@nxgt/s3 0.2.0 → 0.3.0

package/README.md

@@ -34,12 +34,15 @@ everything this package does not wrap is still there.
 ## Install
 
 ```sh
-bun add @nxgt/s3 typescript
+bun add @nxgt/s3 typescript @types/bun
 ```
 
 - **Bun 1.4 or later, and Bun only.** `S3Client` is built into Bun, which is
   why there is no SDK to install — and why this package does not run on Node.
 - `typescript` `^6.0.3`: required peer, the version every `@nxgt` package pins.
+- `@types/bun`: required to typecheck. The shipped declarations name Bun's own
+  `S3Client`, `S3File` and `S3Options`, so without Bun's types the first `tsc`
+  fails with `Cannot find module 'bun'`.
 - Tested against SeaweedFS 4.47's S3 gateway. Anything S3-compatible that Bun
   can sign for will do; a service that is not AWS wants
   `virtualHostedStyle: false`.
@@ -171,6 +174,7 @@ if (error instanceof S3Error && error.code === 'TOO_LARGE') {
 | `WRONG_TYPE` | the body's content type is not one this bucket accepts — or the write named none and the bucket names some |
 | `TOO_LARGE` | the body is bigger than `maxSize` |
 | `UNMEASURABLE` | `maxSize` is set and the body's size cannot be known before sending |
+| `WRONG_OPTION` | an option's own value is not one the service accepts: `acl` or `storageClass` on a write, `acl` or `expiresIn` on a presigned URL |
 
 `defineBucket` throws a `TypeError` for a definition that could never work: an
 empty `bucket`, a `maxSize` that is not a positive number, an empty list of
@@ -239,18 +243,22 @@ Each is a `@ts-expect-error` case in `test/types/s3.ts`.
   set and one without come back with the **same** ETag, and neither carries
   the `-<parts>` suffix a multipart upload leaves. Use `file(params).writer()`
   for a body that wants parts.
-- **An option's *value* is Bun's to check, and it throws Bun's error.** The
-  guards refuse a content type and a size before anything is sent, and raise
-  `S3Error`. An `acl` or a `storageClass` outside what Bun accepts raises
-  Bun's own `TypeError` instead — measured:
-  `storageClass: 'NOPE'` gives `TypeError: storageClass must be one of …`, and
-  `instanceof S3Error` is false. `contentDisposition` and `contentEncoding`
-  are plain strings to Bun and accept anything. Nothing is sent either way; it
-  is the class a handler catches that differs, so validate a bag from a
-  request body before passing it on.
+- **A wrong `acl` or `storageClass` is `WRONG_OPTION`, not Bun's `TypeError`.**
+  Both values are checked here, with the content type and the size — and an
+  `acl` on a presigned URL against the same list — so one `catch` takes every
+  refusal:
+  `if (error instanceof S3Error) return c.json({ error: error.code }, 400);`.
+  `contentDisposition` and `contentEncoding` are free strings and are never
+  refused. `presignGet` and `presignPut` forward `acl` too, and go through the
+  same allowlist. The accepted values are listed in
+  [docs/guide/writes.md](docs/guide/writes.md).
 - **A string body is measured in bytes, not in characters**, and `maxSize` is
   inclusive: 1024 passes, 1025 does not.
-- **`expiresIn` is seconds, and Bun's default is a day.** Always pass one.
+- **`expiresIn` is seconds, and Bun's default is a day.** Always pass one. An
+  `S3Error` with `code: 'WRONG_OPTION'` refuses it above 604 800 seconds —
+  seven days, S3's own cap on a presigned URL — at or below zero, and for
+  anything that is not a finite number, so a signed URL this package hands
+  back is one the service will accept.
 - **A key is built, never guessed.** `keyFor` is there so a caller that needs
   the string gets *the* string; building one by hand somewhere else is how a
   bucket ends up with two spellings of the same object.
@@ -265,6 +273,15 @@ Each is a `@ts-expect-error` case in `test/types/s3.ts`.
   `undefined`; every other failure — a wrong secret, a refused request, a
   service that is down — comes back as the error it is.
 
+## Documentation
+
+- [docs/README.md](docs/README.md) — the guide index: buckets, reading,
+  writing and presigned URLs, each with its options and a worked example.
+- [docs/troubleshooting.md](docs/troubleshooting.md) — every error this
+  package can raise, by the message you will see.
+- [docs/roadmap.md](docs/roadmap.md) — what is coming, and what has been
+  ruled out.
+
 ## License
 
 MIT

package/dist/bucket/guards.d.ts

@@ -22,4 +22,10 @@ export declare function sizeOf(body: PutBody): number | undefined;
 export declare function checkType<P>(context: BucketContext<P>, key: string, type: string | undefined): void;
 /** Refuses a body the bucket does not accept, before anything is sent. */
 export declare function checkSize<P>(context: BucketContext<P>, key: string, body: PutBody): void;
+/**
+ * Refuses a value the service does not accept for `acl` or `storageClass`.
+ * Shared by `put` and `presign`, so the same wrong `acl` is the same error
+ * whichever one a caller reached for. An option with no fixed set passes.
+ */
+export declare function checkOption(key: string, name: string, value: unknown): void;
 //# sourceMappingURL=guards.d.ts.map

package/dist/bucket/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/bucket/guards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAGpB;AAED,8EAA8E;AAC9E,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAaxD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,CAAC,EAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,SAAS,GACtB,IAAI,CAmBN;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,CAAC,EAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,GACX,IAAI,CAoBN"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/bucket/guards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAc,MAAM,SAAS,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAGpB;AAED,8EAA8E;AAC9E,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAaxD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,CAAC,EAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,SAAS,GACtB,IAAI,CAmBN;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,CAAC,EAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,GACX,IAAI,CAoBN;AA4ED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAiB3E"}

package/dist/bucket/operations/presign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presign.d.ts","sourceRoot":"","sources":["../../../src/bucket/operations/presign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AACrC,OAAO,EAAE,KAAK,aAAa,EAAS,MAAM,YAAY,CAAC;AAEvD,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;CACvB;AA4BD,wBAAgB,aAAa,CAAC,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,cAAc,GACtB,MAAM,CAKR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,cAAc,GACtB,MAAM,CAKR"}
+{"version":3,"file":"presign.d.ts","sourceRoot":"","sources":["../../../src/bucket/operations/presign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AACrC,OAAO,EAAE,KAAK,aAAa,EAAS,MAAM,YAAY,CAAC;AAGvD,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC9B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;CACvB;AAqCD,wBAAgB,aAAa,CAAC,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,cAAc,GACtB,MAAM,CAMR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,cAAc,GACtB,MAAM,CAMR"}

package/dist/bucket/operations/writes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writes.d.ts","sourceRoot":"","sources":["../../../src/bucket/operations/writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAS,MAAM,YAAY,CAAC;AAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAChC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,UAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAYf;AAyCD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,CAAC,EAC7B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,GACP,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"writes.d.ts","sourceRoot":"","sources":["../../../src/bucket/operations/writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAS,MAAM,YAAY,CAAC;AAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAChC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,UAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAef;AA4CD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,CAAC,EAC7B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,GACP,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/errors/s3-error.d.ts

@@ -5,7 +5,12 @@ export type S3ErrorCode =
 /** The body is bigger than this bucket's `maxSize`. */
  | 'TOO_LARGE'
 /** The body's size cannot be known before sending, and `maxSize` is set. */
- | 'UNMEASURABLE';
+ | 'UNMEASURABLE'
+/**
+ * An option's own value is not one the service accepts: `acl` or
+ * `storageClass` on a write, `acl` or `expiresIn` on a presigned URL.
+ */
+ | 'WRONG_OPTION';
 /**
  * This package's only error, and every one of them is thrown **before**
  * anything is sent. S3's own failures come back as they are, from Bun's

package/dist/errors/s3-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3-error.d.ts","sourceRoot":"","sources":["../../src/errors/s3-error.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,MAAM,WAAW;AACtB,8DAA8D;AAC5D,YAAY;AACd,uDAAuD;GACrD,WAAW;AACb,4EAA4E;GAC1E,cAAc,CAAC;AAElB;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM3D"}
+{"version":3,"file":"s3-error.d.ts","sourceRoot":"","sources":["../../src/errors/s3-error.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,MAAM,WAAW;AACtB,8DAA8D;AAC5D,YAAY;AACd,uDAAuD;GACrD,WAAW;AACb,4EAA4E;GAC1E,cAAc;AAChB;;;GAGG;GACD,cAAc,CAAC;AAElB;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM3D"}

package/dist/index.js

@@ -36,52 +36,6 @@ async function listObjects(context, options = {}) {
   return { items, nextCursor: next };
 }
 
-// src/bucket/operations/presign.ts
-var SIGNED = ["expiresIn", "acl"];
-function signed(options) {
-  const forwarded = {};
-  for (const key of SIGNED) {
-    if (options?.[key] !== undefined)
-      forwarded[key] = options[key];
-  }
-  return forwarded;
-}
-function presignGetUrl(context, params, options) {
-  return context.client.presign(keyOf(context, params), {
-    ...signed(options),
-    method: "GET"
-  });
-}
-function presignPutUrl(context, params, options) {
-  return context.client.presign(keyOf(context, params), {
-    ...signed(options),
-    method: "PUT"
-  });
-}
-
-// src/bucket/operations/reads.ts
-async function whenPresent(context, params, read) {
-  try {
-    return await read(context.client.file(keyOf(context, params)));
-  } catch (reason) {
-    if (reason.code === "NoSuchKey")
-      return;
-    throw reason;
-  }
-}
-function readBytes(context, params) {
-  return whenPresent(context, params, (file) => file.bytes());
-}
-function readText(context, params) {
-  return whenPresent(context, params, (file) => file.text());
-}
-function statObject(context, params) {
-  return whenPresent(context, params, (file) => file.stat());
-}
-function objectExists(context, params) {
-  return context.client.exists(keyOf(context, params));
-}
-
 // src/errors/s3-error.ts
 class S3Error extends Error {
   constructor(code, key, message) {
@@ -135,6 +89,104 @@ function checkSize(context, key, body) {
     throw new S3Error("TOO_LARGE", key, `"${bucket}" accepts ${maxSize} bytes at most, and this body is ${size}`);
   }
 }
+var ACLS = [
+  "private",
+  "public-read",
+  "public-read-write",
+  "aws-exec-read",
+  "authenticated-read",
+  "bucket-owner-read",
+  "bucket-owner-full-control",
+  "log-delivery-write"
+];
+var STORAGE_CLASSES = [
+  "STANDARD",
+  "DEEP_ARCHIVE",
+  "EXPRESS_ONEZONE",
+  "GLACIER",
+  "GLACIER_IR",
+  "INTELLIGENT_TIERING",
+  "ONEZONE_IA",
+  "OUTPOSTS",
+  "REDUCED_REDUNDANCY",
+  "SNOW",
+  "STANDARD_IA"
+];
+var ALLOWED = {
+  acl: ACLS,
+  storageClass: STORAGE_CLASSES
+};
+var MAX_EXPIRES_IN = 604800;
+function checkOption(key, name, value) {
+  if (value === undefined)
+    return;
+  if (name === "expiresIn") {
+    checkExpiresIn(key, value);
+    return;
+  }
+  const allowed = ALLOWED[name];
+  if (!allowed)
+    return;
+  if (!allowed.includes(value)) {
+    throw new S3Error("WRONG_OPTION", key, `${name} must be one of ${allowed.join(", ")}; got ${JSON.stringify(value)}`);
+  }
+}
+function checkExpiresIn(key, value) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_EXPIRES_IN) {
+    throw new S3Error("WRONG_OPTION", key, `expiresIn is seconds, and must be above 0 and at most ` + `${MAX_EXPIRES_IN} (seven days, which is S3's own limit); ` + `got ${JSON.stringify(value)}`);
+  }
+}
+
+// src/bucket/operations/presign.ts
+var SIGNED = ["expiresIn", "acl"];
+function signed(key, options) {
+  const forwarded = {};
+  for (const name of SIGNED) {
+    const value = options?.[name];
+    if (value === undefined)
+      continue;
+    checkOption(key, name, value);
+    forwarded[name] = value;
+  }
+  return forwarded;
+}
+function presignGetUrl(context, params, options) {
+  const key = keyOf(context, params);
+  return context.client.presign(key, {
+    ...signed(key, options),
+    method: "GET"
+  });
+}
+function presignPutUrl(context, params, options) {
+  const key = keyOf(context, params);
+  return context.client.presign(key, {
+    ...signed(key, options),
+    method: "PUT"
+  });
+}
+
+// src/bucket/operations/reads.ts
+async function whenPresent(context, params, read) {
+  try {
+    return await read(context.client.file(keyOf(context, params)));
+  } catch (reason) {
+    if (reason.code === "NoSuchKey")
+      return;
+    throw reason;
+  }
+}
+function readBytes(context, params) {
+  return whenPresent(context, params, (file) => file.bytes());
+}
+function readText(context, params) {
+  return whenPresent(context, params, (file) => file.text());
+}
+function statObject(context, params) {
+  return whenPresent(context, params, (file) => file.stat());
+}
+function objectExists(context, params) {
+  return context.client.exists(keyOf(context, params));
+}
 
 // src/bucket/operations/writes.ts
 async function putObject(context, params, body, options = {}) {
@@ -142,8 +194,9 @@ async function putObject(context, params, body, options = {}) {
   const type = effectiveType(body, options.type);
   checkType(context, key, type);
   checkSize(context, key, body);
+  const forwarded = passed(key, options);
   await context.client.write(key, body, {
-    ...passed(options),
+    ...forwarded,
     ...type ? { type } : {}
   });
 }
@@ -153,11 +206,14 @@ var PASSED = [
   "contentDisposition",
   "contentEncoding"
 ];
-function passed(options) {
+function passed(key, options) {
   const forwarded = {};
-  for (const key of PASSED) {
-    if (options[key] !== undefined)
-      forwarded[key] = options[key];
+  for (const name of PASSED) {
+    const value = options[name];
+    if (value === undefined)
+      continue;
+    checkOption(key, name, value);
+    forwarded[name] = value;
   }
   return forwarded;
 }
@@ -207,5 +263,5 @@ export {
   defineBucket
 };
 
-//# debugId=F9842873CB32A8B764756E2164756E21
+//# debugId=B73383C85513ABE564756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,18 +1,18 @@
 {
   "version": 3,
-  "sources": ["../src/bucket/bind-bucket.ts", "../src/bucket/context.ts", "../src/bucket/operations/list.ts", "../src/bucket/operations/presign.ts", "../src/bucket/operations/reads.ts", "../src/errors/s3-error.ts", "../src/bucket/guards.ts", "../src/bucket/operations/writes.ts", "../src/bucket/define-bucket.ts"],
+  "sources": ["../src/bucket/bind-bucket.ts", "../src/bucket/context.ts", "../src/bucket/operations/list.ts", "../src/errors/s3-error.ts", "../src/bucket/guards.ts", "../src/bucket/operations/presign.ts", "../src/bucket/operations/reads.ts", "../src/bucket/operations/writes.ts", "../src/bucket/define-bucket.ts"],
   "sourcesContent": [
     "import { S3Client, type S3File, type S3Options, type S3Stats } from 'bun';\nimport { bucketContext, keyOf } from './context';\nimport { listObjects } from './operations/list';\nimport {\n\ttype PresignOptions,\n\tpresignGetUrl,\n\tpresignPutUrl,\n} from './operations/presign';\nimport {\n\tobjectExists,\n\treadBytes,\n\treadText,\n\tstatObject,\n} from './operations/reads';\nimport { deleteObject, putObject } from './operations/writes';\nimport type {\n\tBucketDefinition,\n\tObjectPage,\n\tPutBody,\n\tPutOptions,\n} from './types';\n\nexport type { PresignOptions };\n\n/** A bucket bound to credentials: the definition, with somewhere to put it. */\nexport interface BoundBucket<P> {\n\t/** The client this holds, for anything this package does not wrap. */\n\treadonly client: S3Client;\n\t/** The key this would use, for a caller that needs the string itself. */\n\tkeyFor(params: P): string;\n\t/** Bun's own lazy handle: `.stream()`, `.slice()`, `.writer()` and the rest. */\n\tfile(params: P): S3File;\n\t/**\n\t * Writes it, once the bucket's content type and size have accepted it.\n\t *\n\t * Beyond `type`, an option here describes **this object** — how it is\n\t * served back (`contentDisposition`, `contentEncoding`), who may read it\n\t * (`acl`), what it costs to keep (`storageClass`) — or how a large body is\n\t * uploaded (`partSize`, `queueSize`, `retry`).\n\t */\n\tput(params: P, body: PutBody, options?: PutOptions): Promise<void>;\n\t/** The bytes, or `undefined` when there is no such object. */\n\tbytes(params: P): Promise<Uint8Array | undefined>;\n\t/** The body as text, or `undefined` when there is no such object. */\n\ttext(params: P): Promise<string | undefined>;\n\texists(params: P): Promise<boolean>;\n\t/** What the service knows about it, or `undefined` when it is not there. */\n\tstat(params: P): Promise<S3Stats | undefined>;\n\t/** Removes it. S3 does not say whether anything was there, and nor does this. */\n\tdelete(params: P): Promise<void>;\n\t/** One page of the bucket, in this repository's cursor shape. */\n\tlist(options?: {\n\t\tprefix?: string;\n\t\tlimit?: number;\n\t\tcursor?: string | null;\n\t}): Promise<ObjectPage>;\n\t/** A URL that reads this object, signed. */\n\tpresignGet(params: P, options?: PresignOptions): string;\n\t/**\n\t * A URL that writes this object, signed. It constrains the key and the\n\t * deadline, and **nothing else** — not the size, not the content type.\n\t */\n\tpresignPut(params: P, options?: PresignOptions): string;\n}\n\n/**\n * Binds a bucket definition to credentials.\n *\n * ```ts\n * const store = bindBucket(avatars, {\n * \tendpoint: process.env.S3_ENDPOINT,\n * \taccessKeyId: process.env.S3_KEY,\n * \tsecretAccessKey: process.env.S3_SECRET,\n * });\n * await store.put({ userId: 'u1' }, png, { type: 'image/png' });\n * ```\n *\n * Given no options, Bun reads its own `S3_*` / `AWS_*` environment variables.\n *\n * Each bound bucket holds an `S3Client` of its own. S3 is stateless HTTP —\n * there is no connection to share, and nothing to close.\n */\nexport function bindBucket<P>(\n\tdefinition: BucketDefinition<P>,\n\toptions: Omit<S3Options, 'bucket'> = {},\n): BoundBucket<P> {\n\tconst client = new S3Client({ ...options, bucket: definition.bucket });\n\tconst context = bucketContext(client, definition);\n\treturn {\n\t\tclient,\n\t\tkeyFor: (params) => keyOf(context, params),\n\t\tfile: (params) => client.file(keyOf(context, params)),\n\t\tput: (params, body, putOptions) =>\n\t\t\tputObject(context, params, body, putOptions),\n\t\tbytes: (params) => readBytes(context, params),\n\t\ttext: (params) => readText(context, params),\n\t\texists: (params) => objectExists(context, params),\n\t\tstat: (params) => statObject(context, params),\n\t\tdelete: (params) => deleteObject(context, params),\n\t\tlist: (listOptions) => listObjects(context, listOptions),\n\t\tpresignGet: (params, presignOptions) =>\n\t\t\tpresignGetUrl(context, params, presignOptions),\n\t\tpresignPut: (params, presignOptions) =>\n\t\t\tpresignPutUrl(context, params, presignOptions),\n\t};\n}\n",
     "import type { S3Client } from 'bun';\nimport type { BucketDefinition } from './types';\n\n/**\n * What every operation of a bound bucket works from, resolved once: the\n * client, the definition, and the accepted content types as a list.\n *\n * It holds **data only**. The operations are plain functions that take it as\n * their first argument, in `guards.ts` and `operations/` — a context of\n * closures would only be the factory this package split up, one size down.\n */\nexport interface BucketContext<P> {\n\treadonly client: S3Client;\n\treadonly definition: BucketDefinition<P>;\n\t/**\n\t * The types the definition accepts, always as a list, **as written** —\n\t * an error message quotes these, and the comparison normalises them.\n\t * `undefined` when the bucket accepts anything.\n\t */\n\treadonly accepted: readonly string[] | undefined;\n}\n\n/** The types a definition accepts, as a list. */\nfunction acceptedTypes(\n\tcontentType: string | readonly string[] | undefined,\n): readonly string[] | undefined {\n\tif (contentType === undefined) return undefined;\n\treturn typeof contentType === 'string' ? [contentType] : contentType;\n}\n\nexport function bucketContext<P>(\n\tclient: S3Client,\n\tdefinition: BucketDefinition<P>,\n): BucketContext<P> {\n\treturn {\n\t\tclient,\n\t\tdefinition,\n\t\taccepted: acceptedTypes(definition.contentType),\n\t};\n}\n\n/** The key this definition builds for these parameters. */\nexport function keyOf<P>(context: BucketContext<P>, params: P): string {\n\treturn context.definition.key(params);\n}\n",
     "import type { S3ListObjectsResponse } from 'bun';\nimport type { BucketContext } from '../context';\nimport type { ObjectPage, StoredObject } from '../types';\n\n/** One page of the bucket, in this repository's cursor shape. */\nexport async function listObjects<P>(\n\tcontext: BucketContext<P>,\n\toptions: { prefix?: string; limit?: number; cursor?: string | null } = {},\n): Promise<ObjectPage> {\n\tconst answer = await context.client.list({\n\t\tprefix: options.prefix,\n\t\tmaxKeys: options.limit,\n\t\tcontinuationToken: options.cursor ?? undefined,\n\t});\n\tconst contents: NonNullable<S3ListObjectsResponse['contents']> =\n\t\tanswer.contents ?? [];\n\tconst items: StoredObject[] = contents.map((found) => ({\n\t\tkey: found.key,\n\t\tsize: found.size,\n\t\tlastModified: found.lastModified ? new Date(found.lastModified) : undefined,\n\t\teTag: found.eTag,\n\t}));\n\t// `isTruncated` is what says there is more, and it is the only thing that\n\t// does: a service that sends a token on the last page anyway would page\n\t// for ever if the token alone decided. `null` is this repository's\n\t// \"no next page\".\n\tconst next = answer.isTruncated\n\t\t? (answer.nextContinuationToken ?? null)\n\t\t: null;\n\treturn { items, nextCursor: next };\n}\n",
-    "import type { S3Options } from 'bun';\nimport { type BucketContext, keyOf } from '../context';\n\n/** How a presigned URL is asked for. `expiresIn` is **seconds**, as S3's is. */\nexport interface PresignOptions {\n\t/** Seconds until it expires. Bun's default is a day; give one. */\n\texpiresIn?: number;\n\t/** `public-read` and the rest, when the service honours it. */\n\tacl?: S3Options['acl'];\n}\n\n/**\n * The options this package signs with, and only those.\n *\n * The same rule as a write's, for the same measured reason: Bun's second\n * parameter extends `S3Options`, so a value carrying extra keys at run time —\n * an options bag off a request body, anything that is not a fresh object\n * literal — **redirects the signed URL**. Measured: a `bucket` key signs a\n * URL for another bucket, and a credential key signs it against another\n * endpoint entirely. The types refuse both; a value that never met the types\n * does not.\n */\nconst SIGNED = ['expiresIn', 'acl'] as const satisfies readonly Signable[];\n\ntype Signable = keyof PresignOptions;\ntype Unsigned = Exclude<Signable, (typeof SIGNED)[number]>;\nconst _nothingForgotten: [Unsigned] extends [never] ? true : Unsigned = true;\nvoid _nothingForgotten;\n\nfunction signed(options: PresignOptions | undefined): PresignOptions {\n\tconst forwarded: Record<string, unknown> = {};\n\tfor (const key of SIGNED) {\n\t\tif (options?.[key] !== undefined) forwarded[key] = options[key];\n\t}\n\treturn forwarded as PresignOptions;\n}\n\nexport function presignGetUrl<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\toptions?: PresignOptions,\n): string {\n\treturn context.client.presign(keyOf(context, params), {\n\t\t...signed(options),\n\t\tmethod: 'GET',\n\t});\n}\n\n/**\n * A URL that writes this object, signed.\n *\n * It carries **no content type**, and takes none. Measured on bun 1.4.2:\n * `presign`'s `type` only adds `response-content-type`, S3's override for\n * what a *download* is labelled; `X-Amz-SignedHeaders` stays `host`, so the\n * `Content-Type` the uploader sends is not signed and not constrained. A PUT\n * signed for a `text/csv` bucket stores an `application/zip` body happily —\n * measured against this package's own test service, status 200. Naming a type\n * here would only look like a guarantee.\n */\nexport function presignPutUrl<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\toptions?: PresignOptions,\n): string {\n\treturn context.client.presign(keyOf(context, params), {\n\t\t...signed(options),\n\t\tmethod: 'PUT',\n\t});\n}\n",
+    "/** What went wrong. Each one is documented in the README's Traps. */\nexport type S3ErrorCode =\n\t/** The body's content type is not one this bucket accepts. */\n\t| 'WRONG_TYPE'\n\t/** The body is bigger than this bucket's `maxSize`. */\n\t| 'TOO_LARGE'\n\t/** The body's size cannot be known before sending, and `maxSize` is set. */\n\t| 'UNMEASURABLE'\n\t/**\n\t * An option's own value is not one the service accepts: `acl` or\n\t * `storageClass` on a write, `acl` or `expiresIn` on a presigned URL.\n\t */\n\t| 'WRONG_OPTION';\n\n/**\n * This package's only error, and every one of them is thrown **before**\n * anything is sent. S3's own failures come back as they are, from Bun's\n * client.\n */\nexport class S3Error extends Error {\n\treadonly code: S3ErrorCode;\n\t/** The object key it was about — the bucket and the key, never the body. */\n\treadonly key: string;\n\n\tconstructor(code: S3ErrorCode, key: string, message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'S3Error';\n\t\tthis.code = code;\n\t\tthis.key = key;\n\t}\n}\n",
+    "import { S3Error } from '../errors/s3-error';\nimport type { BucketContext } from './context';\nimport type { PresignOptions } from './operations/presign';\nimport type { PutBody, PutOptions } from './types';\n\n/**\n * A content type without its parameters, lower-cased: `text/plain` from\n * `text/plain;charset=utf-8`.\n *\n * Both sides of the comparison go through this, because the type a body\n * carries is rarely the bare one a definition names — `Bun.file('a.json')`\n * reports `application/json;charset=utf-8` (measured on bun 1.4.2), and an\n * explicit `IMAGE/PNG` is the same type as `image/png`.\n */\nexport function essenceOf(type: string): string {\n\treturn (type.split(';')[0] ?? '').trim().toLowerCase();\n}\n\n/**\n * The type a write would carry: the one the caller named, or the one the\n * body knows about itself. One function, so the type `check` approves and\n * the type `put` sends can never be two different answers.\n */\nexport function effectiveType(\n\tbody: PutBody,\n\tnamed: string | undefined,\n): string | undefined {\n\t// A Blob carries its own type; anything else has to be told.\n\treturn named ?? (body instanceof Blob ? body.type || undefined : undefined);\n}\n\n/** The body's size, or `undefined` when it cannot be known before sending. */\nexport function sizeOf(body: PutBody): number | undefined {\n\tif (typeof body === 'string') return Buffer.byteLength(body, 'utf8');\n\t// An `S3File` **is** a `Blob` — measured on bun 1.4.2 — and its `size` is\n\t// `NaN`, because nothing has asked the service yet. Returning that would\n\t// pass the guard silently: `NaN > maxSize` is false, whatever `maxSize` is.\n\tif (body instanceof Blob) {\n\t\treturn Number.isFinite(body.size) ? body.size : undefined;\n\t}\n\tif (body instanceof ArrayBuffer) return body.byteLength;\n\tif (ArrayBuffer.isView(body)) return body.byteLength;\n\t// A stream, a `Response`: nothing says how long it is until it has been\n\t// read, which is what `UNMEASURABLE` is about.\n\treturn undefined;\n}\n\n/** Refuses a type the bucket does not accept. Shared by `put` and `presign`. */\nexport function checkType<P>(\n\tcontext: BucketContext<P>,\n\tkey: string,\n\ttype: string | undefined,\n): void {\n\tconst { accepted } = context;\n\tif (!accepted) return;\n\tconst list = accepted.join(', ');\n\tif (!type) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_TYPE',\n\t\t\tkey,\n\t\t\t`\"${context.definition.bucket}\" accepts ${list}, and this write ` +\n\t\t\t\t'names no content type. Pass `type`',\n\t\t);\n\t}\n\tif (!accepted.some((one) => essenceOf(one) === essenceOf(type))) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_TYPE',\n\t\t\tkey,\n\t\t\t`\"${context.definition.bucket}\" accepts ${list}, not ${type}`,\n\t\t);\n\t}\n}\n\n/** Refuses a body the bucket does not accept, before anything is sent. */\nexport function checkSize<P>(\n\tcontext: BucketContext<P>,\n\tkey: string,\n\tbody: PutBody,\n): void {\n\tconst { maxSize, bucket } = context.definition;\n\tif (maxSize === undefined) return;\n\tconst size = sizeOf(body);\n\tif (size === undefined) {\n\t\tthrow new S3Error(\n\t\t\t'UNMEASURABLE',\n\t\t\tkey,\n\t\t\t`\"${bucket}\" has a maxSize, and this body's size cannot be known ` +\n\t\t\t\t'before sending it. Read it into memory first, or drop `maxSize` ' +\n\t\t\t\t'and let the service refuse it',\n\t\t);\n\t}\n\tif (size > maxSize) {\n\t\tthrow new S3Error(\n\t\t\t'TOO_LARGE',\n\t\t\tkey,\n\t\t\t`\"${bucket}\" accepts ${maxSize} bytes at most, and this body is ${size}`,\n\t\t);\n\t}\n}\n\n/**\n * The values the service accepts for the two options that have a fixed set,\n * listed so this package refuses a wrong one itself.\n *\n * Bun checks them too, and refuses with a plain `TypeError` — measured on\n * bun 1.4.2, `name` is `\"TypeError\"`. Every other refusal of the same call\n * is an `S3Error` with a code, so a caller had to catch two classes for one\n * `put`, and read message text for one of them. Checking here gives every\n * refusal of a write one class and one code.\n *\n * The exhaustiveness lines below are the ones `PASSED` carries in `writes.ts`,\n * for the values rather than the keys: a value Bun adds or drops fails the\n * build here instead of silently widening or narrowing what this package\n * accepts.\n */\nconst ACLS = [\n\t'private',\n\t'public-read',\n\t'public-read-write',\n\t'aws-exec-read',\n\t'authenticated-read',\n\t'bucket-owner-read',\n\t'bucket-owner-full-control',\n\t'log-delivery-write',\n] as const satisfies readonly NonNullable<PutOptions['acl']>[];\n\nconst STORAGE_CLASSES = [\n\t'STANDARD',\n\t'DEEP_ARCHIVE',\n\t'EXPRESS_ONEZONE',\n\t'GLACIER',\n\t'GLACIER_IR',\n\t'INTELLIGENT_TIERING',\n\t'ONEZONE_IA',\n\t'OUTPOSTS',\n\t'REDUCED_REDUNDANCY',\n\t'SNOW',\n\t'STANDARD_IA',\n] as const satisfies readonly NonNullable<PutOptions['storageClass']>[];\n\ntype UnlistedAcl = Exclude<\n\tNonNullable<PutOptions['acl']>,\n\t(typeof ACLS)[number]\n>;\nconst _everyAclListed: [UnlistedAcl] extends [never] ? true : UnlistedAcl =\n\ttrue;\nvoid _everyAclListed;\n\ntype UnlistedClass = Exclude<\n\tNonNullable<PutOptions['storageClass']>,\n\t(typeof STORAGE_CLASSES)[number]\n>;\nconst _everyClassListed: [UnlistedClass] extends [never]\n\t? true\n\t: UnlistedClass = true;\nvoid _everyClassListed;\n\nconst ALLOWED = {\n\tacl: ACLS,\n\tstorageClass: STORAGE_CLASSES,\n} as const satisfies Partial<\n\tRecord<keyof PutOptions | keyof PresignOptions, readonly string[]>\n>;\n\n/**\n * The longest a presigned URL can live: SigV4's own limit, seven days.\n *\n * Measured on bun 1.4.2: the client refuses `0` and below with a `TypeError`\n * of its own, and **signs** an `expiresIn` of `1e12` happily — a URL the\n * service then rejects at use time, which is the one thing this package\n * exists not to do.\n */\nconst MAX_EXPIRES_IN = 604_800;\n\n/**\n * Refuses a value the service does not accept for `acl` or `storageClass`.\n * Shared by `put` and `presign`, so the same wrong `acl` is the same error\n * whichever one a caller reached for. An option with no fixed set passes.\n */\nexport function checkOption(key: string, name: string, value: unknown): void {\n\tif (value === undefined) return;\n\tif (name === 'expiresIn') {\n\t\tcheckExpiresIn(key, value);\n\t\treturn;\n\t}\n\tconst allowed = (ALLOWED as Record<string, readonly string[] | undefined>)[\n\t\tname\n\t];\n\tif (!allowed) return;\n\tif (!allowed.includes(value as string)) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_OPTION',\n\t\t\tkey,\n\t\t\t`${name} must be one of ${allowed.join(', ')}; got ${JSON.stringify(value)}`,\n\t\t);\n\t}\n}\n\nfunction checkExpiresIn(key: string, value: unknown): void {\n\tif (\n\t\ttypeof value !== 'number' ||\n\t\t!Number.isFinite(value) ||\n\t\tvalue <= 0 ||\n\t\tvalue > MAX_EXPIRES_IN\n\t) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_OPTION',\n\t\t\tkey,\n\t\t\t`expiresIn is seconds, and must be above 0 and at most ` +\n\t\t\t\t`${MAX_EXPIRES_IN} (seven days, which is S3's own limit); ` +\n\t\t\t\t`got ${JSON.stringify(value)}`,\n\t\t);\n\t}\n}\n",
+    "import type { S3Options } from 'bun';\nimport { type BucketContext, keyOf } from '../context';\nimport { checkOption } from '../guards';\n\n/** How a presigned URL is asked for. `expiresIn` is **seconds**, as S3's is. */\nexport interface PresignOptions {\n\t/** Seconds until it expires. Bun's default is a day; give one. */\n\texpiresIn?: number;\n\t/** `public-read` and the rest, when the service honours it. */\n\tacl?: S3Options['acl'];\n}\n\n/**\n * The options this package signs with, and only those.\n *\n * The same rule as a write's, for the same measured reason: Bun's second\n * parameter extends `S3Options`, so a value carrying extra keys at run time —\n * an options bag off a request body, anything that is not a fresh object\n * literal — **redirects the signed URL**. Measured: a `bucket` key signs a\n * URL for another bucket, and a credential key signs it against another\n * endpoint entirely. The types refuse both; a value that never met the types\n * does not.\n */\nconst SIGNED = ['expiresIn', 'acl'] as const satisfies readonly Signable[];\n\ntype Signable = keyof PresignOptions;\ntype Unsigned = Exclude<Signable, (typeof SIGNED)[number]>;\nconst _nothingForgotten: [Unsigned] extends [never] ? true : Unsigned = true;\nvoid _nothingForgotten;\n\nfunction signed(\n\tkey: string,\n\toptions: PresignOptions | undefined,\n): PresignOptions {\n\tconst forwarded: Record<string, unknown> = {};\n\tfor (const name of SIGNED) {\n\t\tconst value = options?.[name];\n\t\tif (value === undefined) continue;\n\t\t// The same allowlist a `put` is held to: a wrong `acl` is an `S3Error`\n\t\t// with `WRONG_OPTION` whichever of the two a caller reached for, rather\n\t\t// than an `S3Error` here and Bun's own `TypeError` there.\n\t\tcheckOption(key, name, value);\n\t\tforwarded[name] = value;\n\t}\n\treturn forwarded as PresignOptions;\n}\n\nexport function presignGetUrl<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\toptions?: PresignOptions,\n): string {\n\tconst key = keyOf(context, params);\n\treturn context.client.presign(key, {\n\t\t...signed(key, options),\n\t\tmethod: 'GET',\n\t});\n}\n\n/**\n * A URL that writes this object, signed.\n *\n * It carries **no content type**, and takes none. Measured on bun 1.4.2:\n * `presign`'s `type` only adds `response-content-type`, S3's override for\n * what a *download* is labelled; `X-Amz-SignedHeaders` stays `host`, so the\n * `Content-Type` the uploader sends is not signed and not constrained. A PUT\n * signed for a `text/csv` bucket stores an `application/zip` body happily —\n * measured against this package's own test service, status 200. Naming a type\n * here would only look like a guarantee.\n */\nexport function presignPutUrl<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\toptions?: PresignOptions,\n): string {\n\tconst key = keyOf(context, params);\n\treturn context.client.presign(key, {\n\t\t...signed(key, options),\n\t\tmethod: 'PUT',\n\t});\n}\n",
     "import type { S3File, S3Stats } from 'bun';\nimport { type BucketContext, keyOf } from '../context';\n\n/**\n * `undefined` rather than a throw when the object is simply not there.\n *\n * It reads straight away and catches the service's own `NoSuchKey`, rather\n * than asking `exists` first: one round trip instead of two, and no window in\n * which an object deleted between the two turns a promised `undefined` into a\n * throw. `stat` is itself a HEAD, so asking first bought nothing at all.\n */\nasync function whenPresent<P, T>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\tread: (file: S3File) => Promise<T>,\n): Promise<T | undefined> {\n\ttry {\n\t\treturn await read(context.client.file(keyOf(context, params)));\n\t} catch (reason) {\n\t\t// Bun names its own S3 failures `S3Error` too, and carries S3's code.\n\t\tif ((reason as { code?: unknown }).code === 'NoSuchKey') return undefined;\n\t\tthrow reason;\n\t}\n}\n\nexport function readBytes<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<Uint8Array | undefined> {\n\treturn whenPresent(context, params, (file) => file.bytes());\n}\n\nexport function readText<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<string | undefined> {\n\treturn whenPresent(context, params, (file) => file.text());\n}\n\nexport function statObject<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<S3Stats | undefined> {\n\treturn whenPresent(context, params, (file) => file.stat());\n}\n\nexport function objectExists<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<boolean> {\n\treturn context.client.exists(keyOf(context, params));\n}\n",
-    "/** What went wrong. Each one is documented in the README's Traps. */\nexport type S3ErrorCode =\n\t/** The body's content type is not one this bucket accepts. */\n\t| 'WRONG_TYPE'\n\t/** The body is bigger than this bucket's `maxSize`. */\n\t| 'TOO_LARGE'\n\t/** The body's size cannot be known before sending, and `maxSize` is set. */\n\t| 'UNMEASURABLE';\n\n/**\n * This package's only error, and every one of them is thrown **before**\n * anything is sent. S3's own failures come back as they are, from Bun's\n * client.\n */\nexport class S3Error extends Error {\n\treadonly code: S3ErrorCode;\n\t/** The object key it was about — the bucket and the key, never the body. */\n\treadonly key: string;\n\n\tconstructor(code: S3ErrorCode, key: string, message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'S3Error';\n\t\tthis.code = code;\n\t\tthis.key = key;\n\t}\n}\n",
-    "import { S3Error } from '../errors/s3-error';\nimport type { BucketContext } from './context';\nimport type { PutBody } from './types';\n\n/**\n * A content type without its parameters, lower-cased: `text/plain` from\n * `text/plain;charset=utf-8`.\n *\n * Both sides of the comparison go through this, because the type a body\n * carries is rarely the bare one a definition names — `Bun.file('a.json')`\n * reports `application/json;charset=utf-8` (measured on bun 1.4.2), and an\n * explicit `IMAGE/PNG` is the same type as `image/png`.\n */\nexport function essenceOf(type: string): string {\n\treturn (type.split(';')[0] ?? '').trim().toLowerCase();\n}\n\n/**\n * The type a write would carry: the one the caller named, or the one the\n * body knows about itself. One function, so the type `check` approves and\n * the type `put` sends can never be two different answers.\n */\nexport function effectiveType(\n\tbody: PutBody,\n\tnamed: string | undefined,\n): string | undefined {\n\t// A Blob carries its own type; anything else has to be told.\n\treturn named ?? (body instanceof Blob ? body.type || undefined : undefined);\n}\n\n/** The body's size, or `undefined` when it cannot be known before sending. */\nexport function sizeOf(body: PutBody): number | undefined {\n\tif (typeof body === 'string') return Buffer.byteLength(body, 'utf8');\n\t// An `S3File` **is** a `Blob` — measured on bun 1.4.2 — and its `size` is\n\t// `NaN`, because nothing has asked the service yet. Returning that would\n\t// pass the guard silently: `NaN > maxSize` is false, whatever `maxSize` is.\n\tif (body instanceof Blob) {\n\t\treturn Number.isFinite(body.size) ? body.size : undefined;\n\t}\n\tif (body instanceof ArrayBuffer) return body.byteLength;\n\tif (ArrayBuffer.isView(body)) return body.byteLength;\n\t// A stream, a `Response`: nothing says how long it is until it has been\n\t// read, which is what `UNMEASURABLE` is about.\n\treturn undefined;\n}\n\n/** Refuses a type the bucket does not accept. Shared by `put` and `presign`. */\nexport function checkType<P>(\n\tcontext: BucketContext<P>,\n\tkey: string,\n\ttype: string | undefined,\n): void {\n\tconst { accepted } = context;\n\tif (!accepted) return;\n\tconst list = accepted.join(', ');\n\tif (!type) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_TYPE',\n\t\t\tkey,\n\t\t\t`\"${context.definition.bucket}\" accepts ${list}, and this write ` +\n\t\t\t\t'names no content type. Pass `type`',\n\t\t);\n\t}\n\tif (!accepted.some((one) => essenceOf(one) === essenceOf(type))) {\n\t\tthrow new S3Error(\n\t\t\t'WRONG_TYPE',\n\t\t\tkey,\n\t\t\t`\"${context.definition.bucket}\" accepts ${list}, not ${type}`,\n\t\t);\n\t}\n}\n\n/** Refuses a body the bucket does not accept, before anything is sent. */\nexport function checkSize<P>(\n\tcontext: BucketContext<P>,\n\tkey: string,\n\tbody: PutBody,\n): void {\n\tconst { maxSize, bucket } = context.definition;\n\tif (maxSize === undefined) return;\n\tconst size = sizeOf(body);\n\tif (size === undefined) {\n\t\tthrow new S3Error(\n\t\t\t'UNMEASURABLE',\n\t\t\tkey,\n\t\t\t`\"${bucket}\" has a maxSize, and this body's size cannot be known ` +\n\t\t\t\t'before sending it. Read it into memory first, or drop `maxSize` ' +\n\t\t\t\t'and let the service refuse it',\n\t\t);\n\t}\n\tif (size > maxSize) {\n\t\tthrow new S3Error(\n\t\t\t'TOO_LARGE',\n\t\t\tkey,\n\t\t\t`\"${bucket}\" accepts ${maxSize} bytes at most, and this body is ${size}`,\n\t\t);\n\t}\n}\n",
-    "import { type BucketContext, keyOf } from '../context';\nimport { checkSize, checkType, effectiveType } from '../guards';\nimport type { PutBody, PutOptions } from '../types';\n\n/**\n * Writes it, once the bucket's content type and size have accepted it. Both\n * guards run before `write` is called, so a refused body is never sent.\n */\nexport async function putObject<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\tbody: PutBody,\n\toptions: PutOptions = {},\n): Promise<void> {\n\tconst key = keyOf(context, params);\n\tconst type = effectiveType(body, options.type);\n\tcheckType(context, key, type);\n\tcheckSize(context, key, body);\n\t// The very type `checkType` approved, and nothing else: `type` is not one\n\t// of the keys `passed` forwards, so no option can carry a second one in\n\t// beside it.\n\tawait context.client.write(key, body, {\n\t\t...passed(options),\n\t\t...(type ? { type } : {}),\n\t});\n}\n\n/**\n * The options this package forwards, and only those.\n *\n * `PutOptions` refuses the rest at compile time, and that is not enough:\n * measured, spreading the caller's object straight through let a `bucket`\n * key **redirect the write to another bucket** — the object was stored\n * somewhere the definition never described, and the call reported success.\n * Options that arrive from outside a handler are not typed, so the list is\n * applied at run time as well. A key that is not here is dropped, never sent.\n */\ntype Forwardable = Exclude<keyof PutOptions, 'type'>;\n\nconst PASSED = [\n\t'acl',\n\t'storageClass',\n\t'contentDisposition',\n\t'contentEncoding',\n] as const satisfies readonly Forwardable[];\n\n/**\n * `satisfies` proves every key listed is real; it proves nothing about one\n * that is **missing**. Widen `PutOptions` and forget to list the new key\n * here, and the type would advertise an option the run time silently drops —\n * which is the failure this allowlist exists to prevent, in the other\n * direction. This line is what fails the build instead.\n */\ntype Unforwarded = Exclude<Forwardable, (typeof PASSED)[number]>;\nconst _nothingForgotten: [Unforwarded] extends [never] ? true : Unforwarded =\n\ttrue;\nvoid _nothingForgotten;\n\nfunction passed(options: PutOptions): PutOptions {\n\tconst forwarded: Record<string, unknown> = {};\n\tfor (const key of PASSED) {\n\t\tif (options[key] !== undefined) forwarded[key] = options[key];\n\t}\n\treturn forwarded as PutOptions;\n}\n\n/** Removes it. S3 does not say whether anything was there, and nor does this. */\nexport function deleteObject<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<void> {\n\treturn context.client.delete(keyOf(context, params));\n}\n",
+    "import { type BucketContext, keyOf } from '../context';\nimport { checkOption, checkSize, checkType, effectiveType } from '../guards';\nimport type { PutBody, PutOptions } from '../types';\n\n/**\n * Writes it, once the bucket's content type and size have accepted it. Both\n * guards run before `write` is called, so a refused body is never sent.\n */\nexport async function putObject<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n\tbody: PutBody,\n\toptions: PutOptions = {},\n): Promise<void> {\n\tconst key = keyOf(context, params);\n\tconst type = effectiveType(body, options.type);\n\tcheckType(context, key, type);\n\tcheckSize(context, key, body);\n\t// Refused here with the other two, so every guard on this call answers\n\t// before anything is sent, and every one of them is an `S3Error`.\n\tconst forwarded = passed(key, options);\n\t// The very type `checkType` approved, and nothing else: `type` is not one\n\t// of the keys `passed` forwards, so no option can carry a second one in\n\t// beside it.\n\tawait context.client.write(key, body, {\n\t\t...forwarded,\n\t\t...(type ? { type } : {}),\n\t});\n}\n\n/**\n * The options this package forwards, and only those.\n *\n * `PutOptions` refuses the rest at compile time, and that is not enough:\n * measured, spreading the caller's object straight through let a `bucket`\n * key **redirect the write to another bucket** — the object was stored\n * somewhere the definition never described, and the call reported success.\n * Options that arrive from outside a handler are not typed, so the list is\n * applied at run time as well. A key that is not here is dropped, never sent.\n */\ntype Forwardable = Exclude<keyof PutOptions, 'type'>;\n\nconst PASSED = [\n\t'acl',\n\t'storageClass',\n\t'contentDisposition',\n\t'contentEncoding',\n] as const satisfies readonly Forwardable[];\n\n/**\n * `satisfies` proves every key listed is real; it proves nothing about one\n * that is **missing**. Widen `PutOptions` and forget to list the new key\n * here, and the type would advertise an option the run time silently drops —\n * which is the failure this allowlist exists to prevent, in the other\n * direction. This line is what fails the build instead.\n */\ntype Unforwarded = Exclude<Forwardable, (typeof PASSED)[number]>;\nconst _nothingForgotten: [Unforwarded] extends [never] ? true : Unforwarded =\n\ttrue;\nvoid _nothingForgotten;\n\nfunction passed(key: string, options: PutOptions): PutOptions {\n\tconst forwarded: Record<string, unknown> = {};\n\tfor (const name of PASSED) {\n\t\tconst value = options[name];\n\t\tif (value === undefined) continue;\n\t\tcheckOption(key, name, value);\n\t\tforwarded[name] = value;\n\t}\n\treturn forwarded as PutOptions;\n}\n\n/** Removes it. S3 does not say whether anything was there, and nor does this. */\nexport function deleteObject<P>(\n\tcontext: BucketContext<P>,\n\tparams: P,\n): Promise<void> {\n\treturn context.client.delete(keyOf(context, params));\n}\n",
     "import type { BucketDefinition } from './types';\n\n/**\n * Describes a bucket. It talks to nothing: `bindBucket` is what needs\n * credentials.\n *\n * ```ts\n * export const avatars = defineBucket({\n * \tbucket: 'avatars',\n * \tkey: (p: { userId: string }) => `${p.userId}.png`,\n * \tcontentType: ['image/png', 'image/jpeg'],\n * \tmaxSize: 2 * 1024 * 1024,\n * });\n * ```\n */\nexport function defineBucket<P>(\n\tdefinition: BucketDefinition<P>,\n): BucketDefinition<P> {\n\tif (definition.bucket.length === 0) {\n\t\tthrow new TypeError('defineBucket: a bucket definition needs a bucket');\n\t}\n\tif (definition.maxSize !== undefined) {\n\t\tconst { maxSize } = definition;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`defineBucket: \"${definition.bucket}\" has a maxSize of ${maxSize}; ` +\n\t\t\t\t\t'it is a number of bytes, and must be above zero',\n\t\t\t);\n\t\t}\n\t}\n\tconst types = definition.contentType;\n\tif (Array.isArray(types) && types.length === 0) {\n\t\tthrow new TypeError(\n\t\t\t`defineBucket: \"${definition.bucket}\" accepts an empty list of ` +\n\t\t\t\t'content types, so nothing could ever be written. Leave ' +\n\t\t\t\t'`contentType` out to accept anything',\n\t\t);\n\t}\n\treturn Object.freeze({ ...definition });\n}\n"
   ],
-  "mappings": ";AAAA;;;ACuBA,SAAS,aAAa,CACrB,aACgC;AAAA,EAChC,IAAI,gBAAgB;AAAA,IAAW;AAAA,EAC/B,OAAO,OAAO,gBAAgB,WAAW,CAAC,WAAW,IAAI;AAAA;AAGnD,SAAS,aAAgB,CAC/B,QACA,YACmB;AAAA,EACnB,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,UAAU,cAAc,WAAW,WAAW;AAAA,EAC/C;AAAA;AAIM,SAAS,KAAQ,CAAC,SAA2B,QAAmB;AAAA,EACtE,OAAO,QAAQ,WAAW,IAAI,MAAM;AAAA;;;ACtCrC,eAAsB,WAAc,CACnC,SACA,UAAuE,CAAC,GAClD;AAAA,EACtB,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK;AAAA,IACxC,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,mBAAmB,QAAQ,UAAU;AAAA,EACtC,CAAC;AAAA,EACD,MAAM,WACL,OAAO,YAAY,CAAC;AAAA,EACrB,MAAM,QAAwB,SAAS,IAAI,CAAC,WAAW;AAAA,IACtD,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM,eAAe,IAAI,KAAK,MAAM,YAAY,IAAI;AAAA,IAClE,MAAM,MAAM;AAAA,EACb,EAAE;AAAA,EAKF,MAAM,OAAO,OAAO,cAChB,OAAO,yBAAyB,OACjC;AAAA,EACH,OAAO,EAAE,OAAO,YAAY,KAAK;AAAA;;;ACPlC,IAAM,SAAS,CAAC,aAAa,KAAK;AAOlC,SAAS,MAAM,CAAC,SAAqD;AAAA,EACpE,MAAM,YAAqC,CAAC;AAAA,EAC5C,WAAW,OAAO,QAAQ;AAAA,IACzB,IAAI,UAAU,SAAS;AAAA,MAAW,UAAU,OAAO,QAAQ;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAgB,CAC/B,SACA,QACA,SACS;AAAA,EACT,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,MAAM,GAAG;AAAA,OAClD,OAAO,OAAO;AAAA,IACjB,QAAQ;AAAA,EACT,CAAC;AAAA;AAcK,SAAS,aAAgB,CAC/B,SACA,QACA,SACS;AAAA,EACT,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,MAAM,GAAG;AAAA,OAClD,OAAO,OAAO;AAAA,IACjB,QAAQ;AAAA,EACT,CAAC;AAAA;;;ACxDF,eAAe,WAAiB,CAC/B,SACA,QACA,MACyB;AAAA,EACzB,IAAI;AAAA,IACH,OAAO,MAAM,KAAK,QAAQ,OAAO,KAAK,MAAM,SAAS,MAAM,CAAC,CAAC;AAAA,IAC5D,OAAO,QAAQ;AAAA,IAEhB,IAAK,OAA8B,SAAS;AAAA,MAAa;AAAA,IACzD,MAAM;AAAA;AAAA;AAID,SAAS,SAAY,CAC3B,SACA,QACkC;AAAA,EAClC,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC;AAAA;AAGpD,SAAS,QAAW,CAC1B,SACA,QAC8B;AAAA,EAC9B,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA;AAGnD,SAAS,UAAa,CAC5B,SACA,QAC+B;AAAA,EAC/B,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA;AAGnD,SAAS,YAAe,CAC9B,SACA,QACmB;AAAA,EACnB,OAAO,QAAQ,OAAO,OAAO,MAAM,SAAS,MAAM,CAAC;AAAA;;;ACpC7C,MAAM,gBAAgB,MAAM;AAAA,EAKlC,WAAW,CAAC,MAAmB,KAAa,SAAiB;AAAA,IAC5D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,OAAO;AAAA,IACZ,KAAK,MAAM;AAAA;AAEb;;;ACZO,SAAS,SAAS,CAAC,MAAsB;AAAA,EAC/C,QAAQ,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,KAAK,EAAE,YAAY;AAAA;AAQ/C,SAAS,aAAa,CAC5B,MACA,OACqB;AAAA,EAErB,OAAO,UAAU,gBAAgB,OAAO,KAAK,QAAQ,YAAY;AAAA;AAI3D,SAAS,MAAM,CAAC,MAAmC;AAAA,EACzD,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,OAAO,WAAW,MAAM,MAAM;AAAA,EAInE,IAAI,gBAAgB,MAAM;AAAA,IACzB,OAAO,OAAO,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO;AAAA,EACjD;AAAA,EACA,IAAI,gBAAgB;AAAA,IAAa,OAAO,KAAK;AAAA,EAC7C,IAAI,YAAY,OAAO,IAAI;AAAA,IAAG,OAAO,KAAK;AAAA,EAG1C;AAAA;AAIM,SAAS,SAAY,CAC3B,SACA,KACA,MACO;AAAA,EACP,QAAQ,aAAa;AAAA,EACrB,IAAI,CAAC;AAAA,IAAU;AAAA,EACf,MAAM,OAAO,SAAS,KAAK,IAAI;AAAA,EAC/B,IAAI,CAAC,MAAM;AAAA,IACV,MAAM,IAAI,QACT,cACA,KACA,IAAI,QAAQ,WAAW,mBAAmB,0BACzC,oCACF;AAAA,EACD;AAAA,EACA,IAAI,CAAC,SAAS,KAAK,CAAC,QAAQ,UAAU,GAAG,MAAM,UAAU,IAAI,CAAC,GAAG;AAAA,IAChE,MAAM,IAAI,QACT,cACA,KACA,IAAI,QAAQ,WAAW,mBAAmB,aAAa,MACxD;AAAA,EACD;AAAA;AAIM,SAAS,SAAY,CAC3B,SACA,KACA,MACO;AAAA,EACP,QAAQ,SAAS,WAAW,QAAQ;AAAA,EACpC,IAAI,YAAY;AAAA,IAAW;AAAA,EAC3B,MAAM,OAAO,OAAO,IAAI;AAAA,EACxB,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,QACT,gBACA,KACA,IAAI,iEACH,qEACA,+BACF;AAAA,EACD;AAAA,EACA,IAAI,OAAO,SAAS;AAAA,IACnB,MAAM,IAAI,QACT,aACA,KACA,IAAI,mBAAmB,2CAA2C,MACnE;AAAA,EACD;AAAA;;;ACxFD,eAAsB,SAAY,CACjC,SACA,QACA,MACA,UAAsB,CAAC,GACP;AAAA,EAChB,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EACjC,MAAM,OAAO,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC7C,UAAU,SAAS,KAAK,IAAI;AAAA,EAC5B,UAAU,SAAS,KAAK,IAAI;AAAA,EAI5B,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;AAAA,OAClC,OAAO,OAAO;AAAA,OACb,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACxB,CAAC;AAAA;AAeF,IAAM,SAAS;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAcA,SAAS,MAAM,CAAC,SAAiC;AAAA,EAChD,MAAM,YAAqC,CAAC;AAAA,EAC5C,WAAW,OAAO,QAAQ;AAAA,IACzB,IAAI,QAAQ,SAAS;AAAA,MAAW,UAAU,OAAO,QAAQ;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAID,SAAS,YAAe,CAC9B,SACA,QACgB;AAAA,EAChB,OAAO,QAAQ,OAAO,OAAO,MAAM,SAAS,MAAM,CAAC;AAAA;;;APW7C,SAAS,UAAa,CAC5B,YACA,UAAqC,CAAC,GACrB;AAAA,EACjB,MAAM,SAAS,IAAI,SAAS,KAAK,SAAS,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrE,MAAM,UAAU,cAAc,QAAQ,UAAU;AAAA,EAChD,OAAO;AAAA,IACN;AAAA,IACA,QAAQ,CAAC,WAAW,MAAM,SAAS,MAAM;AAAA,IACzC,MAAM,CAAC,WAAW,OAAO,KAAK,MAAM,SAAS,MAAM,CAAC;AAAA,IACpD,KAAK,CAAC,QAAQ,MAAM,eACnB,UAAU,SAAS,QAAQ,MAAM,UAAU;AAAA,IAC5C,OAAO,CAAC,WAAW,UAAU,SAAS,MAAM;AAAA,IAC5C,MAAM,CAAC,WAAW,SAAS,SAAS,MAAM;AAAA,IAC1C,QAAQ,CAAC,WAAW,aAAa,SAAS,MAAM;AAAA,IAChD,MAAM,CAAC,WAAW,WAAW,SAAS,MAAM;AAAA,IAC5C,QAAQ,CAAC,WAAW,aAAa,SAAS,MAAM;AAAA,IAChD,MAAM,CAAC,gBAAgB,YAAY,SAAS,WAAW;AAAA,IACvD,YAAY,CAAC,QAAQ,mBACpB,cAAc,SAAS,QAAQ,cAAc;AAAA,IAC9C,YAAY,CAAC,QAAQ,mBACpB,cAAc,SAAS,QAAQ,cAAc;AAAA,EAC/C;AAAA;;AQzFM,SAAS,YAAe,CAC9B,YACsB;AAAA,EACtB,IAAI,WAAW,OAAO,WAAW,GAAG;AAAA,IACnC,MAAM,IAAI,UAAU,kDAAkD;AAAA,EACvE;AAAA,EACA,IAAI,WAAW,YAAY,WAAW;AAAA,IACrC,QAAQ,YAAY;AAAA,IACpB,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG;AAAA,MAC9C,MAAM,IAAI,UACT,kBAAkB,WAAW,4BAA4B,cACxD,iDACF;AAAA,IACD;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,WAAW;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,IAC/C,MAAM,IAAI,UACT,kBAAkB,WAAW,sCAC5B,4DACA,sCACF;AAAA,EACD;AAAA,EACA,OAAO,OAAO,OAAO,KAAK,WAAW,CAAC;AAAA;",
-  "debugId": "F9842873CB32A8B764756E2164756E21",
+  "mappings": ";AAAA;;;ACuBA,SAAS,aAAa,CACrB,aACgC;AAAA,EAChC,IAAI,gBAAgB;AAAA,IAAW;AAAA,EAC/B,OAAO,OAAO,gBAAgB,WAAW,CAAC,WAAW,IAAI;AAAA;AAGnD,SAAS,aAAgB,CAC/B,QACA,YACmB;AAAA,EACnB,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,UAAU,cAAc,WAAW,WAAW;AAAA,EAC/C;AAAA;AAIM,SAAS,KAAQ,CAAC,SAA2B,QAAmB;AAAA,EACtE,OAAO,QAAQ,WAAW,IAAI,MAAM;AAAA;;;ACtCrC,eAAsB,WAAc,CACnC,SACA,UAAuE,CAAC,GAClD;AAAA,EACtB,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK;AAAA,IACxC,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,mBAAmB,QAAQ,UAAU;AAAA,EACtC,CAAC;AAAA,EACD,MAAM,WACL,OAAO,YAAY,CAAC;AAAA,EACrB,MAAM,QAAwB,SAAS,IAAI,CAAC,WAAW;AAAA,IACtD,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM,eAAe,IAAI,KAAK,MAAM,YAAY,IAAI;AAAA,IAClE,MAAM,MAAM;AAAA,EACb,EAAE;AAAA,EAKF,MAAM,OAAO,OAAO,cAChB,OAAO,yBAAyB,OACjC;AAAA,EACH,OAAO,EAAE,OAAO,YAAY,KAAK;AAAA;;;ACV3B,MAAM,gBAAgB,MAAM;AAAA,EAKlC,WAAW,CAAC,MAAmB,KAAa,SAAiB;AAAA,IAC5D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,OAAO;AAAA,IACZ,KAAK,MAAM;AAAA;AAEb;;;AChBO,SAAS,SAAS,CAAC,MAAsB;AAAA,EAC/C,QAAQ,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,KAAK,EAAE,YAAY;AAAA;AAQ/C,SAAS,aAAa,CAC5B,MACA,OACqB;AAAA,EAErB,OAAO,UAAU,gBAAgB,OAAO,KAAK,QAAQ,YAAY;AAAA;AAI3D,SAAS,MAAM,CAAC,MAAmC;AAAA,EACzD,IAAI,OAAO,SAAS;AAAA,IAAU,OAAO,OAAO,WAAW,MAAM,MAAM;AAAA,EAInE,IAAI,gBAAgB,MAAM;AAAA,IACzB,OAAO,OAAO,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO;AAAA,EACjD;AAAA,EACA,IAAI,gBAAgB;AAAA,IAAa,OAAO,KAAK;AAAA,EAC7C,IAAI,YAAY,OAAO,IAAI;AAAA,IAAG,OAAO,KAAK;AAAA,EAG1C;AAAA;AAIM,SAAS,SAAY,CAC3B,SACA,KACA,MACO;AAAA,EACP,QAAQ,aAAa;AAAA,EACrB,IAAI,CAAC;AAAA,IAAU;AAAA,EACf,MAAM,OAAO,SAAS,KAAK,IAAI;AAAA,EAC/B,IAAI,CAAC,MAAM;AAAA,IACV,MAAM,IAAI,QACT,cACA,KACA,IAAI,QAAQ,WAAW,mBAAmB,0BACzC,oCACF;AAAA,EACD;AAAA,EACA,IAAI,CAAC,SAAS,KAAK,CAAC,QAAQ,UAAU,GAAG,MAAM,UAAU,IAAI,CAAC,GAAG;AAAA,IAChE,MAAM,IAAI,QACT,cACA,KACA,IAAI,QAAQ,WAAW,mBAAmB,aAAa,MACxD;AAAA,EACD;AAAA;AAIM,SAAS,SAAY,CAC3B,SACA,KACA,MACO;AAAA,EACP,QAAQ,SAAS,WAAW,QAAQ;AAAA,EACpC,IAAI,YAAY;AAAA,IAAW;AAAA,EAC3B,MAAM,OAAO,OAAO,IAAI;AAAA,EACxB,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,QACT,gBACA,KACA,IAAI,iEACH,qEACA,+BACF;AAAA,EACD;AAAA,EACA,IAAI,OAAO,SAAS;AAAA,IACnB,MAAM,IAAI,QACT,aACA,KACA,IAAI,mBAAmB,2CAA2C,MACnE;AAAA,EACD;AAAA;AAkBD,IAAM,OAAO;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,IAAM,kBAAkB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAmBA,IAAM,UAAU;AAAA,EACf,KAAK;AAAA,EACL,cAAc;AACf;AAYA,IAAM,iBAAiB;AAOhB,SAAS,WAAW,CAAC,KAAa,MAAc,OAAsB;AAAA,EAC5E,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,IAAI,SAAS,aAAa;AAAA,IACzB,eAAe,KAAK,KAAK;AAAA,IACzB;AAAA,EACD;AAAA,EACA,MAAM,UAAW,QAChB;AAAA,EAED,IAAI,CAAC;AAAA,IAAS;AAAA,EACd,IAAI,CAAC,QAAQ,SAAS,KAAe,GAAG;AAAA,IACvC,MAAM,IAAI,QACT,gBACA,KACA,GAAG,uBAAuB,QAAQ,KAAK,IAAI,UAAU,KAAK,UAAU,KAAK,GAC1E;AAAA,EACD;AAAA;AAGD,SAAS,cAAc,CAAC,KAAa,OAAsB;AAAA,EAC1D,IACC,OAAO,UAAU,YACjB,CAAC,OAAO,SAAS,KAAK,KACtB,SAAS,KACT,QAAQ,gBACP;AAAA,IACD,MAAM,IAAI,QACT,gBACA,KACA,2DACC,GAAG,2DACH,OAAO,KAAK,UAAU,KAAK,GAC7B;AAAA,EACD;AAAA;;;AC7LD,IAAM,SAAS,CAAC,aAAa,KAAK;AAOlC,SAAS,MAAM,CACd,KACA,SACiB;AAAA,EACjB,MAAM,YAAqC,CAAC;AAAA,EAC5C,WAAW,QAAQ,QAAQ;AAAA,IAC1B,MAAM,QAAQ,UAAU;AAAA,IACxB,IAAI,UAAU;AAAA,MAAW;AAAA,IAIzB,YAAY,KAAK,MAAM,KAAK;AAAA,IAC5B,UAAU,QAAQ;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAgB,CAC/B,SACA,QACA,SACS;AAAA,EACT,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EACjC,OAAO,QAAQ,OAAO,QAAQ,KAAK;AAAA,OAC/B,OAAO,KAAK,OAAO;AAAA,IACtB,QAAQ;AAAA,EACT,CAAC;AAAA;AAcK,SAAS,aAAgB,CAC/B,SACA,QACA,SACS;AAAA,EACT,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EACjC,OAAO,QAAQ,OAAO,QAAQ,KAAK;AAAA,OAC/B,OAAO,KAAK,OAAO;AAAA,IACtB,QAAQ;AAAA,EACT,CAAC;AAAA;;;ACpEF,eAAe,WAAiB,CAC/B,SACA,QACA,MACyB;AAAA,EACzB,IAAI;AAAA,IACH,OAAO,MAAM,KAAK,QAAQ,OAAO,KAAK,MAAM,SAAS,MAAM,CAAC,CAAC;AAAA,IAC5D,OAAO,QAAQ;AAAA,IAEhB,IAAK,OAA8B,SAAS;AAAA,MAAa;AAAA,IACzD,MAAM;AAAA;AAAA;AAID,SAAS,SAAY,CAC3B,SACA,QACkC;AAAA,EAClC,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC;AAAA;AAGpD,SAAS,QAAW,CAC1B,SACA,QAC8B;AAAA,EAC9B,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA;AAGnD,SAAS,UAAa,CAC5B,SACA,QAC+B;AAAA,EAC/B,OAAO,YAAY,SAAS,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA;AAGnD,SAAS,YAAe,CAC9B,SACA,QACmB;AAAA,EACnB,OAAO,QAAQ,OAAO,OAAO,MAAM,SAAS,MAAM,CAAC;AAAA;;;AC1CpD,eAAsB,SAAY,CACjC,SACA,QACA,MACA,UAAsB,CAAC,GACP;AAAA,EAChB,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EACjC,MAAM,OAAO,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC7C,UAAU,SAAS,KAAK,IAAI;AAAA,EAC5B,UAAU,SAAS,KAAK,IAAI;AAAA,EAG5B,MAAM,YAAY,OAAO,KAAK,OAAO;AAAA,EAIrC,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM;AAAA,OAClC;AAAA,OACC,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACxB,CAAC;AAAA;AAeF,IAAM,SAAS;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAcA,SAAS,MAAM,CAAC,KAAa,SAAiC;AAAA,EAC7D,MAAM,YAAqC,CAAC;AAAA,EAC5C,WAAW,QAAQ,QAAQ;AAAA,IAC1B,MAAM,QAAQ,QAAQ;AAAA,IACtB,IAAI,UAAU;AAAA,MAAW;AAAA,IACzB,YAAY,KAAK,MAAM,KAAK;AAAA,IAC5B,UAAU,QAAQ;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAID,SAAS,YAAe,CAC9B,SACA,QACgB;AAAA,EAChB,OAAO,QAAQ,OAAO,OAAO,MAAM,SAAS,MAAM,CAAC;AAAA;;;APK7C,SAAS,UAAa,CAC5B,YACA,UAAqC,CAAC,GACrB;AAAA,EACjB,MAAM,SAAS,IAAI,SAAS,KAAK,SAAS,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrE,MAAM,UAAU,cAAc,QAAQ,UAAU;AAAA,EAChD,OAAO;AAAA,IACN;AAAA,IACA,QAAQ,CAAC,WAAW,MAAM,SAAS,MAAM;AAAA,IACzC,MAAM,CAAC,WAAW,OAAO,KAAK,MAAM,SAAS,MAAM,CAAC;AAAA,IACpD,KAAK,CAAC,QAAQ,MAAM,eACnB,UAAU,SAAS,QAAQ,MAAM,UAAU;AAAA,IAC5C,OAAO,CAAC,WAAW,UAAU,SAAS,MAAM;AAAA,IAC5C,MAAM,CAAC,WAAW,SAAS,SAAS,MAAM;AAAA,IAC1C,QAAQ,CAAC,WAAW,aAAa,SAAS,MAAM;AAAA,IAChD,MAAM,CAAC,WAAW,WAAW,SAAS,MAAM;AAAA,IAC5C,QAAQ,CAAC,WAAW,aAAa,SAAS,MAAM;AAAA,IAChD,MAAM,CAAC,gBAAgB,YAAY,SAAS,WAAW;AAAA,IACvD,YAAY,CAAC,QAAQ,mBACpB,cAAc,SAAS,QAAQ,cAAc;AAAA,IAC9C,YAAY,CAAC,QAAQ,mBACpB,cAAc,SAAS,QAAQ,cAAc;AAAA,EAC/C;AAAA;;AQzFM,SAAS,YAAe,CAC9B,YACsB;AAAA,EACtB,IAAI,WAAW,OAAO,WAAW,GAAG;AAAA,IACnC,MAAM,IAAI,UAAU,kDAAkD;AAAA,EACvE;AAAA,EACA,IAAI,WAAW,YAAY,WAAW;AAAA,IACrC,QAAQ,YAAY;AAAA,IACpB,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG;AAAA,MAC9C,MAAM,IAAI,UACT,kBAAkB,WAAW,4BAA4B,cACxD,iDACF;AAAA,IACD;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,WAAW;AAAA,EACzB,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,IAC/C,MAAM,IAAI,UACT,kBAAkB,WAAW,sCAC5B,4DACA,sCACF;AAAA,EACD;AAAA,EACA,OAAO,OAAO,OAAO,KAAK,WAAW,CAAC;AAAA;",
+  "debugId": "B73383C85513ABE564756E2164756E21",
   "names": []
 }

package/docs/README.md

@@ -0,0 +1,16 @@
+# `@nxgt/s3` documentation
+
+S3 on Bun's own `S3Client`. `S3Client` is built into Bun, so this package has
+**no dependency at all** — no AWS SDK — and does not run on Node.
+
+| Page | Read it when |
+| --- | --- |
+| [Buckets](guide/buckets.md) | you are describing a bucket, building its keys, or binding it to credentials |
+| [Reading](guide/reads.md) | you want an object's bytes, its text, whether it is there, what the service knows about it, or a page of the bucket |
+| [Writing](guide/writes.md) | you are storing an object, choosing what a write says about it, or handling a refusal |
+| [Presigned URLs](guide/presigned-urls.md) | a browser or another service should read or write an object directly, without your credentials |
+| [Troubleshooting](troubleshooting.md) | a call threw, an upload was refused, or a signed URL did not do what you expected |
+| [Roadmap](roadmap.md) | you want to know what is coming, and what has been ruled out |
+
+The [README](../README.md) is the short version: install, one example per
+area, and the traps in one line each.