@needmoretruth/nmts-cli 0.17.2

package/dist/s3/server.js

@@ -0,0 +1,252 @@
+// The gateway itself: an S3 request in, this account's drive out.
+//
+// ⛔ LOOPBACK ONLY, AND NO OPTION TO CHANGE IT. The machine running this already holds the account
+//    code, and one signature is all that stands between a request and every file in the account.
+//    Bound to an address other people can reach, that one signature becomes the whole lock on the
+//    account -- and the key it checks was printed on somebody's terminal. This is the same call the
+//    rest of the system made on 2026-08-20 when every container port was pulled back to loopback.
+//
+// ⛔ WHAT IS NOT ANSWERED IS REFUSED, LOUDLY. An S3 client that asks for something this gateway does
+//    not do gets 501 and a sentence naming what it does do. The alternative -- answering an empty
+//    listing, or a 200 with nothing behind it -- is how a backup tool reports success over a backup
+//    that never happened.
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { BUCKET, listObjects, objectsOf, folderPrefixesOf, MAX_KEYS_LIMIT } from "./listing.js";
+import { handleMultipart, isMultipartRequest } from "./multipart.js";
+import { responseSink } from "./response-sink.js";
+import { isKeyConflict } from "./same-file.js";
+import { STREAMING_PAYLOAD, STREAMING_PAYLOAD_TRAILER, verifySignature, } from "./sigv4.js";
+import { errorXml, listBucketsXml, listObjectsXml } from "./xml.js";
+/** Where the drive is served. Loopback, always — see the note above. */
+export const BIND_ADDRESS = "127.0.0.1";
+/** A random pair, made fresh every time the gateway starts and stored nowhere. */
+export function newCredential() {
+    const letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+    const raw = randomBytes(20);
+    let id = "NMTS";
+    for (const byte of raw)
+        id += letters[byte % letters.length] ?? "A";
+    return { accessKeyId: id.slice(0, 20), secretAccessKey: randomBytes(30).toString("base64url") };
+}
+function fail(res, status, code, message, resource) {
+    const body = errorXml(code, message, resource);
+    res.writeHead(status, { "content-type": "application/xml", "content-length": String(Buffer.byteLength(body)) });
+    res.end(body);
+}
+/** `/drive/photos/a.jpg` → bucket `drive`, key `photos/a.jpg`. */
+function splitPath(pathname) {
+    const trimmed = pathname.replace(/^\//, "");
+    const at = trimmed.indexOf("/");
+    if (at < 0)
+        return { bucket: decodeURIComponent(trimmed), key: "" };
+    return { bucket: decodeURIComponent(trimmed.slice(0, at)), key: decodeURIComponent(trimmed.slice(at + 1)) };
+}
+function headerOf(req, name) {
+    const raw = req.headers[name];
+    return Array.isArray(raw) ? raw.join(",") : raw;
+}
+/** The one sentence a write gets when this machine has not agreed to spending. */
+function readOnlyBecause() {
+    return ("This gateway is read only. Uploading spends credits, and this machine has not agreed to " +
+        "spending — `nmts consent grant spend`, run by the person whose account this is, is what " +
+        "changes that. Nothing was written.");
+}
+function objectHeaders(object) {
+    return {
+        "content-type": "application/octet-stream",
+        "last-modified": new Date(object.entry.updatedAt).toUTCString(),
+        etag: object.etag,
+        "accept-ranges": "none",
+    };
+}
+async function handle(req, res, options) {
+    const url = req.url ?? "/";
+    const at = url.indexOf("?");
+    const pathname = at < 0 ? url : url.slice(0, at);
+    const query = new URLSearchParams(at < 0 ? "" : url.slice(at + 1));
+    const method = (req.method ?? "GET").toUpperCase();
+    const verdict = verifySignature({ method, url, headers: req.headers }, options.credential, options.now?.() ?? Date.now());
+    if (!verdict.ok) {
+        fail(res, verdict.code === "InvalidAccessKeyId" ? 403 : 403, verdict.code, verdict.message, pathname);
+        return;
+    }
+    const { bucket, key } = splitPath(pathname);
+    if (pathname === "/" && (method === "GET" || method === "HEAD")) {
+        const body = listBucketsXml(BUCKET, new Date(0).toISOString());
+        res.writeHead(200, { "content-type": "application/xml", "content-length": String(Buffer.byteLength(body)) });
+        res.end(method === "HEAD" ? undefined : body);
+        return;
+    }
+    if (bucket !== BUCKET) {
+        fail(res, 404, "NoSuchBucket", `This gateway serves one bucket, named ${BUCKET}.`, pathname);
+        return;
+    }
+    // ⛔ MEASURED, NOT GUESSED: rclone's first act when copying a file is to create the bucket, and a
+    //    refusal here ends the copy before the upload is ever attempted. The bucket exists, so the
+    //    honest answer to "make it" is that it is made.
+    if (key === "" && method === "PUT") {
+        res.writeHead(200, { "content-length": "0" });
+        res.end();
+        return;
+    }
+    const entries = await options.source.entries();
+    if (key === "" && (method === "GET" || method === "HEAD")) {
+        const objects = objectsOf(entries);
+        const listing = listObjects(objects, folderPrefixesOf(entries), {
+            prefix: query.get("prefix") ?? "",
+            delimiter: query.get("delimiter") ?? "",
+            maxKeys: Number(query.get("max-keys") ?? MAX_KEYS_LIMIT) || MAX_KEYS_LIMIT,
+            after: query.get("continuation-token") ?? query.get("start-after") ?? query.get("marker"),
+        });
+        const body = listObjectsXml({
+            bucket: BUCKET,
+            prefix: query.get("prefix") ?? "",
+            delimiter: query.get("delimiter") ?? "",
+            maxKeys: Number(query.get("max-keys") ?? MAX_KEYS_LIMIT) || MAX_KEYS_LIMIT,
+            v2: query.get("list-type") === "2",
+            contents: listing.contents,
+            commonPrefixes: listing.commonPrefixes,
+            truncated: listing.truncated,
+            next: listing.next,
+            encodingType: query.get("encoding-type"),
+        });
+        res.writeHead(200, { "content-type": "application/xml", "content-length": String(Buffer.byteLength(body)) });
+        res.end(method === "HEAD" ? undefined : body);
+        options.log?.(`${method} list prefix=${query.get("prefix") ?? ""} → ${listing.contents.length} keys`);
+        return;
+    }
+    if (method === "HEAD" || method === "GET") {
+        const object = objectsOf(entries).find((o) => o.key === key);
+        if (object === undefined) {
+            fail(res, 404, "NoSuchKey", "This account's file list has no such file.", pathname);
+            return;
+        }
+        if (method === "HEAD") {
+            res.writeHead(200, { ...objectHeaders(object), "content-length": String(object.size) });
+            res.end();
+            options.log?.(`HEAD ${key}`);
+            return;
+        }
+        if (object.entry.dekWrapped === undefined) {
+            fail(res, 500, "InternalError", "That entry has no key in the file list.", pathname);
+            return;
+        }
+        const sink = responseSink(res, { headers: objectHeaders(object) });
+        try {
+            await options.source.fetch(object, sink);
+            options.log?.(`GET ${key} → ${object.size} bytes`);
+        }
+        catch (error) {
+            await sink.abandon();
+            if (!res.headersSent) {
+                fail(res, 502, "InternalError", error instanceof Error ? error.message : String(error), pathname);
+            }
+            options.log?.(`GET ${key} → failed`);
+        }
+        return;
+    }
+    const writer = options.source.write;
+    // ⛔ WHETHER A TAKEN KEY IS A CONFLICT IS NOT DECIDED HERE.
+    //    It used to be, on the strength of the NAME alone, and both upload paths carried their own
+    //    copy of that check. The question is now about CONTENT — is the file arriving the file
+    //    already there — and it cannot be answered until the bytes have arrived, so it is answered
+    //    once, by the writer, at the point both paths meet. What reaches this layer is the verdict:
+    //    a writer that returns normally means the key now holds these bytes (whether it had to send
+    //    them or they were already there), and one that throws a conflict means something else is at
+    //    that key. ⭐ The status matters: 409 is a request the drive declined, 500 is a fault of ours.
+    const refuseConflict = (error) => {
+        fail(res, 409, "InvalidRequest", error instanceof Error ? error.message : String(error), pathname);
+    };
+    if (isMultipartRequest(method, query) && key !== "") {
+        if (writer === undefined) {
+            fail(res, 501, "NotImplemented", readOnlyBecause(), pathname);
+            return;
+        }
+        const handled = await handleMultipart({
+            req,
+            res,
+            bucket: BUCKET,
+            key,
+            method,
+            query,
+            writer,
+            payloadHash: /^[0-9a-f]{64}$/.test(verdict.payloadHash) ? verdict.payloadHash : null,
+            fail: (status, code, message) => fail(res, status, code, message, pathname),
+            ...(options.log === undefined ? {} : { log: options.log }),
+        });
+        if (handled)
+            return;
+    }
+    if (method === "PUT" && key !== "") {
+        if (writer === undefined) {
+            fail(res, 501, "NotImplemented", readOnlyBecause(), pathname);
+            return;
+        }
+        const declared = headerOf(req, "x-amz-content-sha256");
+        if (declared === STREAMING_PAYLOAD || declared === STREAMING_PAYLOAD_TRAILER) {
+            fail(res, 501, "NotImplemented", "This gateway does not read chunk-signed uploads yet. Tell the client to send the body " +
+                "unsigned (the AWS CLI calls this --no-sign-payload on http endpoints; rclone already " +
+                "does it).", pathname);
+            return;
+        }
+        const length = Number(headerOf(req, "content-length") ?? "");
+        if (!Number.isInteger(length) || length < 0) {
+            fail(res, 411, "MissingContentLength", "This gateway needs to know the size before it starts.", pathname);
+            return;
+        }
+        try {
+            await writer.put(key, req, length);
+        }
+        catch (error) {
+            if (isKeyConflict(error)) {
+                refuseConflict(error);
+                return;
+            }
+            fail(res, 500, "InternalError", error instanceof Error ? error.message : String(error), pathname);
+            return;
+        }
+        res.writeHead(200, { "content-length": "0" });
+        res.end();
+        options.log?.(`PUT ${key} → ${length} bytes`);
+        return;
+    }
+    if (method === "DELETE" && key !== "") {
+        if (writer === undefined) {
+            fail(res, 501, "NotImplemented", readOnlyBecause(), pathname);
+            return;
+        }
+        const object = objectsOf(entries).find((o) => o.key === key);
+        if (object === undefined) {
+            // S3 answers 204 for a key that is not there, and clients rely on it: a sync that deletes
+            // the same key twice must not fail the second time.
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        try {
+            await writer.trash(object);
+        }
+        catch (error) {
+            fail(res, 500, "InternalError", error instanceof Error ? error.message : String(error), pathname);
+            return;
+        }
+        res.writeHead(204);
+        res.end();
+        options.log?.(`DELETE ${key} → trash`);
+        return;
+    }
+    fail(res, 501, "NotImplemented", `This gateway does not answer ${method} on that address.`, pathname);
+}
+export function createGateway(options) {
+    return createServer((req, res) => {
+        handle(req, res, options).catch((error) => {
+            if (!res.headersSent) {
+                fail(res, 500, "InternalError", error instanceof Error ? error.message : String(error), req.url ?? "/");
+            }
+            else {
+                res.destroy();
+            }
+        });
+    });
+}

package/dist/s3/sigv4.js

@@ -0,0 +1,168 @@
+// AWS Signature Version 4, the verifying half.
+//
+// ⛔ WHY A LOCAL SERVER CHECKS SIGNATURES AT ALL. This gateway listens on the loopback address of a
+//    machine that already holds an account code, and a request that reaches it can upload, read and
+//    delete that account's files. "It is only local" is not an argument: every other program on the
+//    machine, and every page a browser on it loads, can also reach 127.0.0.1. The signature is the
+//    one thing that separates the tool the person started from everything else running as them.
+//
+// ⛔ WHAT IS DELIBERATELY NOT HERE. The body is not hashed here. The signature covers a payload hash
+//    the client DECLARES in `x-amz-content-sha256`, and whether the bytes that follow really hash to
+//    that value can only be known once they have all arrived. This module returns the declared value
+//    and the caller enforces it while streaming -- doing it here would mean holding whole uploads in
+//    memory before a single byte reached the storage network.
+//
+// The rules implemented are S3's, which differ from the generic SigV4 ones in one way that matters:
+// the canonical path is the request path EXACTLY as it arrived, neither normalised nor re-encoded.
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+/** How far a request's own timestamp may sit from ours before it is refused. AWS uses the same. */
+export const MAX_CLOCK_SKEW_MS = 15 * 60 * 1000;
+/** The literals a client may put in `x-amz-content-sha256` instead of a hex digest. */
+export const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+export const STREAMING_PAYLOAD = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD";
+export const STREAMING_PAYLOAD_TRAILER = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER";
+function refuse(code, message) {
+    return { ok: false, code, message };
+}
+function headerValue(headers, name) {
+    const raw = headers[name];
+    if (raw === undefined)
+        return undefined;
+    return Array.isArray(raw) ? raw.join(",") : String(raw);
+}
+/**
+ * RFC 3986 encoding, which is what SigV4 means by "URI-encode".
+ *
+ * ⚠ `encodeURIComponent` leaves `!'()*` alone and AWS does not, so those four are finished by hand.
+ * A query string that contains one of them and is encoded the JavaScript way produces a different
+ * canonical request from the client's, and the request is refused for no reason a person can see.
+ */
+function uriEncode(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** `k=v&k2=v2` in the order AWS wants: encoded, sorted by key and then by value. */
+export function canonicalQuery(rawQuery) {
+    if (rawQuery.length === 0)
+        return "";
+    const pairs = [];
+    for (const part of rawQuery.split("&")) {
+        if (part.length === 0)
+            continue;
+        const at = part.indexOf("=");
+        const key = at < 0 ? part : part.slice(0, at);
+        const value = at < 0 ? "" : part.slice(at + 1);
+        pairs.push([uriEncode(decodeURIComponent(key)), uriEncode(decodeURIComponent(value))]);
+    }
+    pairs.sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : 1) : a[0] < b[0] ? -1 : 1));
+    return pairs.map(([k, v]) => `${k}=${v}`).join("&");
+}
+/** Pull apart `AWS4-HMAC-SHA256 Credential=…, SignedHeaders=…, Signature=…`. */
+export function parseAuthorization(header) {
+    if (header === undefined || !header.startsWith("AWS4-HMAC-SHA256 "))
+        return null;
+    const fields = new Map();
+    for (const part of header.slice("AWS4-HMAC-SHA256 ".length).split(",")) {
+        const at = part.indexOf("=");
+        if (at < 0)
+            return null;
+        fields.set(part.slice(0, at).trim(), part.slice(at + 1).trim());
+    }
+    const credential = fields.get("Credential");
+    const signedHeaders = fields.get("SignedHeaders");
+    const signature = fields.get("Signature");
+    if (credential === undefined || signedHeaders === undefined || signature === undefined)
+        return null;
+    const scope = credential.split("/");
+    if (scope.length !== 5 || scope[4] !== "aws4_request")
+        return null;
+    const [accessKeyId, date, region, service] = scope;
+    if (accessKeyId === undefined || date === undefined || region === undefined || service === undefined) {
+        return null;
+    }
+    return {
+        accessKeyId,
+        date,
+        region,
+        service,
+        signedHeaders: signedHeaders.split(";").filter((h) => h.length > 0),
+        signature,
+    };
+}
+function signingKey(secret, date, region, service) {
+    const kDate = createHmac("sha256", `AWS4${secret}`).update(date).digest();
+    const kRegion = createHmac("sha256", kDate).update(region).digest();
+    const kService = createHmac("sha256", kRegion).update(service).digest();
+    return createHmac("sha256", kService).update("aws4_request").digest();
+}
+/** `20260824T232759Z` → epoch milliseconds, or null if it is not that shape. */
+export function amzDateToMs(stamp) {
+    if (stamp === undefined)
+        return null;
+    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(stamp);
+    if (m === null)
+        return null;
+    return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]), Number(m[4]), Number(m[5]), Number(m[6]));
+}
+/**
+ * Rebuild the string the client signed and check that the signature matches.
+ *
+ * The clock is passed in rather than read here: a test that cannot choose "now" cannot check the
+ * skew rule at all, and that rule is the one that stops a captured request being replayed tomorrow.
+ */
+export function verifySignature(request, credential, now) {
+    const auth = parseAuthorization(headerValue(request.headers, "authorization"));
+    if (auth === null)
+        return refuse("AccessDenied", "no AWS Signature Version 4 authorization header");
+    if (auth.accessKeyId !== credential.accessKeyId) {
+        return refuse("InvalidAccessKeyId", "that access key is not the one this gateway printed");
+    }
+    const stamp = headerValue(request.headers, "x-amz-date");
+    const signedAt = amzDateToMs(stamp);
+    if (signedAt === null)
+        return refuse("AccessDenied", "missing or malformed x-amz-date");
+    if (Math.abs(now - signedAt) > MAX_CLOCK_SKEW_MS) {
+        return refuse("RequestTimeTooSkewed", "the request's own timestamp is too far from this clock");
+    }
+    if (stamp !== undefined && !stamp.startsWith(auth.date)) {
+        return refuse("AccessDenied", "the signature's date does not match x-amz-date");
+    }
+    const payloadHash = headerValue(request.headers, "x-amz-content-sha256");
+    if (payloadHash === undefined) {
+        return refuse("AccessDenied", "missing x-amz-content-sha256");
+    }
+    const canonicalHeaders = [];
+    for (const name of auth.signedHeaders) {
+        const value = headerValue(request.headers, name);
+        if (value === undefined) {
+            return refuse("AccessDenied", `the signature covers a header that is not here: ${name}`);
+        }
+        canonicalHeaders.push(`${name}:${value.trim().replace(/\s+/g, " ")}\n`);
+    }
+    const at = request.url.indexOf("?");
+    const path = at < 0 ? request.url : request.url.slice(0, at);
+    const query = at < 0 ? "" : request.url.slice(at + 1);
+    const canonicalRequest = [
+        request.method.toUpperCase(),
+        path,
+        canonicalQuery(query),
+        canonicalHeaders.join(""),
+        auth.signedHeaders.join(";"),
+        payloadHash,
+    ].join("\n");
+    const scope = `${auth.date}/${auth.region}/${auth.service}/aws4_request`;
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        stamp,
+        scope,
+        createHash("sha256").update(canonicalRequest).digest("hex"),
+    ].join("\n");
+    const expected = createHmac("sha256", signingKey(credential.secretAccessKey, auth.date, auth.region, auth.service))
+        .update(stringToSign)
+        .digest("hex");
+    const given = Buffer.from(auth.signature, "utf8");
+    const mine = Buffer.from(expected, "utf8");
+    if (given.length !== mine.length || !timingSafeEqual(given, mine)) {
+        return refuse("SignatureDoesNotMatch", "the signature does not match what was signed");
+    }
+    return { ok: true, payloadHash };
+}

package/dist/s3/staging.js

@@ -0,0 +1,87 @@
+// Where the pieces of a multipart upload wait until they are one file.
+//
+// ⛔ ITS OWN MODULE SO IT CAN BE TESTED WITHOUT AN ACCOUNT. What goes wrong here is ordering and
+//    integrity -- pieces arrive at the same time and out of order, and one that changed on the way
+//    becomes part of a file that opens and is wrong. Both are testable against a real directory
+//    with a stub for the one thing that costs money, and neither is testable through a command that
+//    starts by opening a session.
+//
+// ⛔ ONE DIRECTORY PER RUN, 0700, AND EVERY PIECE 0600. The pieces are somebody's plaintext; left
+//    in a shared temporary directory under a predictable name they would be readable by every other
+//    account on the machine, for as long as the upload takes.
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { NmtsError } from "../errors.js";
+export function createStaging(root, store) {
+    const inFlight = new Map();
+    const dirOf = (uploadId) => join(root, uploadId);
+    const openUpload = (uploadId) => {
+        const upload = inFlight.get(uploadId);
+        if (upload === undefined)
+            throw new NmtsError("No upload is in progress with that id.");
+        return upload;
+    };
+    return {
+        async begin(key) {
+            const uploadId = randomUUID();
+            await mkdir(dirOf(uploadId), { recursive: true, mode: 0o700 });
+            inFlight.set(uploadId, { key, parts: new Set() });
+            return uploadId;
+        },
+        // ⛔ EACH PIECE IS ITS OWN FILE NAMED BY ITS NUMBER, and nothing is appended: a real client
+        //    sends them concurrently and out of order (measured from rclone: 1, 3, 2).
+        async part(uploadId, partNumber, body, size, expectedSha256) {
+            const upload = openUpload(uploadId);
+            const path = join(dirOf(uploadId), String(partNumber));
+            const digest = createHash("sha256");
+            const hashing = new Transform({
+                transform(chunk, _encoding, next) {
+                    digest.update(chunk);
+                    next(null, chunk);
+                },
+            });
+            await pipeline(body, hashing, createWriteStream(path, { mode: 0o600 }));
+            const written = (await stat(path)).size;
+            // ⛔ WHAT THE CLIENT SIGNED FOR IS WHAT MUST HAVE ARRIVED. A piece that changed on the way is
+            //    the one failure a backup cannot notice later.
+            if (expectedSha256 !== null && digest.digest("hex") !== expectedSha256) {
+                await rm(path, { force: true });
+                throw new NmtsError("That part's bytes do not hash to what the request declared.");
+            }
+            if (written !== size) {
+                await rm(path, { force: true });
+                throw new NmtsError(`The part said ${size} bytes and ${written} arrived.`);
+            }
+            upload.parts.add(partNumber);
+            return `"${partNumber.toString(16).padStart(32, "0")}-1"`;
+        },
+        async complete(uploadId) {
+            const upload = openUpload(uploadId);
+            const numbers = [...upload.parts].sort((a, b) => a - b);
+            if (numbers.length === 0)
+                throw new NmtsError("That upload has no parts to finish.");
+            const whole = join(dirOf(uploadId), "whole");
+            const out = createWriteStream(whole, { mode: 0o600 });
+            try {
+                for (const number of numbers) {
+                    await pipeline(createReadStream(join(dirOf(uploadId), String(number))), out, { end: false });
+                }
+                await new Promise((resolve) => out.end(resolve));
+                await store(upload.key, whole);
+            }
+            finally {
+                inFlight.delete(uploadId);
+                await rm(dirOf(uploadId), { recursive: true, force: true });
+            }
+            return `"${uploadId.replace(/-/g, "").slice(0, 32)}-${numbers.length}"`;
+        },
+        async abort(uploadId) {
+            inFlight.delete(uploadId);
+            await rm(dirOf(uploadId), { recursive: true, force: true });
+        },
+    };
+}

package/dist/s3/xml.js

@@ -0,0 +1,80 @@
+// The XML the S3 protocol answers in.
+//
+// ⛔ WRITTEN BY HAND, ON PURPOSE. Pulling in an XML builder to emit five fixed shapes would add a
+//    dependency to a tool whose whole dependency list is auditable in one screen, and this is the
+//    one place where the output is dictated by somebody else's specification -- there is nothing to
+//    design, only to match.
+//
+// ⚠ EVERY VALUE THAT CAME FROM A FILE NAME IS ESCAPED. Names in this drive are whatever a person
+//   typed, including `&` and `<`, and an unescaped one produces XML the client cannot parse -- a
+//   listing that fails for one badly-named file and works for everything else.
+/** The five characters XML cannot carry raw. */
+export function escapeXml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+const HEAD = `<?xml version="1.0" encoding="UTF-8"?>`;
+const NS = `http://s3.amazonaws.com/doc/2006-03-01/`;
+export function errorXml(code, message, resource) {
+    return (`${HEAD}<Error><Code>${escapeXml(code)}</Code><Message>${escapeXml(message)}</Message>` +
+        `<Resource>${escapeXml(resource)}</Resource></Error>`);
+}
+export function listBucketsXml(bucket, createdAt) {
+    return (`${HEAD}<ListAllMyBucketsResult xmlns="${NS}"><Owner><ID>nmts</ID>` +
+        `<DisplayName>nmts</DisplayName></Owner><Buckets><Bucket>` +
+        `<Name>${escapeXml(bucket)}</Name><CreationDate>${escapeXml(createdAt)}</CreationDate>` +
+        `</Bucket></Buckets></ListAllMyBucketsResult>`);
+}
+export function initiateUploadXml(bucket, key, uploadId) {
+    return (`${HEAD}<InitiateMultipartUploadResult xmlns="${NS}">` +
+        `<Bucket>${escapeXml(bucket)}</Bucket><Key>${escapeXml(key)}</Key>` +
+        `<UploadId>${escapeXml(uploadId)}</UploadId></InitiateMultipartUploadResult>`);
+}
+export function completeUploadXml(bucket, key, etag) {
+    return (`${HEAD}<CompleteMultipartUploadResult xmlns="${NS}">` +
+        `<Location>/${escapeXml(bucket)}/${escapeXml(key)}</Location>` +
+        `<Bucket>${escapeXml(bucket)}</Bucket><Key>${escapeXml(key)}</Key>` +
+        `<ETag>${escapeXml(etag)}</ETag></CompleteMultipartUploadResult>`);
+}
+/** `encoding-type=url` means every name in the answer comes back percent-encoded. */
+function out(value, encodingType) {
+    return escapeXml(encodingType === "url" ? encodeURIComponent(value) : value);
+}
+export function listObjectsXml(listing) {
+    const enc = listing.encodingType;
+    const parts = [
+        HEAD,
+        `<ListBucketResult xmlns="${NS}">`,
+        `<Name>${escapeXml(listing.bucket)}</Name>`,
+        `<Prefix>${out(listing.prefix, enc)}</Prefix>`,
+        listing.delimiter.length > 0 ? `<Delimiter>${out(listing.delimiter, enc)}</Delimiter>` : "",
+        `<MaxKeys>${listing.maxKeys}</MaxKeys>`,
+        enc === null ? "" : `<EncodingType>${escapeXml(enc)}</EncodingType>`,
+        `<IsTruncated>${listing.truncated ? "true" : "false"}</IsTruncated>`,
+    ];
+    if (listing.v2) {
+        parts.push(`<KeyCount>${listing.contents.length + listing.commonPrefixes.length}</KeyCount>`);
+        if (listing.next !== null) {
+            parts.push(`<NextContinuationToken>${escapeXml(listing.next)}</NextContinuationToken>`);
+        }
+    }
+    else if (listing.next !== null) {
+        parts.push(`<NextMarker>${out(listing.next, enc)}</NextMarker>`);
+    }
+    for (const row of listing.contents) {
+        parts.push(`<Contents><Key>${out(row.key, enc)}</Key>` +
+            `<LastModified>${escapeXml(row.lastModified)}</LastModified>` +
+            `<ETag>${escapeXml(row.etag)}</ETag>` +
+            `<Size>${row.size}</Size>` +
+            `<StorageClass>STANDARD</StorageClass></Contents>`);
+    }
+    for (const prefix of listing.commonPrefixes) {
+        parts.push(`<CommonPrefixes><Prefix>${out(prefix, enc)}</Prefix></CommonPrefixes>`);
+    }
+    parts.push(`</ListBucketResult>`);
+    return parts.join("");
+}