@prisma/composer-prisma-cloud 0.2.0-dev.12 → 0.2.0-dev.14

package/dist/buckets-main.mjs

@@ -0,0 +1,795 @@
+import { i as readOwnVersion, n as isValidSegment, r as readJsonFile, t as StateFile } from "./segments-NpKN-46R-B01DmCqy.mjs";
+import * as fs from "node:fs";
+import * as fs$1 from "node:fs/promises";
+import * as path from "node:path";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import * as http from "node:http";
+//#region ../../1-prisma-cloud/0-lowering/s3-protocol/dist/index.mjs
+const DEFAULT_CONTENT_TYPE$1 = "application/octet-stream";
+const TMP_DIR_NAME = ".tmp";
+const META_DIR_NAME = ".meta";
+const RESERVED_SEGMENTS = /* @__PURE__ */ new Set([TMP_DIR_NAME, META_DIR_NAME]);
+const BUCKET_NAME_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+function etagOf$1(bytes) {
+	return `"${createHash("sha256").update(bytes).digest("hex")}"`;
+}
+function isErrnoException(err) {
+	return err instanceof Error && "code" in err;
+}
+function isEnoent(err) {
+	return isErrnoException(err) && err.code === "ENOENT";
+}
+/**
+* Splits a key into its `/` segments, rejecting anything that could escape
+* the bucket dir or collide with the reserved `.tmp`/`.meta` namespaces:
+* `..` segments, an empty segment (leading/trailing/doubled `/`, which also
+* catches a leading-slash "absolute" key), or a segment literally `.tmp` or
+* `.meta` at any depth.
+*/
+function keySegments(key) {
+	const segments = key.split("/");
+	for (const segment of segments) if (segment === "" || segment === "." || segment === ".." || RESERVED_SEGMENTS.has(segment)) throw new Error(`invalid object key: "${key}"`);
+	return segments;
+}
+/** `<bucketDir>/<key's segments>`, double-checked to still resolve inside `bucketDir`. */
+function objectPath(bucketDir, key) {
+	const target = path.join(bucketDir, ...keySegments(key));
+	const resolvedRoot = path.resolve(bucketDir) + path.sep;
+	if (!(path.resolve(target) + path.sep).startsWith(resolvedRoot)) throw new Error(`invalid object key: "${key}"`);
+	return target;
+}
+/** `<bucketDir>/.meta/<key's segments>.json` — mirrors `objectPath`'s tree under `.meta`. */
+function sidecarPath(bucketDir, key) {
+	const segments = keySegments(key);
+	const last = segments[segments.length - 1];
+	const dirs = segments.slice(0, -1);
+	return path.join(bucketDir, META_DIR_NAME, ...dirs, `${last}.json`);
+}
+/** Write-temp-then-rename: never leaves a reader observing a partial file. */
+async function writeAtomic(finalPath, tmpRoot, bytes) {
+	await fs$1.mkdir(tmpRoot, { recursive: true });
+	const tmpPath = path.join(tmpRoot, randomUUID());
+	await fs$1.writeFile(tmpPath, bytes);
+	await fs$1.mkdir(path.dirname(finalPath), { recursive: true });
+	await fs$1.rename(tmpPath, finalPath);
+}
+function isSidecar(value) {
+	return typeof value === "object" && value !== null && "contentType" in value && typeof value.contentType === "string" && "etag" in value && typeof value.etag === "string";
+}
+async function readSidecar(sidecar) {
+	let raw;
+	try {
+		raw = await fs$1.readFile(sidecar, "utf8");
+	} catch (err) {
+		if (isEnoent(err)) return null;
+		throw err;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (isSidecar(parsed)) return parsed;
+	} catch {}
+	return null;
+}
+/** Read the object's bytes plus its metadata — adopting a sidecar-less file (dropped in by a developer) by computing and lazily persisting one. `null` when the object is missing. */
+async function readObject(bucketDir, key) {
+	const target = objectPath(bucketDir, key);
+	let bytes;
+	try {
+		bytes = await fs$1.readFile(target);
+	} catch (err) {
+		if (isEnoent(err)) return null;
+		throw err;
+	}
+	const existing = await readSidecar(sidecarPath(bucketDir, key));
+	if (existing) return {
+		bytes,
+		meta: existing
+	};
+	const meta = {
+		contentType: DEFAULT_CONTENT_TYPE$1,
+		etag: etagOf$1(bytes)
+	};
+	await writeAtomic(sidecarPath(bucketDir, key), path.join(bucketDir, TMP_DIR_NAME), Buffer.from(JSON.stringify(meta)));
+	return {
+		bytes,
+		meta
+	};
+}
+/** Remove now-empty directories from `startDir` up to (never including) `root`. */
+async function pruneEmptyDirs(root, startDir) {
+	const resolvedRoot = path.resolve(root);
+	let dir = path.resolve(startDir);
+	while (dir !== resolvedRoot && dir.startsWith(resolvedRoot + path.sep)) {
+		let entries;
+		try {
+			entries = await fs$1.readdir(dir);
+		} catch (err) {
+			if (isEnoent(err)) {
+				dir = path.dirname(dir);
+				continue;
+			}
+			throw err;
+		}
+		if (entries.length > 0) break;
+		try {
+			await fs$1.rmdir(dir);
+		} catch (err) {
+			if (!isEnoent(err)) throw err;
+		}
+		dir = path.dirname(dir);
+	}
+}
+/** Recursively lists every object key under `dir`, skipping `.tmp`/`.meta` at any depth. */
+async function walkKeys(dir) {
+	const keys = [];
+	async function walk(current, prefix) {
+		let entries;
+		try {
+			entries = await fs$1.readdir(current, { withFileTypes: true });
+		} catch (err) {
+			if (isEnoent(err)) return;
+			throw err;
+		}
+		for (const entry of entries) {
+			if (RESERVED_SEGMENTS.has(entry.name)) continue;
+			const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+			if (entry.isDirectory()) await walk(path.join(current, entry.name), rel);
+			else if (entry.isFile()) keys.push(rel);
+		}
+	}
+	await walk(dir, "");
+	return keys;
+}
+/**
+* A disk-backed `ObjectStore`: object bytes and a metadata sidecar under a
+* per-bucket directory the caller resolves. See the module doc for the
+* unknown-bucket / invalid-key failure shapes.
+*/
+function fsStore(resolveBucketDir) {
+	function resolveDir(bucket) {
+		if (!BUCKET_NAME_RE.test(bucket)) return void 0;
+		return resolveBucketDir(bucket);
+	}
+	return {
+		async put(bucket, key, bytes, opts = {}) {
+			const dir = resolveDir(bucket);
+			if (dir === void 0) throw new Error(`no such bucket: "${bucket}"`);
+			const target = objectPath(dir, key);
+			const tmpRoot = path.join(dir, TMP_DIR_NAME);
+			const etag = etagOf$1(bytes);
+			const contentType = opts.contentType ?? DEFAULT_CONTENT_TYPE$1;
+			await writeAtomic(target, tmpRoot, bytes);
+			await writeAtomic(sidecarPath(dir, key), tmpRoot, Buffer.from(JSON.stringify({
+				contentType,
+				etag
+			})));
+			return { etag };
+		},
+		async get(bucket, key, opts = {}) {
+			const dir = resolveDir(bucket);
+			if (dir === void 0) return null;
+			const found = await readObject(dir, key);
+			if (!found) return null;
+			const { bytes, meta } = found;
+			const size = bytes.byteLength;
+			if (opts.range) {
+				const start = opts.range.start;
+				const end = opts.range.end === void 0 ? size - 1 : Math.min(opts.range.end, size - 1);
+				return {
+					bytes: start > end ? /* @__PURE__ */ new Uint8Array(0) : bytes.subarray(start, end + 1),
+					etag: meta.etag,
+					contentType: meta.contentType,
+					size
+				};
+			}
+			return {
+				bytes: new Uint8Array(bytes),
+				etag: meta.etag,
+				contentType: meta.contentType,
+				size
+			};
+		},
+		async head(bucket, key) {
+			const dir = resolveDir(bucket);
+			if (dir === void 0) return null;
+			const found = await readObject(dir, key);
+			if (!found) return null;
+			return {
+				etag: found.meta.etag,
+				size: found.bytes.byteLength,
+				contentType: found.meta.contentType
+			};
+		},
+		async delete(bucket, key) {
+			const dir = resolveDir(bucket);
+			if (dir === void 0) return;
+			const target = objectPath(dir, key);
+			const sidecar = sidecarPath(dir, key);
+			try {
+				await fs$1.unlink(target);
+			} catch (err) {
+				if (!isEnoent(err)) throw err;
+			}
+			try {
+				await fs$1.unlink(sidecar);
+			} catch (err) {
+				if (!isEnoent(err)) throw err;
+			}
+			await pruneEmptyDirs(dir, path.dirname(target));
+			await pruneEmptyDirs(path.join(dir, META_DIR_NAME), path.dirname(sidecar));
+		},
+		async list(bucket, opts = {}) {
+			const dir = resolveDir(bucket);
+			if (dir === void 0) return {
+				keys: [],
+				isTruncated: false
+			};
+			const prefix = opts.prefix ?? "";
+			const maxKeys = opts.maxKeys ?? 1e3;
+			const token = opts.continuationToken;
+			const matching = (await walkKeys(dir)).filter((key) => key.startsWith(prefix)).sort().filter((key) => token === void 0 ? true : key > token);
+			const page = matching.slice(0, maxKeys);
+			const isTruncated = matching.length > maxKeys;
+			const last = page.at(-1);
+			return {
+				keys: page,
+				isTruncated,
+				...isTruncated && last !== void 0 ? { nextContinuationToken: last } : {}
+			};
+		}
+	};
+}
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+	return createHmac("sha256", key).update(data).digest();
+}
+/** AWS canonical URI encoding: every byte except the unreserved set is %XX. */
+function awsUriEncode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%7E/g, "~");
+}
+function parseCredential(credential) {
+	const parts = credential.split("/");
+	if (parts.length !== 5 || parts[4] !== "aws4_request") return null;
+	const [accessKeyId, date, region, service] = parts;
+	if (!accessKeyId || !date || !region || !service) return null;
+	return {
+		accessKeyId,
+		date,
+		region,
+		service
+	};
+}
+function signingKey(secret, scope) {
+	return hmac(hmac(hmac(hmac(`AWS4${secret}`, scope.date), scope.region), scope.service), "aws4_request");
+}
+function canonicalHeaders(url, req, signedHeaders) {
+	return signedHeaders.map((name) => {
+		return `${name}:${(name === "host" ? url.host : req.headers.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`;
+	}).join("");
+}
+function canonicalQuery(url, exclude) {
+	const entries = [];
+	for (const [key, value] of url.searchParams.entries()) {
+		if (exclude !== void 0 && key === exclude) continue;
+		entries.push([awsUriEncode(key), awsUriEncode(value)]);
+	}
+	const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+	entries.sort(([ak, av], [bk, bv]) => cmp(ak, bk) || cmp(av, bv));
+	return entries.map(([k, v]) => `${k}=${v}`).join("&");
+}
+function stringToSign(amzDate, scope, canonicalRequest) {
+	const scopeString = `${scope.date}/${scope.region}/${scope.service}/aws4_request`;
+	return [
+		ALGORITHM,
+		amzDate,
+		scopeString,
+		sha256Hex(canonicalRequest)
+	].join("\n");
+}
+function signatureMatches(expected, provided) {
+	const a = Buffer.from(expected, "hex");
+	const b = Buffer.from(provided, "hex");
+	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+/** `YYYYMMDDTHHMMSSZ` → epoch ms, or null when malformed. */
+function parseAmzDate(amzDate) {
+	const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+	if (!match) return null;
+	const [, y, mo, d, h, mi, s] = match;
+	return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
+}
+function parseAuthorizationHeader(header) {
+	if (!header.startsWith(`${ALGORITHM} `)) return null;
+	const rest = header.slice(17);
+	const fields = /* @__PURE__ */ new Map();
+	for (const part of rest.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		fields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+	}
+	const credential = fields.get("Credential");
+	const signedHeaders = fields.get("SignedHeaders");
+	const signature = fields.get("Signature");
+	if (!credential || !signedHeaders || !signature) return null;
+	return {
+		credential,
+		signedHeaders: signedHeaders.split(";"),
+		signature
+	};
+}
+/** The one signing core both auth forms share: check the access key, rebuild the canonical request, derive the key, compare in constant time. */
+function verifySignature(req, url, credentials, params) {
+	if (params.scope.accessKeyId !== credentials.accessKeyId) return {
+		ok: false,
+		reason: "unknown access key"
+	};
+	const canonicalRequest = [
+		req.method,
+		url.pathname,
+		canonicalQuery(url, params.excludeQuery),
+		canonicalHeaders(url, req, params.signedHeaders),
+		params.signedHeaders.join(";"),
+		params.payloadHash
+	].join("\n");
+	return signatureMatches(hmac(signingKey(credentials.secretAccessKey, params.scope), stringToSign(params.amzDate, params.scope, canonicalRequest)).toString("hex"), params.signature) ? { ok: true } : {
+		ok: false,
+		reason: "signature mismatch"
+	};
+}
+function verifyHeader(req, url, credentials) {
+	const auth = parseAuthorizationHeader(req.headers.get("authorization") ?? "");
+	if (!auth) return {
+		ok: false,
+		reason: "malformed Authorization header"
+	};
+	const scope = parseCredential(auth.credential);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const amzDate = req.headers.get("x-amz-date");
+	if (!amzDate) return {
+		ok: false,
+		reason: "missing x-amz-date"
+	};
+	const payloadHash = req.headers.get("x-amz-content-sha256");
+	if (!payloadHash) return {
+		ok: false,
+		reason: "missing x-amz-content-sha256"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: auth.signedHeaders,
+		payloadHash,
+		signature: auth.signature
+	});
+}
+function verifyPresigned(req, url, credentials, now) {
+	const q = url.searchParams;
+	if (q.get("X-Amz-Algorithm") !== ALGORITHM) return {
+		ok: false,
+		reason: "unsupported presign algorithm"
+	};
+	const credentialRaw = q.get("X-Amz-Credential");
+	const amzDate = q.get("X-Amz-Date");
+	const expiresRaw = q.get("X-Amz-Expires");
+	const signedHeadersRaw = q.get("X-Amz-SignedHeaders");
+	const signature = q.get("X-Amz-Signature");
+	if (!credentialRaw || !amzDate || !expiresRaw || !signedHeadersRaw || !signature) return {
+		ok: false,
+		reason: "incomplete presign parameters"
+	};
+	const scope = parseCredential(credentialRaw);
+	if (!scope) return {
+		ok: false,
+		reason: "malformed credential scope"
+	};
+	const signedAt = parseAmzDate(amzDate);
+	const expires = Number(expiresRaw);
+	if (signedAt === null || !Number.isFinite(expires)) return {
+		ok: false,
+		reason: "malformed presign date"
+	};
+	if (now.getTime() > signedAt + expires * 1e3) return {
+		ok: false,
+		reason: "presign expired"
+	};
+	return verifySignature(req, url, credentials, {
+		scope,
+		amzDate,
+		signedHeaders: signedHeadersRaw.split(";"),
+		payloadHash: UNSIGNED_PAYLOAD,
+		signature,
+		excludeQuery: "X-Amz-Signature"
+	});
+}
+/**
+* Verify a request's SigV4 signature against a single credential pair. Picks
+* the presigned form when `X-Amz-Signature` is present, otherwise the
+* `Authorization`-header form. `now` is injectable for deterministic
+* expiry tests.
+*/
+function verifyRequest(req, credentials, now = /* @__PURE__ */ new Date()) {
+	const url = new URL(req.url);
+	if (url.searchParams.has("X-Amz-Signature")) return verifyPresigned(req, url, credentials, now);
+	if (req.headers.has("authorization")) return verifyHeader(req, url, credentials);
+	return {
+		ok: false,
+		reason: "unsigned request"
+	};
+}
+const DEFAULT_CONTENT_TYPE = "application/octet-stream";
+/** Path-style: `/{bucket}/{key…}`. Each segment is percent-decoded. */
+function parseTarget(url) {
+	const segments = url.pathname.split("/").filter((s) => s.length > 0);
+	if (segments.length === 0) return null;
+	const [bucket, ...keyParts] = segments;
+	return {
+		bucket: decodeURIComponent(bucket ?? ""),
+		key: keyParts.map(decodeURIComponent).join("/")
+	};
+}
+/** `bytes=a-b` (inclusive) or `bytes=a-` (open-ended). Null when absent/malformed. */
+function parseRange(header) {
+	if (!header) return null;
+	const match = /^bytes=(\d+)-(\d*)$/.exec(header.trim());
+	if (!match) return null;
+	const start = Number(match[1]);
+	return match[2] ? {
+		start,
+		end: Number(match[2])
+	} : { start };
+}
+function xmlEscape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function listXml(bucket, prefix, maxKeys, result) {
+	const contents = result.keys.map((k) => `<Contents><Key>${xmlEscape(k)}</Key></Contents>`).join("");
+	const next = result.isTruncated && result.nextContinuationToken !== void 0 ? `<NextContinuationToken>${xmlEscape(result.nextContinuationToken)}</NextContinuationToken>` : "";
+	return `<?xml version="1.0" encoding="UTF-8"?><ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Name>${xmlEscape(bucket)}</Name><Prefix>${xmlEscape(prefix)}</Prefix><KeyCount>${result.keys.length}</KeyCount><MaxKeys>${maxKeys}</MaxKeys><IsTruncated>${result.isTruncated}</IsTruncated>` + contents + next + "</ListBucketResult>";
+}
+const DEFAULT_MAX_KEYS$1 = 1e3;
+async function handleList(store, bucket, url) {
+	const prefix = url.searchParams.get("prefix") ?? "";
+	const continuationToken = url.searchParams.get("continuation-token");
+	const maxKeysRaw = url.searchParams.get("max-keys");
+	const maxKeys = maxKeysRaw !== null && Number.isFinite(Number(maxKeysRaw)) ? Number(maxKeysRaw) : DEFAULT_MAX_KEYS$1;
+	const result = await store.list(bucket, {
+		prefix,
+		maxKeys,
+		...continuationToken !== null ? { continuationToken } : {}
+	});
+	return new Response(listXml(bucket, prefix, maxKeys, result), {
+		status: 200,
+		headers: { "content-type": "application/xml" }
+	});
+}
+/** aws-chunked / flexible-checksum PUTs frame the body as chunks + a trailer (signalled by `x-amz-content-sha256: STREAMING-…` or `content-encoding: aws-chunked`); the seed signature still verifies, so reject them (501) rather than store the raw framing as the object bytes. Decoding is out of scope. */
+function isStreamingPut(req) {
+	const contentSha = req.headers.get("x-amz-content-sha256") ?? "";
+	const contentEncoding = req.headers.get("content-encoding") ?? "";
+	return contentSha.startsWith("STREAMING-") || contentEncoding.split(",").some((e) => e.trim() === "aws-chunked");
+}
+async function handlePut(store, t, req) {
+	if (isStreamingPut(req)) return new Response("aws-chunked / flexible checksums not supported; set requestChecksumCalculation: 'WHEN_REQUIRED'", { status: 501 });
+	const body = new Uint8Array(await req.arrayBuffer());
+	const contentType = req.headers.get("content-type") ?? DEFAULT_CONTENT_TYPE;
+	const { etag } = await store.put(t.bucket, t.key, body, { contentType });
+	return new Response(null, {
+		status: 200,
+		headers: { etag }
+	});
+}
+/** The etag/content-type/content-length/accept-ranges headers GET and HEAD share — `contentLength` is the slice length for GET, the total object size for HEAD. */
+function metaHeaders(meta) {
+	return new Headers({
+		etag: meta.etag,
+		"content-type": meta.contentType,
+		"content-length": String(meta.contentLength),
+		"accept-ranges": "bytes"
+	});
+}
+async function handleGet(store, t, req) {
+	const range = parseRange(req.headers.get("range"));
+	const object = await store.get(t.bucket, t.key, range ? { range } : void 0);
+	if (!object) return new Response(null, { status: 404 });
+	const headers = metaHeaders({
+		etag: object.etag,
+		contentType: object.contentType,
+		contentLength: object.bytes.byteLength
+	});
+	if (!range) return new Response(object.bytes, {
+		status: 200,
+		headers
+	});
+	if (range.start >= object.size && object.size > 0) return new Response(null, {
+		status: 416,
+		headers: { "content-range": `bytes */${object.size}` }
+	});
+	const end = range.end === void 0 ? object.size - 1 : Math.min(range.end, object.size - 1);
+	headers.set("content-range", `bytes ${range.start}-${end}/${object.size}`);
+	return new Response(object.bytes, {
+		status: 206,
+		headers
+	});
+}
+async function handleHead(store, t) {
+	const meta = await store.head(t.bucket, t.key);
+	if (!meta) return new Response(null, { status: 404 });
+	return new Response(null, {
+		status: 200,
+		headers: metaHeaders({
+			etag: meta.etag,
+			contentType: meta.contentType,
+			contentLength: meta.size
+		})
+	});
+}
+async function handleDelete(store, t) {
+	await store.delete(t.bucket, t.key);
+	return new Response(null, { status: 204 });
+}
+function createS3Handler(opts) {
+	const { store, credentials } = opts;
+	return async (req) => {
+		if (!verifyRequest(req, credentials).ok) return new Response(null, { status: 403 });
+		const url = new URL(req.url);
+		const target = parseTarget(url);
+		if (!target) return new Response(null, { status: 400 });
+		if (req.method === "GET" && url.searchParams.get("list-type") === "2" && target.key === "") return handleList(store, target.bucket, url);
+		if (target.key === "") return new Response(null, { status: 400 });
+		switch (req.method) {
+			case "PUT": return handlePut(store, target, req);
+			case "GET": return handleGet(store, target, req);
+			case "HEAD": return handleHead(store, target);
+			case "DELETE": return handleDelete(store, target);
+			default: return new Response(null, { status: 405 });
+		}
+	};
+}
+//#endregion
+//#region ../../1-prisma-cloud/0-lowering/dev-emulators/dist/buckets-main.mjs
+/**
+* The bucket emulator daemon (local-dev spec § 2 `buckets-main.ts`): the S3
+* wire protocol (`@internal/s3-protocol`'s handler + `fsStore`) over
+* registered per-app, per-bucket directories, multi-tenant via physical
+* names `<app>--<name>`. Admin lives under `/_pcdev/` (the underscore can't
+* collide with a valid bucket name). Plain `node:http`.
+*
+* Runs as its own OS process, started by `daemon.ts`'s `ensureDaemon` via
+* `process.execPath <this file> --port <n> --state-dir <dir>`.
+*/
+const STATE_MODE = 384;
+const PHYSICAL_BUCKET_NAME_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+const MULTIPART_MESSAGE = "multipart upload is not supported by the local dev bucket emulator yet";
+function isBucketRegistration(value) {
+	return typeof value === "object" && value !== null && "app" in value && typeof value.app === "string" && "name" in value && typeof value.name === "string" && "dir" in value && typeof value.dir === "string";
+}
+function isCredentialRecord(value) {
+	return typeof value === "object" && value !== null && "app" in value && typeof value.app === "string" && "secretAccessKey" in value && typeof value.secretAccessKey === "string";
+}
+function isBucketsState(value) {
+	return typeof value === "object" && value !== null && "buckets" in value && typeof value.buckets === "object" && value.buckets !== null && Object.values(value.buckets).every(isBucketRegistration) && "credentials" in value && typeof value.credentials === "object" && value.credentials !== null && Object.values(value.credentials).every(isCredentialRecord);
+}
+function isBucketBody(value) {
+	return typeof value === "object" && value !== null && "dir" in value && typeof value.dir === "string";
+}
+function isCredentialsBody(value) {
+	return typeof value === "object" && value !== null && "accessKeyId" in value && typeof value.accessKeyId === "string" && "secretAccessKey" in value && typeof value.secretAccessKey === "string";
+}
+function parseArgs(argv) {
+	let port;
+	let stateDir;
+	for (let i = 0; i < argv.length; i++) if (argv[i] === "--port") port = Number(argv[i + 1]);
+	else if (argv[i] === "--state-dir") stateDir = argv[i + 1];
+	if (port === void 0 || Number.isNaN(port)) throw new Error("buckets-main: --port <n> is required");
+	if (stateDir === void 0) throw new Error("buckets-main: --state-dir <dir> is required");
+	return {
+		port,
+		stateDir
+	};
+}
+function readBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		req.on("data", (chunk) => chunks.push(chunk));
+		req.on("end", () => resolve(Buffer.concat(chunks)));
+		req.on("error", reject);
+	});
+}
+function toWebHeaders(nodeHeaders) {
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(nodeHeaders)) {
+		if (value === void 0) continue;
+		if (Array.isArray(value)) for (const v of value) headers.append(key, v);
+		else headers.set(key, value);
+	}
+	return headers;
+}
+async function sendWebResponse(res, webRes) {
+	const headers = {};
+	webRes.headers.forEach((value, key) => {
+		headers[key] = value;
+	});
+	const buf = Buffer.from(await webRes.arrayBuffer());
+	res.writeHead(webRes.status, headers);
+	res.end(buf);
+}
+function main() {
+	const { port, stateDir } = parseArgs(process.argv.slice(2));
+	const ownVersion = readOwnVersion();
+	const stateJsonPath = path.join(stateDir, "state.json");
+	const stateFile = new StateFile(stateJsonPath, STATE_MODE);
+	let state = {
+		buckets: {},
+		credentials: {}
+	};
+	function schedulePersist() {
+		stateFile.write(state);
+	}
+	const store = fsStore((physicalName) => state.buckets[physicalName]?.dir);
+	function json(res, status, body) {
+		res.writeHead(status, { "content-type": "application/json" });
+		res.end(JSON.stringify(body));
+	}
+	function text(res, status, body) {
+		res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+		res.end(body);
+	}
+	function badSegment(res, segment) {
+		text(res, 400, `invalid path segment "${segment}": must match /^[a-z0-9][a-z0-9-]*$/ and be at most 63 characters`);
+	}
+	async function handlePutBucket(req, res, app, name) {
+		const physicalName = `${app}--${name}`;
+		if (!PHYSICAL_BUCKET_NAME_RE.test(physicalName)) return text(res, 400, `invalid bucket "${physicalName}" (app "${app}", name "${name}"): the physical bucket name must match /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/ and be at most 63 characters`);
+		const raw = await readBody(req);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw.toString("utf8"));
+		} catch {
+			return text(res, 400, "malformed JSON body");
+		}
+		if (!isBucketBody(parsed)) return text(res, 400, "malformed bucket body: expected { \"dir\": string }");
+		await fs.promises.mkdir(parsed.dir, { recursive: true });
+		state.buckets[physicalName] = {
+			app,
+			name,
+			dir: parsed.dir
+		};
+		schedulePersist();
+		res.writeHead(204);
+		res.end();
+	}
+	async function handlePutCredentials(req, res, app) {
+		const raw = await readBody(req);
+		let parsed;
+		try {
+			parsed = JSON.parse(raw.toString("utf8"));
+		} catch {
+			return text(res, 400, "malformed JSON body");
+		}
+		if (!isCredentialsBody(parsed)) return text(res, 400, "malformed credentials body: expected { \"accessKeyId\", \"secretAccessKey\" }");
+		const existing = state.credentials[parsed.accessKeyId];
+		if (existing && existing.app !== app) return text(res, 409, `accessKeyId "${parsed.accessKeyId}" is already registered by a different app`);
+		state.credentials[parsed.accessKeyId] = {
+			app,
+			secretAccessKey: parsed.secretAccessKey
+		};
+		schedulePersist();
+		res.writeHead(204);
+		res.end();
+	}
+	function handleDeleteApp(res, app) {
+		for (const [key, reg] of Object.entries(state.buckets)) if (reg.app === app) delete state.buckets[key];
+		for (const [key, cred] of Object.entries(state.credentials)) if (cred.app === app) delete state.credentials[key];
+		schedulePersist();
+		res.writeHead(204);
+		res.end();
+	}
+	/** Path-style addressing: the bucket is the first non-empty path segment. Mirrors the handler's own `parseTarget`, which isn't exported. */
+	function bucketFromPath(pathname) {
+		const first = pathname.split("/").find((s) => s.length > 0);
+		return first !== void 0 ? decodeURIComponent(first) : void 0;
+	}
+	/**
+	* Credentials accepted for THIS request's target bucket only — its
+	* owning app, derived from the bucket's registration (the authoritative
+	* source for the `<app>--<name>` split; unregistered apps/names may
+	* themselves contain `--`, so the registration is trusted over re-parsing
+	* the string). An unknown bucket or an app with no registered credentials
+	* yields no candidates, which still resolves through the real 403 path
+	* below — never a bespoke "unknown bucket" shortcut that would reveal
+	* anything.
+	*/
+	function credentialsForBucket(bucket) {
+		const owningApp = bucket !== void 0 ? state.buckets[bucket]?.app : void 0;
+		if (owningApp === void 0) return [];
+		return Object.entries(state.credentials).filter(([, rec]) => rec.app === owningApp).map(([accessKeyId, rec]) => ({
+			accessKeyId,
+			secretAccessKey: rec.secretAccessKey
+		}));
+	}
+	async function handleS3Wire(req, res, url) {
+		if (url.searchParams.has("uploads") || url.searchParams.has("uploadId") || url.searchParams.has("partNumber")) return text(res, 501, MULTIPART_MESSAGE);
+		const method = req.method ?? "GET";
+		const bodyBuf = method !== "GET" && method !== "HEAD" ? await readBody(req) : void 0;
+		const fullUrl = `http://${req.headers.host ?? `127.0.0.1:${String(port)}`}${req.url ?? "/"}`;
+		const headers = toWebHeaders(req.headers);
+		const candidates = credentialsForBucket(bucketFromPath(url.pathname));
+		if (candidates.length === 0) candidates.push({
+			accessKeyId: "",
+			secretAccessKey: ""
+		});
+		let last;
+		for (const credentials of candidates) {
+			const webReq = new Request(fullUrl, {
+				method,
+				headers,
+				...bodyBuf && bodyBuf.length > 0 ? { body: bodyBuf } : {}
+			});
+			const webRes = await createS3Handler({
+				store,
+				credentials
+			})(webReq);
+			if (webRes.status !== 403) return sendWebResponse(res, webRes);
+			last = webRes;
+		}
+		if (last) await sendWebResponse(res, last);
+	}
+	async function handleRequest(req, res) {
+		const url = new URL(req.url ?? "/", `http://127.0.0.1:${String(port)}`);
+		const method = req.method ?? "GET";
+		if (method === "GET" && url.pathname === "/health") return json(res, 200, { version: ownVersion });
+		if (url.pathname === "/_pcdev/health" || url.pathname.startsWith("/_pcdev/")) {
+			const segments = url.pathname.split("/").filter((s) => s.length > 0).map((s) => decodeURIComponent(s));
+			if (method === "GET" && segments.length === 2 && segments[1] === "health") return json(res, 200, { version: ownVersion });
+			if (segments[1] === "apps" && segments.length >= 3) {
+				const app = segments[2];
+				if (app === void 0 || !isValidSegment(app)) return badSegment(res, app ?? "");
+				if (method === "PUT" && segments.length === 5 && segments[3] === "buckets") {
+					const name = segments[4];
+					if (name === void 0 || !isValidSegment(name)) return badSegment(res, name ?? "");
+					return handlePutBucket(req, res, app, name);
+				}
+				if (method === "PUT" && segments.length === 4 && segments[3] === "credentials") return handlePutCredentials(req, res, app);
+				if (method === "DELETE" && segments.length === 3) return handleDeleteApp(res, app);
+			}
+			res.writeHead(404);
+			res.end();
+			return;
+		}
+		return handleS3Wire(req, res, url);
+	}
+	const server = http.createServer((req, res) => {
+		handleRequest(req, res).catch((err) => {
+			if (!res.headersSent) res.writeHead(500, { "content-type": "text/plain" });
+			res.end(err instanceof Error ? err.message : String(err));
+		});
+	});
+	async function shutdown() {
+		await stateFile.flush();
+		server.close();
+		process.exit(0);
+	}
+	process.on("SIGTERM", () => void shutdown());
+	process.on("SIGINT", () => void shutdown());
+	readJsonFile(stateJsonPath, isBucketsState).then((loaded) => {
+		if (loaded) state = loaded;
+		server.listen(port, "127.0.0.1", () => {
+			console.log(`[dev-emulators] buckets-main listening on 127.0.0.1:${String(port)}`);
+		});
+	}).catch((err) => {
+		console.error("buckets-main: failed to load state", err);
+		process.exit(1);
+	});
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=buckets-main.mjs.map