@prisma/composer-prisma-cloud 0.1.0-dev.1

package/dist/storage/testing.d.mts

@@ -0,0 +1,85 @@
+//#region ../../1-prisma-cloud/2-shared-modules/storage/dist/testing.d.mts
+//#region src/store.d.ts
+/**
+ * The minimal object store the protocol handler drives — the seam between the
+ * wire protocol (D2) and its backing (the Postgres bytea store, D3). Buckets
+ * are namespaces: any bucket name is accepted and simply scopes keys. The
+ * store owns the ETag (quoted SHA-256 hex of the object bytes).
+ */
+interface PutResult {
+  readonly etag: string;
+}
+interface GetRange {
+  readonly start: number;
+  /** Inclusive end; omitted means "to the end of the object". */
+  readonly end?: number;
+}
+interface GetResult {
+  /** The requested slice — the whole object when no range was given. */
+  readonly bytes: Uint8Array;
+  readonly etag: string;
+  readonly contentType: string;
+  /** TOTAL object size, for `Content-Range` — not the slice length. */
+  readonly size: number;
+}
+interface HeadResult {
+  readonly etag: string;
+  readonly size: number;
+  readonly contentType: string;
+}
+interface ListOptions {
+  readonly prefix?: string;
+  readonly continuationToken?: string;
+  readonly maxKeys?: number;
+}
+interface ListResult {
+  readonly keys: readonly string[];
+  readonly nextContinuationToken?: string;
+  readonly isTruncated: boolean;
+}
+interface ObjectStore {
+  put(bucket: string, key: string, bytes: Uint8Array, opts?: {
+    contentType?: string;
+  }): Promise<PutResult>;
+  /** `null` when the key is missing. */
+  get(bucket: string, key: string, opts?: {
+    range?: GetRange;
+  }): Promise<GetResult | null>;
+  /** `null` when the key is missing. */
+  head(bucket: string, key: string): Promise<HeadResult | null>;
+  /** Idempotent — deleting a missing key is not an error. */
+  delete(bucket: string, key: string): Promise<void>;
+  list(bucket: string, opts?: ListOptions): Promise<ListResult>;
+}
+//#endregion
+//#region src/pg-store.d.ts
+/**
+ * Connect (FT-5219 posture: `max: 1`, short `idleTimeout`), apply the schema
+ * idempotently behind the cold-start retry, and return the store.
+ */
+declare function createPgStore(url: string): Promise<ObjectStore>;
+//#endregion
+//#region src/sigv4.d.ts
+interface Credentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+}
+//#endregion
+//#region src/storage-server.d.ts
+interface StorageServer {
+  /** The externally reachable base URL of the running server. */
+  readonly url: string;
+  stop(): void;
+}
+interface StorageServerOptions {
+  readonly store: ObjectStore;
+  readonly credentials: Credentials;
+  /** The module's canonical bucket — surfaced to consumers; the wire namespaces by the path bucket. */
+  readonly bucket: string;
+  readonly port: number;
+  readonly hostname?: string;
+}
+declare function startStorageServer(opts: StorageServerOptions): StorageServer;
+//#endregion
+export { type StorageServer, type StorageServerOptions, createPgStore, startStorageServer };
+//# sourceMappingURL=testing.d.mts.map

package/dist/storage/testing.mjs

@@ -0,0 +1,531 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { SQL } from "bun";
+//#region ../../1-prisma-cloud/2-shared-modules/storage/dist/testing.mjs
+/** Connection resilience helpers for Prisma Postgres cold-starts (FT-5226); no heavy imports (no `effect`/`alchemy`/`pg`), so the deploy lowerings, the pnPostgres runtime client, and bun-runnable services (the storage store, via the pure `@internal/prisma-cloud/connection` subpath) all share one implementation. */
+/** Network-level socket failures node-postgres surfaces as `err.code`. */
+const TRANSIENT_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+/** Connection-establishment failure messages (no useful `err.code`). */
+const TRANSIENT_MESSAGE_FRAGMENTS = [
+	"upstream database",
+	"connection terminated",
+	"connection refused",
+	"terminating connection",
+	"server closed the connection",
+	"connection timeout",
+	"timeout expired"
+];
+/** Whether an error is a transient connection failure worth retrying, as opposed to a real query error that must surface at once. */
+function isTransientConnectionError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
+	if (code !== void 0 && TRANSIENT_CODES.has(code)) return true;
+	const message = "message" in error && typeof error.message === "string" ? error.message.toLowerCase() : "";
+	return TRANSIENT_MESSAGE_FRAGMENTS.some((fragment) => message.includes(fragment));
+}
+/**
+* Retries an operation past a transient connection failure, bounded (default
+* ~1 min). `shouldRetry` decides what's transient — defaults to retrying
+* everything; the runtime client passes {@link isTransientConnectionError}.
+*/
+async function withConnectionRetry(operation, opts = {}) {
+	const attempts = opts.attempts ?? 12;
+	const delayMs = opts.delayMs ?? 5e3;
+	const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const shouldRetry = opts.shouldRetry ?? (() => true);
+	let lastError;
+	for (let attempt = 1; attempt <= attempts; attempt++) try {
+		return await operation();
+	} catch (error) {
+		if (!shouldRetry(error)) throw error;
+		lastError = error;
+		if (attempt < attempts) await sleep(delayMs);
+	}
+	throw lastError;
+}
+/** Retries acquiring a connection past a transient cold-start; {@link withConnectionRetry} with {@link isTransientConnectionError} fixed as the predicate. */
+function retryTransientConnect(acquire, opts = {}) {
+	return withConnectionRetry(acquire, {
+		...opts,
+		shouldRetry: isTransientConnectionError
+	});
+}
+/**
+* The `ObjectStore` over Postgres `bytea` (spec § 3): one `objects` table,
+* single-row-per-object. Ranged reads use SQL `substring` so a range request
+* never detoasts the whole object. The schema is applied idempotently at init
+* behind a bounded connection retry — the first connect to a freshly
+* provisioned Postgres is rejected while the upstream is cold (FT-5226).
+*
+* Runtime engine code (`bun` SQL + `node:crypto`); NOT re-exported from the
+* authoring barrel.
+*/
+const DEFAULT_MAX_KEYS$1 = 1e3;
+function etagOf(bytes) {
+	return `"${createHash("sha256").update(bytes).digest("hex")}"`;
+}
+/** bytea comes back as a Node Buffer (a Uint8Array). Fail closed on anything else rather than returning wrong bytes. */
+function toBytes(value) {
+	if (value instanceof Uint8Array) return value;
+	throw new TypeError(`expected bytea to decode as Uint8Array, got ${typeof value}`);
+}
+/** One row → GetResult (both the whole-object and ranged queries alias the payload as `bytes`; `size` is the bigint total). */
+function toGetResult(row) {
+	return {
+		bytes: toBytes(row.bytes),
+		etag: row.etag,
+		contentType: row.content_type,
+		size: Number(row.size)
+	};
+}
+var PgObjectStore = class {
+	sql;
+	constructor(sql) {
+		this.sql = sql;
+	}
+	async put(bucket, key, bytes, opts = {}) {
+		const etag = etagOf(bytes);
+		const contentType = opts.contentType ?? "application/octet-stream";
+		await this.sql`
+      insert into objects (bucket, key, bytes, size, etag, content_type)
+      values (${bucket}, ${key}, ${bytes}, ${bytes.byteLength}, ${etag}, ${contentType})
+      on conflict (bucket, key) do update set
+        bytes = excluded.bytes, size = excluded.size,
+        etag = excluded.etag, content_type = excluded.content_type`;
+		return { etag };
+	}
+	async get(bucket, key, opts = {}) {
+		const range = opts.range;
+		if (range) {
+			const from = range.start + 1;
+			const row = (range.end === void 0 ? await this.sql`select substring(bytes from ${from}) as bytes, size, etag, content_type
+                           from objects where bucket = ${bucket} and key = ${key}` : await this.sql`select substring(bytes from ${from} for ${range.end - range.start + 1}) as bytes,
+                           size, etag, content_type
+                           from objects where bucket = ${bucket} and key = ${key}`)[0];
+			return row === void 0 ? null : toGetResult(row);
+		}
+		const row = (await this.sql`select bytes, size, etag, content_type
+                                from objects where bucket = ${bucket} and key = ${key}`)[0];
+		return row === void 0 ? null : toGetResult(row);
+	}
+	async head(bucket, key) {
+		const row = (await this.sql`select size, etag, content_type
+                                from objects where bucket = ${bucket} and key = ${key}`)[0];
+		if (row === void 0) return null;
+		return {
+			etag: row.etag,
+			size: Number(row.size),
+			contentType: row.content_type
+		};
+	}
+	async delete(bucket, key) {
+		await this.sql`delete from objects where bucket = ${bucket} and key = ${key}`;
+	}
+	async list(bucket, opts = {}) {
+		const prefix = opts.prefix ?? "";
+		const maxKeys = opts.maxKeys ?? DEFAULT_MAX_KEYS$1;
+		const token = opts.continuationToken;
+		const limit = maxKeys + 1;
+		const keys = (token === void 0 ? await this.sql`select key from objects
+                         where bucket = ${bucket} and starts_with(key, ${prefix})
+                         order by key limit ${limit}` : await this.sql`select key from objects
+                         where bucket = ${bucket} and starts_with(key, ${prefix}) and key > ${token}
+                         order by key limit ${limit}`).map((r) => r.key);
+		const isTruncated = keys.length > maxKeys;
+		const page = isTruncated ? keys.slice(0, maxKeys) : keys;
+		const last = page.at(-1);
+		return {
+			keys: page,
+			isTruncated,
+			...isTruncated && last !== void 0 ? { nextContinuationToken: last } : {}
+		};
+	}
+};
+/**
+* Connect (FT-5219 posture: `max: 1`, short `idleTimeout`), apply the schema
+* idempotently behind the cold-start retry, and return the store.
+*/
+async function createPgStore(url) {
+	const sql = new SQL({
+		url,
+		max: 1,
+		idleTimeout: 10
+	});
+	await retryTransientConnect(() => sql`
+      create table if not exists objects (
+        bucket text not null,
+        key text not null,
+        bytes bytea not null,
+        size bigint not null,
+        etag text not null,
+        content_type text not null,
+        created_at timestamptz not null default now(),
+        primary key (bucket, key)
+      )`);
+	return new PgObjectStore(sql);
+}
+/**
+* AWS SigV4 verification for the S3 wire protocol (spec § 2 auth). The payload
+* hash comes from the client — `x-amz-content-sha256` (a real hash or
+* `UNSIGNED-PAYLOAD`) for header auth, `UNSIGNED-PAYLOAD` for presign — and is
+* never re-hashed; the verifier trusts what was signed, like a real S3 endpoint.
+* Runtime engine code (`node:crypto`); not re-exported from the authoring barrel.
+*/
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+	return createHmac("sha256", key).update(data).digest();
+}
+/** AWS canonical URI encoding: every byte except the unreserved set is %XX. */
+function awsUriEncode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%7E/g, "~");
+}
+function parseCredential(credential) {
+	const parts = credential.split("/");
+	if (parts.length !== 5 || parts[4] !== "aws4_request") return null;
+	const [accessKeyId, date, region, service] = parts;
+	if (!accessKeyId || !date || !region || !service) return null;
+	return {
+		accessKeyId,
+		date,
+		region,
+		service
+	};
+}
+function signingKey(secret, scope) {
+	return hmac(hmac(hmac(hmac(`AWS4${secret}`, scope.date), scope.region), scope.service), "aws4_request");
+}
+function canonicalHeaders(url, req, signedHeaders) {
+	return signedHeaders.map((name) => {
+		return `${name}:${(name === "host" ? url.host : req.headers.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`;
+	}).join("");
+}
+function canonicalQuery(url, exclude) {
+	const entries = [];
+	for (const [key, value] of url.searchParams.entries()) {
+		if (exclude !== void 0 && key === exclude) continue;
+		entries.push([awsUriEncode(key), awsUriEncode(value)]);
+	}
+	const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+	entries.sort(([ak, av], [bk, bv]) => cmp(ak, bk) || cmp(av, bv));
+	return entries.map(([k, v]) => `${k}=${v}`).join("&");
+}
+function stringToSign(amzDate, scope, canonicalRequest) {
+	const scopeString = `${scope.date}/${scope.region}/${scope.service}/aws4_request`;
+	return [
+		ALGORITHM,
+		amzDate,
+		scopeString,
+		sha256Hex(canonicalRequest)
+	].join("\n");
+}
+function signatureMatches(expected, provided) {
+	const a = Buffer.from(expected, "hex");
+	const b = Buffer.from(provided, "hex");
+	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+/** `YYYYMMDDTHHMMSSZ` → epoch ms, or null when malformed. */
+function parseAmzDate(amzDate) {
+	const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+	if (!match) return null;
+	const [, y, mo, d, h, mi, s] = match;
+	return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
+}
+function parseAuthorizationHeader(header) {
+	if (!header.startsWith(`${ALGORITHM} `)) return null;
+	const rest = header.slice(17);
+	const fields = /* @__PURE__ */ new Map();
+	for (const part of rest.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		fields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+	}
+	const credential = fields.get("Credential");
+	const signedHeaders = fields.get("SignedHeaders");
+	const signature = fields.get("Signature");
+	if (!credential || !signedHeaders || !signature) return null;
+	return {
+		credential,
+		signedHeaders: signedHeaders.split(";"),
+		signature
+	};
+}
+/** The one signing core both auth forms share: check the access key, rebuild the canonical request, derive the key, compare in constant time. */
+function verifySignature(req, url, credentials, params) {
+	if (params.scope.accessKeyId !== credentials.accessKeyId) return {
+		ok: false,
+		reason: "unknown access key"
+	};
+	const canonicalRequest = [
+		req.method,
+		url.pathname,
+		canonicalQuery(url, params.excludeQuery),
+		canonicalHeaders(url, req, params.signedHeaders),
+		params.signedHeaders.join(";"),
+		params.payloadHash
+	].join("\n");
+	return signatureMatches(hmac(signingKey(credentials.secretAccessKey, params.scope), stringToSign(params.amzDate, params.scope, canonicalRequest)).toString("hex"), params.signature) ? { ok: true } : {
+		ok: false,
+		reason: "signature mismatch"
+	};
+}
+function verifyHeader(req, url, credentials) {
+	const auth = parseAuthorizationHeader(req.headers.get("authorization") ?? "");
+	if (!auth) return {
+		ok: false,
+		reason: "malformed Authorization header"
+	};
+	const scope = parseCredential(auth.credential);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const amzDate = req.headers.get("x-amz-date");
+	if (!amzDate) return {
+		ok: false,
+		reason: "missing x-amz-date"
+	};
+	const payloadHash = req.headers.get("x-amz-content-sha256");
+	if (!payloadHash) return {
+		ok: false,
+		reason: "missing x-amz-content-sha256"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: auth.signedHeaders,
+		payloadHash,
+		signature: auth.signature
+	});
+}
+function verifyPresigned(req, url, credentials, now) {
+	const q = url.searchParams;
+	if (q.get("X-Amz-Algorithm") !== ALGORITHM) return {
+		ok: false,
+		reason: "unsupported presign algorithm"
+	};
+	const credentialRaw = q.get("X-Amz-Credential");
+	const amzDate = q.get("X-Amz-Date");
+	const expiresRaw = q.get("X-Amz-Expires");
+	const signedHeadersRaw = q.get("X-Amz-SignedHeaders");
+	const signature = q.get("X-Amz-Signature");
+	if (!credentialRaw || !amzDate || !expiresRaw || !signedHeadersRaw || !signature) return {
+		ok: false,
+		reason: "incomplete presign parameters"
+	};
+	const scope = parseCredential(credentialRaw);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const signedAt = parseAmzDate(amzDate);
+	const expires = Number(expiresRaw);
+	if (signedAt === null || !Number.isFinite(expires)) return {
+		ok: false,
+		reason: "malformed presign date"
+	};
+	if (now.getTime() > signedAt + expires * 1e3) return {
+		ok: false,
+		reason: "presign expired"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: signedHeadersRaw.split(";"),
+		payloadHash: UNSIGNED_PAYLOAD,
+		signature,
+		excludeQuery: "X-Amz-Signature"
+	});
+}
+/**
+* Verify a request's SigV4 signature against a single credential pair. Picks
+* the presigned form when `X-Amz-Signature` is present, otherwise the
+* `Authorization`-header form. `now` is injectable for deterministic
+* expiry tests.
+*/
+function verifyRequest(req, credentials, now = /* @__PURE__ */ new Date()) {
+	const url = new URL(req.url);
+	if (url.searchParams.has("X-Amz-Signature")) return verifyPresigned(req, url, credentials, now);
+	if (req.headers.has("authorization")) return verifyHeader(req, url, credentials);
+	return {
+		ok: false,
+		reason: "unsigned request"
+	};
+}
+const DEFAULT_CONTENT_TYPE = "application/octet-stream";
+/** Path-style: `/{bucket}/{key…}`. Each segment is percent-decoded. */
+function parseTarget(url) {
+	const segments = url.pathname.split("/").filter((s) => s.length > 0);
+	if (segments.length === 0) return null;
+	const [bucket, ...keyParts] = segments;
+	return {
+		bucket: decodeURIComponent(bucket ?? ""),
+		key: keyParts.map(decodeURIComponent).join("/")
+	};
+}
+/** `bytes=a-b` (inclusive) or `bytes=a-` (open-ended). Null when absent/malformed. */
+function parseRange(header) {
+	if (!header) return null;
+	const match = /^bytes=(\d+)-(\d*)$/.exec(header.trim());
+	if (!match) return null;
+	const start = Number(match[1]);
+	return match[2] ? {
+		start,
+		end: Number(match[2])
+	} : { start };
+}
+function xmlEscape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function listXml(bucket, prefix, maxKeys, result) {
+	const contents = result.keys.map((k) => `<Contents><Key>${xmlEscape(k)}</Key></Contents>`).join("");
+	const next = result.isTruncated && result.nextContinuationToken !== void 0 ? `<NextContinuationToken>${xmlEscape(result.nextContinuationToken)}</NextContinuationToken>` : "";
+	return `<?xml version="1.0" encoding="UTF-8"?><ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Name>${xmlEscape(bucket)}</Name><Prefix>${xmlEscape(prefix)}</Prefix><KeyCount>${result.keys.length}</KeyCount><MaxKeys>${maxKeys}</MaxKeys><IsTruncated>${result.isTruncated}</IsTruncated>` + contents + next + "</ListBucketResult>";
+}
+const DEFAULT_MAX_KEYS = 1e3;
+async function handleList(store, bucket, url) {
+	const prefix = url.searchParams.get("prefix") ?? "";
+	const continuationToken = url.searchParams.get("continuation-token");
+	const maxKeysRaw = url.searchParams.get("max-keys");
+	const maxKeys = maxKeysRaw !== null && Number.isFinite(Number(maxKeysRaw)) ? Number(maxKeysRaw) : DEFAULT_MAX_KEYS;
+	const result = await store.list(bucket, {
+		prefix,
+		maxKeys,
+		...continuationToken !== null ? { continuationToken } : {}
+	});
+	return new Response(listXml(bucket, prefix, maxKeys, result), {
+		status: 200,
+		headers: { "content-type": "application/xml" }
+	});
+}
+/** aws-chunked / flexible-checksum PUTs frame the body as chunks + a trailer (signalled by `x-amz-content-sha256: STREAMING-…` or `content-encoding: aws-chunked`); the seed signature still verifies, so reject them (501) rather than store the raw framing as the object bytes. Decoding is out of scope. */
+function isStreamingPut(req) {
+	const contentSha = req.headers.get("x-amz-content-sha256") ?? "";
+	const contentEncoding = req.headers.get("content-encoding") ?? "";
+	return contentSha.startsWith("STREAMING-") || contentEncoding.split(",").some((e) => e.trim() === "aws-chunked");
+}
+async function handlePut(store, t, req) {
+	if (isStreamingPut(req)) return new Response("aws-chunked / flexible checksums not supported; set requestChecksumCalculation: 'WHEN_REQUIRED'", { status: 501 });
+	const body = new Uint8Array(await req.arrayBuffer());
+	const contentType = req.headers.get("content-type") ?? DEFAULT_CONTENT_TYPE;
+	const { etag } = await store.put(t.bucket, t.key, body, { contentType });
+	return new Response(null, {
+		status: 200,
+		headers: { etag }
+	});
+}
+/** The etag/content-type/content-length/accept-ranges headers GET and HEAD share — `contentLength` is the slice length for GET, the total object size for HEAD. */
+function metaHeaders(meta) {
+	return new Headers({
+		etag: meta.etag,
+		"content-type": meta.contentType,
+		"content-length": String(meta.contentLength),
+		"accept-ranges": "bytes"
+	});
+}
+async function handleGet(store, t, req) {
+	const range = parseRange(req.headers.get("range"));
+	const object = await store.get(t.bucket, t.key, range ? { range } : void 0);
+	if (!object) return new Response(null, { status: 404 });
+	const headers = metaHeaders({
+		etag: object.etag,
+		contentType: object.contentType,
+		contentLength: object.bytes.byteLength
+	});
+	if (!range) return new Response(object.bytes, {
+		status: 200,
+		headers
+	});
+	if (range.start >= object.size && object.size > 0) return new Response(null, {
+		status: 416,
+		headers: { "content-range": `bytes */${object.size}` }
+	});
+	const end = range.end === void 0 ? object.size - 1 : Math.min(range.end, object.size - 1);
+	headers.set("content-range", `bytes ${range.start}-${end}/${object.size}`);
+	return new Response(object.bytes, {
+		status: 206,
+		headers
+	});
+}
+async function handleHead(store, t) {
+	const meta = await store.head(t.bucket, t.key);
+	if (!meta) return new Response(null, { status: 404 });
+	return new Response(null, {
+		status: 200,
+		headers: metaHeaders({
+			etag: meta.etag,
+			contentType: meta.contentType,
+			contentLength: meta.size
+		})
+	});
+}
+async function handleDelete(store, t) {
+	await store.delete(t.bucket, t.key);
+	return new Response(null, { status: 204 });
+}
+function createS3Handler(opts) {
+	const { store, credentials } = opts;
+	return async (req) => {
+		if (!verifyRequest(req, credentials).ok) return new Response(null, { status: 403 });
+		const url = new URL(req.url);
+		const target = parseTarget(url);
+		if (!target) return new Response(null, { status: 400 });
+		if (req.method === "GET" && url.searchParams.get("list-type") === "2" && target.key === "") return handleList(store, target.bucket, url);
+		if (target.key === "") return new Response(null, { status: 400 });
+		switch (req.method) {
+			case "PUT": return handlePut(store, target, req);
+			case "GET": return handleGet(store, target, req);
+			case "HEAD": return handleHead(store, target);
+			case "DELETE": return handleDelete(store, target);
+			default: return new Response(null, { status: 405 });
+		}
+	};
+}
+/**
+* Boots the S3 wire protocol on `Bun.serve` — the D2 handler over any
+* `ObjectStore`. Binds all interfaces (Compute routes external HTTP to the VM,
+* so a loopback-only listener would be unreachable). Installs the FT-5219
+* process guards so an idle Bun.SQL connection close surfaces as a logged
+* error instead of crash-looping the process on scale-to-zero.
+*
+* Runtime engine code; NOT re-exported from the authoring barrel. The D4
+* entrypoint reads deps via `load()` and calls this.
+*/
+let guardsInstalled = false;
+/** FT-5219: keep the process alive when Bun.SQL surfaces an idle-close as an unawaited async error. Installed once. */
+function installProcessGuards() {
+	if (guardsInstalled) return;
+	guardsInstalled = true;
+	process.on("uncaughtException", (err) => console.error("uncaughtException", err));
+	process.on("unhandledRejection", (err) => console.error("unhandledRejection", err));
+}
+function startStorageServer(opts) {
+	installProcessGuards();
+	const handler = createS3Handler({
+		store: opts.store,
+		credentials: opts.credentials
+	});
+	const hostname = opts.hostname ?? "0.0.0.0";
+	const server = Bun.serve({
+		port: opts.port,
+		hostname,
+		fetch: (req) => handler(req)
+	});
+	return {
+		url: `http://${hostname === "0.0.0.0" ? "127.0.0.1" : hostname}:${server.port}`,
+		stop: () => server.stop(true)
+	};
+}
+//#endregion
+export { createPgStore, startStorageServer };
+
+//# sourceMappingURL=testing.mjs.map