.slice(base.length) || "/", host, options.hosts ?? []);
+		const resource = `/${bucket ?? ""}${key ? `/${key}` : ""}`;
+		let credential;
+		let response;
+		try {
+			const signing = await authenticate(request, url, host, options, bucket ? namedBy(request, bucket) : void 0);
+			credential = signing.credential;
+			const chunking = chunkingOf(request, signing);
+			const streamed = streamedBody(request, engine, chunking);
+			response = await route({
+				request,
+				url,
+				base,
+				body: streamed ? /* @__PURE__ */ new Uint8Array(0) : await payloadOf(request, new Uint8Array(await request.arrayBuffer()), chunking),
+				...streamed ? { streamed } : {},
+				credential,
+				engine: scoped(engine, credential),
+				clock: options.clock,
+				...bucket ? { bucket } : {},
+				...key ? { key } : {}
+			});
+		} catch (error) {
+			if (error instanceof S3Error) response = errorResponse(request, error.status, error.code, error.message, resource);
+			else if (error instanceof StorageError) {
+				const [status, code] = statusOf(error.code, error.reason);
+				response = errorResponse(request, status, code, error.message, resource);
+			} else throw error;
+		}
+		const kind = classOf(request.method, url.searchParams, key);
+		if (options.counted && credential && bucket && kind && response.status !== 403 && response.status !== 501) {
+			const id = credential.buckets ? Object.hasOwn(credential.buckets, bucket) ? credential.buckets[bucket] : void 0 : bucket;
+			if (id) options.counted(id, kind);
+		}
+		return response;
+	};
+	return async (request) => {
+		if (request.method === "OPTIONS") return preflight(request);
+		const response = await answer(request);
+		if (request.headers.has("origin")) for (const [name, value] of Object.entries(OPEN)) response.headers.set(name, value);
+		return response;
+	};
+}
+const CORS_METHODS = [
+	"GET",
+	"PUT",
+	"POST",
+	"DELETE",
+	"HEAD"
+];
+/** What every answer to a browser carries: any site may read it, and every header, ETag included. */
+const OPEN = {
+	"access-control-allow-origin": "*",
+	"access-control-expose-headers": "*"
+};
+function preflight(request) {
+	return new Response(null, {
+		status: 200,
+		headers: {
+			...OPEN,
+			"access-control-allow-methods": CORS_METHODS.join(", "),
+			"access-control-allow-headers": request.headers.get("access-control-request-headers") ?? "*",
+			"access-control-max-age": "3000"
+		}
+	});
+}
+/** The class S3 bills a request in, or `undefined` for a delete, which is free. */
+function classOf(method, q, key) {
+	if (method === "DELETE" || method === "POST" && q.has("delete")) return void 0;
+	if (method !== "GET" && method !== "HEAD") return "a";
+	return !key && method === "GET" && !BUCKET_SETTINGS.some((name) => q.has(name)) ? "a" : "b";
+}
+var S3Error = class extends Error {
+	status;
+	code;
+	constructor(status, code, message) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
+const byReason = {
+	range: [416, "InvalidRange"],
+	upload: [404, "NoSuchUpload"],
+	part: [400, "InvalidPart"],
+	"part-order": [400, "InvalidPartOrder"],
+	"part-too-small": [400, "EntityTooSmall"]
+};
+function statusOf(code, reason) {
+	if (reason) return byReason[reason];
+	switch (code) {
+		case "invalid": return [400, "InvalidArgument"];
+		case "not_found": return [404, "NoSuchKey"];
+		case "conflict": return [412, "PreconditionFailed"];
+		case "forbidden": return [403, "AccessDenied"];
+		case "quota": return [403, "QuotaExceeded"];
+		case "unavailable": return [503, "ServiceUnavailable"];
+	}
+}
+function address(path, host, hosts) {
+	const segments = path.split("/").slice(1);
+	const decoded = (parts) => parts.map((part) => decodeURIComponent(part)).join("/");
+	const hostname = host.replace(/:\d+$/, "");
+	for (const suffix of hosts) if (hostname.endsWith(`.${suffix}`)) {
+		const key = decoded(segments);
+		return {
+			bucket: hostname.slice(0, -suffix.length - 1),
+			...key ? { key } : {}
+		};
+	}
+	const [first = "", ...rest] = segments;
+	const key = decoded(rest);
+	return {
+		...first ? { bucket: decodeURIComponent(first) } : {},
+		...key ? { key } : {}
+	};
+}
+/** Every byte except the unreserved ones, as Signature Version 4 encodes; `/` too unless it is a path. */
+function awsEncode(value, slash) {
+	return [...new TextEncoder().encode(value)].map((b) => {
+		const c = String.fromCharCode(b);
+		if (/[A-Za-z0-9\-._~]/.test(c) || !slash && c === "/") return c;
+		return `%${b.toString(16).toUpperCase().padStart(2, "0")}`;
+	}).join("");
+}
+async function hmac(key, data) {
+	const raw = typeof key === "string" ? new TextEncoder().encode(key) : key;
+	const imported = await crypto.subtle.importKey("raw", raw, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return new Uint8Array(await crypto.subtle.sign("HMAC", imported, new TextEncoder().encode(data)));
+}
+const hex = (bytes) => [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+function sameHex(a, b) {
+	if (a.length !== b.length) return false;
+	let difference = 0;
+	for (let i = 0; i < a.length; i += 1) difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return difference === 0;
+}
+function signedPart(request, url) {
+	const authorization = request.headers.get("authorization");
+	if (authorization) {
+		const match = /^AWS4-HMAC-SHA256 Credential=([^/,\s]+)\/(\d{8})\/([^/,\s]+)\/s3\/aws4_request,\s*SignedHeaders=([^,\s]+),\s*Signature=([0-9a-f]{64})$/.exec(authorization.trim());
+		if (!match) throw new S3Error(400, "AuthorizationHeaderMalformed", "The Authorization header is not a Signature Version 4 header");
+		return {
+			accessKeyId: match[1],
+			date: match[2],
+			region: match[3],
+			signedHeaders: match[4].split(";"),
+			signature: match[5],
+			amzDate: request.headers.get("x-amz-date") ?? "",
+			payloadHash: request.headers.get("x-amz-content-sha256") ?? ""
+		};
+	}
+	const q = url.searchParams;
+	if (q.get("X-Amz-Algorithm") === "AWS4-HMAC-SHA256") {
+		const credential = /^([^/]+)\/(\d{8})\/([^/]+)\/s3\/aws4_request$/.exec(q.get("X-Amz-Credential") ?? "");
+		const signature = q.get("X-Amz-Signature") ?? "";
+		const expires = Number(q.get("X-Amz-Expires"));
+		if (!credential || !/^[0-9a-f]{64}$/.test(signature) || !Number.isSafeInteger(expires) || expires < 1 || expires > 604800) throw new S3Error(400, "AuthorizationQueryParametersError", "The presigned URL's query is not Signature Version 4");
+		return {
+			accessKeyId: credential[1],
+			date: credential[2],
+			region: credential[3],
+			signedHeaders: (q.get("X-Amz-SignedHeaders") ?? "").split(";"),
+			signature,
+			amzDate: q.get("X-Amz-Date") ?? "",
+			payloadHash: "UNSIGNED-PAYLOAD",
+			presigned: { expires }
+		};
+	}
+	throw new S3Error(403, "AccessDenied", "The request is not signed");
+}
+function timeOf(amzDate) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+	if (!m) throw new S3Error(403, "AccessDenied", "The request's date is not in Signature Version 4 form");
+	return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]), Number(m[4]), Number(m[5]), Number(m[6]));
+}
+/** The Buckets a request names: its own, and the source of a copy when that is another. */
+function namedBy(request, bucket) {
+	const source = request.headers.get("x-amz-copy-source");
+	if (!source) return [bucket];
+	let from;
+	try {
+		from = decodeURIComponent(source.replace(/^\//, "").split("?")[0]).split("/", 1)[0];
+	} catch {
+		return [bucket];
+	}
+	return from && from !== bucket ? [bucket, from] : [bucket];
+}
+async function authenticate(request, url, host, options, named) {
+	const signed = signedPart(request, url);
+	const at = timeOf(signed.amzDate), now = options.clock();
+	if (!signed.amzDate.startsWith(signed.date)) throw new S3Error(403, "AccessDenied", "The credential's date is not the request's date");
+	if (signed.presigned) {
+		if (now > at + signed.presigned.expires * 1e3) throw new S3Error(403, "AccessDenied", "Request has expired");
+		if (at > now + SKEW) throw new S3Error(403, "AccessDenied", "The presigned URL is dated in the future");
+	} else if (Math.abs(now - at) > SKEW) throw new S3Error(403, "RequestTimeTooSkewed", "The request's time is more than 15 minutes from the server's");
+	if (!signed.signedHeaders.includes("host")) throw new S3Error(403, "AccessDenied", "The host header is not signed");
+	const credential = await options.credentials(signed.accessKeyId, named);
+	if (!credential) throw new S3Error(403, "InvalidAccessKeyId", "The access key id is not known");
+	const query = [...url.searchParams].filter(([name]) => !(signed.presigned && name === "X-Amz-Signature")).map(([name, value]) => [awsEncode(name, true), awsEncode(value, true)]).sort(([a, x], [b, y]) => a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0).map(([name, value]) => `${name}=${value}`).join("&");
+	const path = url.pathname.split("/").map((part) => awsEncode(decodeURIComponent(part), true)).join("/");
+	const headers = signed.signedHeaders.map((name) => `${name}:${(name === "host" ? host : request.headers.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`).join("");
+	const canonical = [
+		request.method,
+		path,
+		query,
+		headers,
+		signed.signedHeaders.join(";"),
+		signed.payloadHash
+	].join("\n");
+	const scope = `${signed.date}/${signed.region}/s3/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		signed.amzDate,
+		scope,
+		await sha256(new TextEncoder().encode(canonical))
+	].join("\n");
+	let key = await hmac(`AWS4${credential.secret}`, signed.date);
+	for (const part of [
+		signed.region,
+		"s3",
+		"aws4_request"
+	]) key = await hmac(key, part);
+	if (!sameHex(hex(await hmac(key, toSign)), signed.signature)) throw new S3Error(403, "SignatureDoesNotMatch", "The request signature does not match");
+	return {
+		credential,
+		key,
+		amzDate: signed.amzDate,
+		scope,
+		seed: signed.signature
+	};
+}
+/** The bytes a request stores: its body, or the data of an aws-chunked body, its signatures and checksum checked. A signed hash is checked. */
+async function payloadOf(request, body, chunking) {
+	const declared = request.headers.get("x-amz-content-sha256") ?? "UNSIGNED-PAYLOAD";
+	if (chunking) {
+		const data = new Uint8Array(await new Response(new Blob([body]).stream().pipeThrough(unchunkStream(chunking))).arrayBuffer());
+		const length = request.headers.get("x-amz-decoded-content-length");
+		if (length !== null && Number(length) !== data.length) throw new S3Error(400, "IncompleteBody", "The decoded body is not x-amz-decoded-content-length bytes");
+		return data;
+	}
+	if (/^[0-9a-f]{64}$/.test(declared) && !sameHex(await sha256(body), declared)) throw new S3Error(400, "XAmzContentSHA256Mismatch", "The body's SHA-256 is not x-amz-content-sha256");
+	return body;
+}
+const STREAM_ABOVE = 1048576;
+/** A PUT's body as a stream of the bytes it stores, with their size and signed hash, when an engine can take it so. */
+function streamedBody(request, engine, chunking) {
+	if (request.method !== "PUT" || !request.body || !(engine.putStream || engine.uploadPartStream)) return void 0;
+	const declared = request.headers.get("x-amz-content-sha256") ?? "UNSIGNED-PAYLOAD";
+	const size = Number(request.headers.get(chunking ? "x-amz-decoded-content-length" : "content-length") ?? NaN);
+	if (!Number.isSafeInteger(size) || size <= STREAM_ABOVE) return void 0;
+	return {
+		body: chunking ? request.body.pipeThrough(unchunkStream(chunking)) : request.body,
+		size,
+		.../^[0-9a-f]{64}$/.test(declared) ? { sha256: declared } : {}
+	};
+}
+const EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/** A signed chunk is held whole until its signature is checked: at most this many bytes. */
+const MAX_CHUNK = 16777216;
+/** How a request's aws-chunked body is checked, from its x-amz-content-sha256 and x-amz-trailer; undefined for a body that is not aws-chunked. */
+function chunkingOf(request, signing) {
+	const declared = request.headers.get("x-amz-content-sha256") ?? "UNSIGNED-PAYLOAD";
+	if (!declared.startsWith("STREAMING-")) return void 0;
+	const mode = {
+		"STREAMING-AWS4-HMAC-SHA256-PAYLOAD": {
+			signed: true,
+			trailer: false
+		},
+		"STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER": {
+			signed: true,
+			trailer: true
+		},
+		"STREAMING-UNSIGNED-PAYLOAD-TRAILER": {
+			signed: false,
+			trailer: true
+		}
+	}[declared];
+	if (!mode) throw new S3Error(501, "NotImplemented", `${declared} bodies are not taken: sign each chunk with STREAMING-AWS4-HMAC-SHA256-PAYLOAD, or send STREAMING-UNSIGNED-PAYLOAD-TRAILER with a CRC32 or CRC32C checksum`);
+	if (!mode.trailer) return mode.signed ? { signing } : {};
+	const trailer = (request.headers.get("x-amz-trailer") ?? "").trim().toLowerCase();
+	if (!trailer) throw new S3Error(400, "InvalidRequest", `${declared} needs x-amz-trailer to name its checksum`);
+	if (trailer !== "x-amz-checksum-crc32" && trailer !== "x-amz-checksum-crc32c") throw new S3Error(501, "NotImplemented", `A ${trailer} trailer is not checked: send x-amz-checksum-crc32 or x-amz-checksum-crc32c`);
+	return {
+		...mode.signed ? { signing } : {},
+		trailer: trailer === "x-amz-checksum-crc32" ? "crc32" : "crc32c"
+	};
+}
+const crcTables = /* @__PURE__ */ new Map();
+/** A reflected CRC-32 under `polynomial` (CRC32's 0xEDB88320, CRC32C's 0x82F63B78), carried on from `crc`. */
+function crc32(polynomial, crc, bytes) {
+	let table = crcTables.get(polynomial);
+	if (!table) {
+		table = /* @__PURE__ */ new Uint32Array(256);
+		for (let n = 0; n < 256; n += 1) {
+			let c = n;
+			for (let k = 0; k < 8; k += 1) c = c & 1 ? polynomial ^ c >>> 1 : c >>> 1;
+			table[n] = c >>> 0;
+		}
+		crcTables.set(polynomial, table);
+	}
+	let c = ~crc >>> 0;
+	for (const byte of bytes) c = table[(c ^ byte) & 255] ^ c >>> 8;
+	return ~c >>> 0;
+}
+/**
+* The data of an aws-chunked body as it arrives: `<hex size>[;chunk-signature=…]\r\n<data>\r\n` until a 0
+* chunk, then trailer lines and an empty line. Signed, each chunk is held until its signature, chained from
+* the one before, is checked, so nothing unsigned is passed on; the trailer's signature and checksum are
+* checked at the end, where the stream fails, and the engine keeps nothing, when either does not match.
+*/
+function unchunkStream(chunking) {
+	const signing = chunking.signing;
+	const polynomial = chunking.trailer === "crc32" ? 3988292384 : 2197175160;
+	let state = "size", header = [], remaining = 0;
+	let previous = signing?.seed ?? "", signature = "", held = [], crc = 0;
+	const trailers = [];
+	const signedOver = async (kind, hash) => hex(await hmac(signing.key, [
+		`AWS4-HMAC-SHA256-${kind}`,
+		signing.amzDate,
+		signing.scope,
+		previous,
+		...kind === "PAYLOAD" ? [EMPTY_SHA256] : [],
+		hash
+	].join("\n")));
+	/** Checks the chunk just read against its signature, then passes its data on. */
+	const settleChunk = async (controller) => {
+		if (!signing) return;
+		const data = new Uint8Array(held.reduce((n, part) => n + part.length, 0));
+		held.reduce((at, part) => (data.set(part, at), at + part.length), 0);
+		held = [];
+		const expected = await signedOver("PAYLOAD", await sha256(data));
+		if (!sameHex(expected, signature)) throw new S3Error(403, "SignatureDoesNotMatch", "An aws-chunked chunk's signature does not match");
+		previous = expected;
+		if (data.length) controller.enqueue(data);
+	};
+	return new TransformStream({
+		async transform(bytes, controller) {
+			for (let at = 0; at < bytes.length;) {
+				if (state === "done") return;
+				if (state === "data") {
+					const n = Math.min(remaining, bytes.length - at);
+					const piece = bytes.slice(at, at + n);
+					if (chunking.trailer) crc = crc32(polynomial, crc, piece);
+					if (signing) held.push(piece);
+					else controller.enqueue(piece);
+					remaining -= n, at += n;
+					if (remaining === 0) state = "crlf", header = [];
+					continue;
+				}
+				header.push(bytes[at++]);
+				if (header.length > 4096) throw new S3Error(400, "InvalidRequest", "An aws-chunked chunk header is too long");
+				if (header.length < 2 || header.at(-2) !== 13 || header.at(-1) !== 10) continue;
+				const line = new TextDecoder().decode(new Uint8Array(header.slice(0, -2)));
+				header = [];
+				if (state === "crlf") {
+					if (line !== "") throw new S3Error(400, "IncompleteBody", "An aws-chunked chunk does not end where its size says");
+					await settleChunk(controller);
+					state = "size";
+					continue;
+				}
+				if (state === "trailer") {
+					if (line === "") state = "done";
+					else trailers.push(line);
+					continue;
+				}
+				const [sizeText, ...extensions] = line.split(";");
+				const size = parseInt(sizeText, 16);
+				if (!/^[0-9a-fA-F]+$/.test(sizeText) || !Number.isSafeInteger(size)) throw new S3Error(400, "InvalidRequest", "An aws-chunked chunk size is not hexadecimal");
+				if (signing) {
+					signature = extensions.find((extension) => extension.startsWith("chunk-signature="))?.slice(16) ?? "";
+					if (!/^[0-9a-f]{64}$/.test(signature)) throw new S3Error(403, "SignatureDoesNotMatch", "An aws-chunked chunk is not signed");
+					if (size > MAX_CHUNK) throw new S3Error(400, "InvalidRequest", "An aws-chunked chunk is over 16 MiB");
+				}
+				if (size === 0) {
+					await settleChunk(controller);
+					state = "trailer";
+				} else state = "data", remaining = size;
+			}
+		},
+		async flush() {
+			if (state !== "trailer" && state !== "done") throw new S3Error(400, "IncompleteBody", "The aws-chunked body ends before its last chunk");
+			if (!chunking.trailer) return;
+			const name = `x-amz-checksum-${chunking.trailer}`;
+			const fields = trailers.map((line) => [line.slice(0, line.indexOf(":")).trim().toLowerCase(), line.slice(line.indexOf(":") + 1).trim()]);
+			const checksum = fields.find(([field]) => field === name)?.[1];
+			if (checksum === void 0) throw new S3Error(400, "InvalidRequest", `The aws-chunked body's trailer has no ${name}`);
+			if (signing) {
+				const given = fields.find(([field]) => field === "x-amz-trailer-signature")?.[1] ?? "";
+				if (!sameHex(await signedOver("TRAILER", await sha256(new TextEncoder().encode(`${name}:${checksum}\n`))), given)) throw new S3Error(403, "SignatureDoesNotMatch", "The aws-chunked body's trailer signature does not match");
+			}
+			if (checksum !== btoa(String.fromCharCode(crc >>> 24, crc >>> 16 & 255, crc >>> 8 & 255, crc & 255))) throw new S3Error(400, "BadDigest", `The body's ${chunking.trailer.toUpperCase()} is not its ${name}`);
+		}
+	});
+}
+/** `engine` with each Bucket name a credential may use turned into the name the engine knows it by. */
+function scoped(engine, credential) {
+	const map = credential.buckets;
+	if (!map) return engine;
+	const id = (name) => {
+		if (!Object.hasOwn(map, name)) throw new S3Error(403, "AccessDenied", `The key may not use the Bucket ${name}`);
+		return map[name];
+	};
+	return {
+		put: (bucket, ...rest) => engine.put(id(bucket), ...rest),
+		get: (bucket, ...rest) => engine.get(id(bucket), ...rest),
+		head: (bucket, ...rest) => engine.head(id(bucket), ...rest),
+		delete: (bucket, ...rest) => engine.delete(id(bucket), ...rest),
+		list: (bucket, ...rest) => engine.list(id(bucket), ...rest),
+		copy: (bucket, ...rest) => engine.copy(id(bucket), ...rest),
+		createUpload: (bucket, ...rest) => engine.createUpload(id(bucket), ...rest),
+		uploadPart: (bucket, ...rest) => engine.uploadPart(id(bucket), ...rest),
+		completeUpload: (bucket, ...rest) => engine.completeUpload(id(bucket), ...rest),
+		abortUpload: (bucket, ...rest) => engine.abortUpload(id(bucket), ...rest),
+		usage: (bucket) => engine.usage(id(bucket)),
+		operations: (bucket, ...rest) => engine.operations(id(bucket), ...rest),
+		...streamsOf(engine, id, id)
+	};
+}
+function may(call, bucket, write) {
+	checkBucketName(bucket);
+	if (call.credential.buckets && !Object.hasOwn(call.credential.buckets, bucket)) throw new S3Error(403, "AccessDenied", `The key may not use the Bucket ${bucket}`);
+	if (write && call.credential.access !== "write") throw new S3Error(403, "AccessDenied", "The key may only read");
+	if (write && call.credential.paused?.includes(bucket)) throw new S3Error(403, "QuotaExceeded", `Writes to the Bucket ${bucket} are paused: its Team reached its budget`);
+}
+async function route(call) {
+	const { request, url, bucket, key } = call;
+	const q = url.searchParams, method = request.method;
+	if (!bucket) {
+		if (method === "GET") return listBuckets(call);
+		throw new S3Error(405, "MethodNotAllowed", "Only ListBuckets is answered at the root");
+	}
+	if (!key) {
+		const setting = BUCKET_SETTINGS.find((name) => q.has(name));
+		if (setting) return bucketSetting(call, bucket, setting);
+		if (method === "HEAD" || method === "PUT") return may(call, bucket, false), new Response(null, { status: 200 });
+		if (method === "GET") return may(call, bucket, false), listObjects(call, bucket);
+		if (method === "POST" && q.has("delete")) return may(call, bucket, true), deleteObjects(call, bucket);
+		if (method === "DELETE") throw new S3Error(501, "NotImplemented", "Buckets are deleted by the platform (midsummer storage bucket delete), not over S3");
+		throw new S3Error(501, "NotImplemented", "That Bucket operation is not answered");
+	}
+	checkKey(key);
+	if (q.has("uploads") || q.has("uploadId")) return multipart(call, bucket, key);
+	if (q.has("tagging")) return tagging(call, bucket, key);
+	const other = OBJECT_SETTINGS.find((name) => q.has(name));
+	if (other) throw new S3Error(501, "NotImplemented", other === "acl" ? "Access is granted by a Storage Key's role, not by ACLs" : `The Object operation "${other}" is not answered`);
+	switch (method) {
+		case "GET":
+		case "HEAD":
+			may(call, bucket, false);
+			return getObject(call, bucket, key, method === "HEAD");
+		case "PUT":
+			may(call, bucket, true);
+			return request.headers.has("x-amz-copy-source") ? copyObject(call, bucket, key) : putObject(call, bucket, key);
+		case "DELETE":
+			may(call, bucket, true);
+			await call.engine.delete(bucket, key);
+			return new Response(null, { status: 204 });
+		default: throw new S3Error(405, "MethodNotAllowed", `${method} is not answered on an Object`);
+	}
+}
+/** A Bucket's settings, as S3 calls them in the query: returned as they stand, never changed. */
+const BUCKET_SETTINGS = [
+	"accelerate",
+	"acl",
+	"analytics",
+	"cors",
+	"encryption",
+	"intelligent-tiering",
+	"inventory",
+	"lifecycle",
+	"location",
+	"logging",
+	"metrics",
+	"notification",
+	"object-lock",
+	"ownershipControls",
+	"policy",
+	"policyStatus",
+	"publicAccessBlock",
+	"replication",
+	"requestPayment",
+	"tagging",
+	"uploads",
+	"versioning",
+	"versions",
+	"website"
+];
+/** An Object's subresources other than tags and uploads, none of which is served. */
+const OBJECT_SETTINGS = [
+	"acl",
+	"attributes",
+	"legal-hold",
+	"retention",
+	"restore",
+	"select",
+	"torrent"
+];
+/** Why a Bucket setting cannot be changed, or listed, over S3. */
+const UNCHANGED = {
+	cors: "CORS is open to every origin and cannot be changed: a request is allowed by its signature",
+	lifecycle: "Lifecycle rules are not kept: Objects are kept until they are deleted",
+	tagging: "Tags are not kept",
+	uploads: "ListMultipartUploads is not answered: an unfinished upload is ended by AbortMultipartUpload from the client that started it",
+	versioning: "Versioning is not offered: a put replaces what its key holds",
+	versions: "Versioning is not offered: a put replaces what its key holds",
+	acl: "Access is granted by a Storage Key's role, not by ACLs",
+	policy: "Access is granted by a Storage Key's role, not by policies"
+};
+/** GetBucketLocation, GetBucketVersioning, GetBucketCors and the settings S3 returns "none" for; nothing is changed. */
+async function bucketSetting(call, bucket, setting) {
+	const method = call.request.method;
+	may(call, bucket, method !== "GET" && method !== "HEAD");
+	if (method === "GET") switch (setting) {
+		case "location": return xml(200, `<LocationConstraint xmlns="${XMLNS}"></LocationConstraint>`);
+		case "versioning": return xml(200, `<VersioningConfiguration xmlns="${XMLNS}"></VersioningConfiguration>`);
+		case "cors": return xml(200, `<CORSConfiguration xmlns="${XMLNS}"><CORSRule><AllowedOrigin>*</AllowedOrigin>${CORS_METHODS.map((m) => `<AllowedMethod>${m}</AllowedMethod>`).join("")}<AllowedHeader>*</AllowedHeader><ExposeHeader>ETag</ExposeHeader><MaxAgeSeconds>3000</MaxAgeSeconds></CORSRule></CORSConfiguration>`);
+		case "lifecycle": throw new S3Error(404, "NoSuchLifecycleConfiguration", UNCHANGED.lifecycle);
+		case "tagging": throw new S3Error(404, "NoSuchTagSet", "Buckets have no tags");
+		case "policy": throw new S3Error(404, "NoSuchBucketPolicy", UNCHANGED.policy);
+	}
+	if (method === "DELETE" && (setting === "lifecycle" || setting === "tagging")) return new Response(null, { status: 204 });
+	throw new S3Error(501, "NotImplemented", UNCHANGED[setting] ?? `The Bucket setting "${setting}" is not kept`);
+}
+/** Refuses a put that asks for tags: they are not kept, and dropping them would lose what was asked. */
+function noTags(headers) {
+	if (headers.get("x-amz-tagging")) throw new S3Error(501, "NotImplemented", UNCHANGED.tagging);
+}
+/**
+* Whether an If-Match or If-None-Match list names `etag` (or is `*`). If-Match compares strongly, so
+* a weak validator (`W/"…"`) never matches; If-None-Match compares weakly, ignoring `W/` (RFC 9110, 13.1).
+*/
+function names(list, etag, weak) {
+	return list.split(",").some((tag) => {
+		const trimmed = tag.trim();
+		if (trimmed === "*") return true;
+		if (trimmed.startsWith("W/") && !weak) return false;
+		return trimmed.replace(/^W\//, "").replace(/^"|"$/g, "") === etag;
+	});
+}
+/** An HTTP date in milliseconds; one that is not a date is ignored, as HTTP says. */
+function dateOf(value) {
+	if (value === null) return void 0;
+	const at = Date.parse(value);
+	return Number.isNaN(at) ? void 0 : at;
+}
+/**
+* How `object` meets a request's conditions, as S3 and HTTP check them (each `prefix`ed, such as
+* `x-amz-copy-source-` for the source of a copy): `failed` when If-Match, or without it
+* If-Unmodified-Since, does not hold; `unchanged` when If-None-Match, or without it
+* If-Modified-Since, says the caller has it; otherwise `undefined`. Dates count whole seconds, as
+* Last-Modified carries them.
+*/
+function conditionOf(headers, object, prefix = "") {
+	const modified = Math.floor(object.uploadedAt / 1e3) * 1e3;
+	const match = headers.get(`${prefix}if-match`), none = headers.get(`${prefix}if-none-match`);
+	const unmodifiedSince = dateOf(headers.get(`${prefix}if-unmodified-since`)), modifiedSince = dateOf(headers.get(`${prefix}if-modified-since`));
+	if (match !== null ? !names(match, object.etag, false) : unmodifiedSince !== void 0 && modified > unmodifiedSince) return "failed";
+	if (none !== null ? names(none, object.etag, true) : modifiedSince !== void 0 && modified <= modifiedSince) return "unchanged";
+}
+const COPY_CONDITIONS = [
+	"x-amz-copy-source-if-match",
+	"x-amz-copy-source-if-none-match",
+	"x-amz-copy-source-if-modified-since",
+	"x-amz-copy-source-if-unmodified-since"
+];
+/** Refuses a copy whose source does not meet its `x-amz-copy-source-if-*` conditions: every failure is 412 for a copy. */
+async function checkSource(headers, source) {
+	if (!conditionOf(headers, source, "x-amz-copy-source-")) return;
+	if (source.body instanceof ReadableStream) await source.body.cancel();
+	throw new S3Error(412, "PreconditionFailed", "The copy source does not meet the conditions given");
+}
+function metadataOf(headers) {
+	const metadata = {};
+	for (const [name, value] of headers) if (name.startsWith("x-amz-meta-")) metadata[name.slice(11)] = value;
+	checkMetadata(metadata);
+	return metadata;
+}
+function conditionsOf(headers) {
+	const none = headers.get("if-none-match"), match = headers.get("if-match");
+	if (none !== null && none !== "*") throw new S3Error(501, "NotImplemented", "If-None-Match on a put takes only *");
+	return {
+		...none === "*" ? { ifNoneMatch: "*" } : {},
+		...match !== null ? { ifMatch: match.replace(/^"|"$/g, "") } : {}
+	};
+}
+async function putObject(call, bucket, key) {
+	noTags(call.request.headers);
+	const options = {
+		contentType: call.request.headers.get("content-type") ?? "application/octet-stream",
+		metadata: metadataOf(call.request.headers),
+		...conditionsOf(call.request.headers)
+	};
+	const { streamed, engine } = call;
+	const object = streamed && engine.putStream ? await engine.putStream(bucket, key, streamed.body, streamed.size, {
+		...options,
+		...streamed.sha256 ? { sha256: streamed.sha256 } : {}
+	}) : await engine.put(bucket, key, call.body, options);
+	return new Response(null, {
+		status: 200,
+		headers: { etag: `"${object.etag}"` }
+	});
+}
+/** The Object `x-amz-copy-source` names, which the key must be able to read. */
+function copySource(call) {
+	const source = decodeURIComponent(call.request.headers.get("x-amz-copy-source").replace(/^\//, "").split("?")[0]);
+	const cut = source.indexOf("/");
+	const from = {
+		bucket: source.slice(0, cut),
+		key: source.slice(cut + 1)
+	};
+	if (cut < 1 || !from.key) throw new S3Error(400, "InvalidArgument", "x-amz-copy-source is not <bucket>/<key>");
+	may(call, from.bucket, false);
+	checkKey(from.key);
+	return from;
+}
+/** Object tags: none are kept, so an Object's tag set is empty, deleting it leaves it so, and setting tags is refused. */
+async function tagging(call, bucket, key) {
+	const method = call.request.method;
+	if (method !== "GET" && method !== "DELETE") throw new S3Error(501, "NotImplemented", UNCHANGED.tagging);
+	may(call, bucket, method === "DELETE");
+	if (!await call.engine.head(bucket, key)) throw new StorageError("not_found", `"${key}" holds nothing`);
+	return method === "DELETE" ? new Response(null, { status: 204 }) : xml(200, `<Tagging xmlns="${XMLNS}"><TagSet></TagSet></Tagging>`);
+}
+async function copyObject(call, bucket, key) {
+	const from = copySource(call);
+	const headers = call.request.headers;
+	if (headers.get("x-amz-tagging-directive") === "REPLACE") noTags(headers);
+	const replace = headers.get("x-amz-metadata-directive") === "REPLACE";
+	const conditions = conditionsOf(headers);
+	const checked = COPY_CONDITIONS.some((name) => headers.has(name));
+	let object;
+	if (from.bucket === bucket && !replace && conditions.ifMatch === void 0 && !checked) object = await call.engine.copy(bucket, from.key, key, conditions.ifNoneMatch ? { ifNoneMatch: "*" } : {});
+	else {
+		const { engine } = call;
+		const replacement = replace ? {
+			contentType: headers.get("content-type") ?? "application/octet-stream",
+			metadata: metadataOf(headers)
+		} : void 0;
+		const read = engine.stream && engine.putStream ? await engine.stream(from.bucket, from.key) : await engine.get(from.bucket, from.key);
+		if (!read) throw new StorageError("not_found", `"${from.key}" holds nothing`);
+		await checkSource(headers, read);
+		const options = {
+			...replacement ?? {
+				contentType: read.contentType,
+				metadata: read.metadata
+			},
+			...conditions
+		};
+		object = read.body instanceof ReadableStream ? await engine.putStream(bucket, key, read.body, read.size, options) : await engine.put(bucket, key, read.body, options);
+	}
+	return xml(200, `<CopyObjectResult xmlns="${XMLNS}"><LastModified>${iso(object.uploadedAt)}</LastModified><ETag>${escape(`"${object.etag}"`)}</ETag></CopyObjectResult>`);
+}
+function rangeOf(header) {
+	if (!header) return void 0;
+	const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+	if (!m || m[1] === "" && m[2] === "") return void 0;
+	if (m[1] === "") return { suffix: Number(m[2]) };
+	const offset = Number(m[1]);
+	if (m[2] === "") return { offset };
+	const last = Number(m[2]);
+	if (last < offset) return void 0;
+	return {
+		offset,
+		length: last - offset + 1
+	};
+}
+function objectHeaders(object) {
+	const headers = {
+		etag: `"${object.etag}"`,
+		"content-type": object.contentType,
+		"last-modified": new Date(object.uploadedAt).toUTCString(),
+		"accept-ranges": "bytes"
+	};
+	for (const [name, value] of Object.entries(object.metadata)) headers[`x-amz-meta-${name}`] = value;
+	return headers;
+}
+async function getObject(call, bucket, key, head) {
+	const range = rangeOf(call.request.headers.get("range"));
+	if (head && !range) {
+		const object = await call.engine.head(bucket, key);
+		if (!object) throw new S3Error(404, "NoSuchKey", "The key holds nothing");
+		return await unmet(call.request.headers, object) ?? new Response(null, {
+			status: 200,
+			headers: {
+				...objectHeaders(object),
+				"content-length": String(object.size)
+			}
+		});
+	}
+	let read;
+	try {
+		read = !head && call.engine.stream ? await call.engine.stream(bucket, key, range) : await call.engine.get(bucket, key, range);
+	} catch (error) {
+		if (error instanceof StorageError && error.reason === "range") {
+			const object = await call.engine.head(bucket, key);
+			const refused = object && await unmet(call.request.headers, object);
+			if (refused) return refused;
+		}
+		throw error;
+	}
+	if (!read) throw new S3Error(404, "NoSuchKey", "The key holds nothing");
+	const refused = await unmet(call.request.headers, read);
+	if (refused) return refused;
+	const headers = {
+		...objectHeaders(read),
+		"content-length": String(read.range?.length ?? read.size)
+	};
+	if (read.range) {
+		const last = read.range.offset + read.range.length - 1;
+		return new Response(head ? null : read.body, {
+			status: 206,
+			headers: {
+				...headers,
+				"content-range": `bytes ${read.range.offset}-${last}/${read.size}`
+			}
+		});
+	}
+	return new Response(head ? null : read.body, {
+		status: 200,
+		headers
+	});
+}
+/**
+* The answer to a read whose conditions `object` does not meet: 304 with its validators, or 412.
+* Either way a body already opened is cancelled first, so no stream is left open.
+*/
+async function unmet(headers, object) {
+	const condition = conditionOf(headers, object);
+	if (!condition) return void 0;
+	if ("body" in object && object.body instanceof ReadableStream) await object.body.cancel();
+	if (condition === "failed") throw new S3Error(412, "PreconditionFailed", "At least one of the preconditions given did not hold");
+	if (condition === "unchanged") return new Response(null, {
+		status: 304,
+		headers: {
+			etag: `"${object.etag}"`,
+			"last-modified": new Date(object.uploadedAt).toUTCString()
+		}
+	});
+}
+/** CreateMultipartUpload, UploadPart, CompleteMultipartUpload and AbortMultipartUpload. */
+async function multipart(call, bucket, key) {
+	const { request, url, engine } = call;
+	const q = url.searchParams, uploadId = q.get("uploadId");
+	may(call, bucket, request.method !== "GET");
+	if (request.method === "POST" && q.has("uploads")) {
+		noTags(request.headers);
+		const none = conditionsOf(request.headers).ifNoneMatch;
+		const { uploadId: id } = await engine.createUpload(bucket, key, {
+			contentType: request.headers.get("content-type") ?? "application/octet-stream",
+			metadata: metadataOf(request.headers),
+			...none ? { ifNoneMatch: none } : {}
+		});
+		return xml(200, `<InitiateMultipartUploadResult xmlns="${XMLNS}"><Bucket>${escape(bucket)}</Bucket><Key>${escape(key)}</Key><UploadId>${escape(id)}</UploadId></InitiateMultipartUploadResult>`);
+	}
+	if (uploadId === null) throw new S3Error(400, "InvalidRequest", "The request names no uploadId");
+	checkUploadId(uploadId);
+	if (request.method === "PUT") {
+		const partNumber = Number(q.get("partNumber"));
+		checkPartNumber(partNumber);
+		if (request.headers.has("x-amz-copy-source")) {
+			const from = copySource(call);
+			const range = /^bytes=(\d+)-(\d+)$/.exec(request.headers.get("x-amz-copy-source-range") ?? "");
+			const span = range ? {
+				offset: Number(range[1]),
+				length: Number(range[2]) - Number(range[1]) + 1
+			} : void 0;
+			if (engine.stream && engine.uploadPartStream) {
+				const source = await engine.stream(from.bucket, from.key, span);
+				if (!source) throw new StorageError("not_found", `"${from.key}" holds nothing`);
+				await checkSource(request.headers, source);
+				const part = await engine.uploadPartStream(bucket, key, uploadId, partNumber, source.body, source.range?.length ?? source.size);
+				return xml(200, `<CopyPartResult xmlns="${XMLNS}"><LastModified>${iso(source.uploadedAt)}</LastModified><ETag>${escape(`"${part.etag}"`)}</ETag></CopyPartResult>`);
+			}
+			const read = await engine.get(from.bucket, from.key, span);
+			if (!read) throw new StorageError("not_found", `"${from.key}" holds nothing`);
+			await checkSource(request.headers, read);
+			const part = await engine.uploadPart(bucket, key, uploadId, partNumber, read.body);
+			return xml(200, `<CopyPartResult xmlns="${XMLNS}"><LastModified>${iso(read.uploadedAt)}</LastModified><ETag>${escape(`"${part.etag}"`)}</ETag></CopyPartResult>`);
+		}
+		const { streamed } = call;
+		const part = streamed && engine.uploadPartStream ? await engine.uploadPartStream(bucket, key, uploadId, partNumber, streamed.body, streamed.size, streamed.sha256) : await engine.uploadPart(bucket, key, uploadId, partNumber, call.body);
+		return new Response(null, {
+			status: 200,
+			headers: { etag: `"${part.etag}"` }
+		});
+	}
+	if (request.method === "POST") {
+		const parts = [...new TextDecoder().decode(call.body).matchAll(/<Part>([\s\S]*?)<\/Part>/g)].map((m) => ({
+			partNumber: Number(/<PartNumber>\s*(\d+)\s*<\/PartNumber>/.exec(m[1])?.[1]),
+			etag: unescape(/<ETag>([\s\S]*?)<\/ETag>/.exec(m[1])?.[1] ?? "").trim().replace(/^"|"$/g, "")
+		}));
+		if (parts.length === 0) throw new S3Error(400, "MalformedXML", "CompleteMultipartUpload names no parts");
+		checkParts(parts);
+		const location = `${url.origin}${call.base}/${awsEncode(bucket, true)}/${key.split("/").map((p) => awsEncode(p, true)).join("/")}`;
+		return keptAlive(engine.completeUpload(bucket, key, uploadId, parts).then((object) => `<CompleteMultipartUploadResult xmlns="${XMLNS}"><Location>${escape(location)}</Location><Bucket>${escape(bucket)}</Bucket><Key>${escape(key)}</Key><ETag>${escape(`"${object.etag}"`)}</ETag></CompleteMultipartUploadResult>`));
+	}
+	if (request.method === "DELETE") {
+		await engine.abortUpload(bucket, key, uploadId);
+		return new Response(null, { status: 204 });
+	}
+	throw new S3Error(501, "NotImplemented", "ListParts is not answered: a client keeps the etags of the parts it sent");
+}
+const ANSWER_WITHIN_MS = 1e3;
+const KEEP_ALIVE_MS = 1e4;
+/**
+* The answer to a request whose work can take minutes, as S3 replies to CompleteMultipartUpload: as it
+* stands if it is done within a second, refusals with their own status; else a 200 at once that
+* sends a space every 10 seconds, so clients and proxies keep waiting, then the result or an Error.
+*/
+async function keptAlive(result) {
+	const settled = result.then((body) => ({ body }), (error) => ({ error }));
+	const early = await Promise.race([settled, new Promise((resolve) => setTimeout(() => resolve(null), ANSWER_WITHIN_MS))]);
+	if (early) {
+		if ("error" in early) throw early.error;
+		return xml(200, early.body);
+	}
+	const encoder = new TextEncoder();
+	let timer;
+	const body = new ReadableStream({
+		start(controller) {
+			controller.enqueue(encoder.encode(`<?xml version="1.0" encoding="UTF-8"?>\n`));
+			timer = setInterval(() => controller.enqueue(encoder.encode(" ")), KEEP_ALIVE_MS);
+			settled.then((outcome) => {
+				clearInterval(timer);
+				if ("body" in outcome) controller.enqueue(encoder.encode(outcome.body));
+				else {
+					const error = outcome.error;
+					const [, code] = error instanceof S3Error ? [error.status, error.code] : error instanceof StorageError ? statusOf(error.code, error.reason) : [500, "InternalError"];
+					controller.enqueue(encoder.encode(`<Error><Code>${code}</Code><Message>${escape(error instanceof Error ? error.message : "The upload did not complete")}</Message><RequestId>${crypto.randomUUID()}</RequestId></Error>`));
+				}
+				controller.close();
+			});
+		},
+		cancel() {
+			clearInterval(timer);
+		}
+	});
+	return new Response(body, {
+		status: 200,
+		headers: { "content-type": "application/xml" }
+	});
+}
+async function deleteObjects(call, bucket) {
+	const text = new TextDecoder().decode(call.body);
+	const keys = [...text.matchAll(/<Key>([\s\S]*?)<\/Key>/g)].map((m) => unescape(m[1]));
+	if (keys.length > 1e3) throw new S3Error(400, "MalformedXML", "At most 1,000 keys are deleted at once");
+	const quiet = /<Quiet>\s*true\s*<\/Quiet>/i.test(text);
+	const deleting = /* @__PURE__ */ new Map();
+	const deleted = (key) => {
+		let done = deleting.get(key);
+		if (!done) deleting.set(key, done = (async () => (checkKey(key), await call.engine.delete(bucket, key)))());
+		return done;
+	};
+	const outcomes = await Promise.allSettled(keys.map(deleted));
+	const results = [];
+	for (const [i, outcome] of outcomes.entries()) {
+		const key = keys[i];
+		if (outcome.status === "fulfilled") {
+			if (!quiet) results.push(`<Deleted><Key>${escape(key)}</Key></Deleted>`);
+			continue;
+		}
+		const error = outcome.reason;
+		if (!(error instanceof StorageError)) throw error;
+		results.push(`<Error><Key>${escape(key)}</Key><Code>${statusOf(error.code, error.reason)[1]}</Code><Message>${escape(error.message)}</Message></Error>`);
+	}
+	return xml(200, `<DeleteResult xmlns="${XMLNS}">${results.join("")}</DeleteResult>`);
+}
+async function listObjects(call, bucket) {
+	const q = call.url.searchParams;
+	const v2 = q.get("list-type") === "2";
+	const encode = q.get("encoding-type") === "url";
+	const out = (value) => escape(encode ? encodeURIComponent(value) : value);
+	const prefix = q.get("prefix") ?? "", delimiter = q.get("delimiter") || void 0;
+	const maxKeys = q.has("max-keys") ? Number(q.get("max-keys")) : 1e3;
+	if (!Number.isSafeInteger(maxKeys) || maxKeys < 0) throw new S3Error(400, "InvalidArgument", "max-keys is not a whole number");
+	const token = q.get("continuation-token");
+	const after = v2 ? token !== null ? tokenKey(token) : q.get("start-after") ?? void 0 : q.get("marker") ?? void 0;
+	const listing = maxKeys === 0 ? {
+		objects: [],
+		prefixes: []
+	} : await call.engine.list(bucket, {
+		prefix,
+		limit: Math.min(maxKeys, 1e3),
+		...delimiter ? { delimiter } : {},
+		...after ? { after } : {}
+	});
+	const fields = [
+		`<Name>${escape(bucket)}</Name>`,
+		`<Prefix>${out(prefix)}</Prefix>`,
+		delimiter ? `<Delimiter>${out(delimiter)}</Delimiter>` : "",
+		`<MaxKeys>${maxKeys}</MaxKeys>`,
+		encode ? "<EncodingType>url</EncodingType>" : "",
+		`<IsTruncated>${listing.next !== void 0}</IsTruncated>`,
+		v2 ? `<KeyCount>${listing.objects.length + listing.prefixes.length}</KeyCount>` : `<Marker>${out(q.get("marker") ?? "")}</Marker>`,
+		v2 && token !== null ? `<ContinuationToken>${escape(token)}</ContinuationToken>` : "",
+		v2 && q.has("start-after") ? `<StartAfter>${out(q.get("start-after"))}</StartAfter>` : "",
+		listing.next !== void 0 ? v2 ? `<NextContinuationToken>${keyToken(listing.next)}</NextContinuationToken>` : `<NextMarker>${out(listing.next)}</NextMarker>` : "",
+		...listing.objects.map((o) => `<Contents><Key>${out(o.key)}</Key><LastModified>${iso(o.uploadedAt)}</LastModified><ETag>${escape(`"${o.etag}"`)}</ETag><Size>${o.size}</Size><StorageClass>STANDARD</StorageClass></Contents>`),
+		...listing.prefixes.map((p) => `<CommonPrefixes><Prefix>${out(p)}</Prefix></CommonPrefixes>`)
+	];
+	return xml(200, `<ListBucketResult xmlns="${XMLNS}">${fields.join("")}</ListBucketResult>`);
+}
+const keyToken = (key) => btoa(String.fromCharCode(...new TextEncoder().encode(key))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function tokenKey(token) {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(atob(token.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0)));
+	} catch {
+		throw new S3Error(400, "InvalidArgument", "The continuation token is not one this server gave");
+	}
+}
+function listBuckets(call) {
+	const buckets = Object.keys(call.credential.buckets ?? {}).sort().map((name) => `<Bucket><Name>${escape(name)}</Name><CreationDate>${iso(0)}</CreationDate></Bucket>`).join("");
+	return xml(200, `<ListAllMyBucketsResult xmlns="${XMLNS}"><Owner><ID>project</ID></Owner><Buckets>${buckets}</Buckets></ListAllMyBucketsResult>`);
+}
+const iso = (ms) => new Date(ms).toISOString();
+function escape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function unescape(value) {
+	return value.replace(/&(lt|gt|quot|apos|amp|#(\d+)|#x([0-9a-f]+));/gi, (_, name, dec, hexa) => dec ? String.fromCodePoint(Number(dec)) : hexa ? String.fromCodePoint(parseInt(hexa, 16)) : {
+		lt: "<",
+		gt: ">",
+		quot: "\"",
+		apos: "'",
+		amp: "&"
+	}[name.toLowerCase()]);
+}
+function xml(status, body) {
+	return new Response(`<?xml version="1.0" encoding="UTF-8"?>\n${body}`, {
+		status,
+		headers: { "content-type": "application/xml" }
+	});
+}
+function errorResponse(request, status, code, message, resource) {
+	if (request.method === "HEAD") return new Response(null, {
+		status,
+		headers: { "x-amz-error-code": code }
+	});
+	return xml(status, `<Error><Code>${code}</Code><Message>${escape(message)}</Message><Resource>${escape(resource)}</Resource></Error>`);
+}
+//#endregion
+export { s3 };