@stowage/adapter-s3 0.1.0 → 0.2.0

package/README.md

@@ -11,8 +11,9 @@ npm install @stowage/adapter-s3
 
 ## Example
 
-A server signs a URL for one upload of the type and length the browser reported. The browser then
-calls it with a plain `fetch` and `PUT`, against AWS S3 or R2 alike.
+A server signs a URL for one upload of the type and length the browser reported. `presignPut`
+resolves with the URL and the `headers` the upload sends beside the body, here `content-type`. The
+browser then calls it with a plain `fetch`, `PUT` and those `headers`, against AWS S3 or R2 alike.
 
 ```ts
 import { fromEnv, s3Storage } from "@stowage/adapter-s3";
@@ -34,40 +35,43 @@ const r2 = s3Storage({
 });
 
 for (const storage of [aws, r2]) {
-  const url = await storage.presignPut("avatars/alice.png", {
+  const { url, headers } = await storage.presignPut("avatars/alice.png", {
     expiresIn: 300,
     contentType: "image/png",
     contentLength: 48_213,
   });
 
-  console.log(url);
+  console.log(url, headers);
 }
 ```
 
 The bucket has to allow `UNSIGNED-PAYLOAD` and carry a CORS rule for the uploading origin; stowage
 configures neither
-([flow 2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#flow-2-browser-upload-through-a-presigned-put)).
+([flow 2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#flow-2-browser-upload-through-a-presigned-put)).
 
 ## Runtimes
 
-Node 24 and later, Bun, Deno and `workerd` at the compatibility date `2026-09-01`. `fromEnv` reads
+Node 24 and later, Bun, Deno and `workerd` at the compatibility date `2026-09-01` without Node APIs. `fromEnv` reads
 the environment on `workerd` under `nodejs_compat` and on Deno under `--allow-env`. CI last ran green on Bun 1.4.2 and Deno 2.9.6.
 
-The bundle measures 13.4 kB minified and gzipped, `@stowage/core` included.
+The bundle measures 13.9 kB minified and gzipped, `@stowage/core` included.
 
 ## Limits
 
 - `keyBytesPreserved` is not declared
-  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#49-capabilities)).
+  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#49-capabilities)).
   R2 normalizes a key to NFC, so two Unicode-equivalent keys name one object there and two on AWS
   S3.
+- `delete` sends at most one `DeleteObjects` per 1000 keys, plus at most one `DELETE` per key
+  holding `U+FFFE` or `U+FFFF`, which XML carries neither raw nor as a reference
+  ([spec 7.1](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#71-construction)).
 - Where AWS S3 and R2 answer differently, the adapter is written to the stricter side
-  ([spec 7.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#72-promised-providers)):
+  ([spec 7.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#72-promised-providers)):
 
 | Point                              | What holds                                                                                                               |
 | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
 | Listing order                      | None. A page holds at most 1000 keys                                                                                     |
-| `userMetadata`                     | 2 KB of encoded header bytes; ASCII keys                                                                                 |
+| `userMetadata`                     | 2 KB of encoded header bytes; keys handed back in lower case                                                             |
 | Single `PUT`                       | Up to 5 GB for a `Uint8Array` or string; a stream that fills more than one part goes as a multipart upload               |
 | Object size ceiling                | The provider's, answered with `EntityTooLarge`                                                                           |
 | `Content-Type`                     | Always sent by `put`, `application/octet-stream` where none was given                                                    |
@@ -80,7 +84,7 @@ The bundle measures 13.4 kB minified and gzipped, `@stowage/core` included.
 ## Notes
 
 No package takes a connection URL
-([spec 7.3](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#73-credentials)).
+([spec 7.3](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#73-credentials)).
 A caller holding one splits it into the four options. `credentials: fromEnv` keeps the secret out of
 the URL; one that stays in it has to be percent-encoded, because a `/` in the secret makes
 `new URL` throw.
@@ -109,7 +113,7 @@ export function s3StorageFromUrl(connection: string): S3Storage {
 ```
 
 `put` takes no `Blob`. A caller holding one passes its stream
-([spec 4.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#42-bodies)):
+([spec 4.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#42-bodies)):
 
 ```ts
 import { fromEnv, s3Storage } from "@stowage/adapter-s3";
@@ -121,7 +125,7 @@ await storage.put("reports/2026/q3.csv", blob.stream(), { contentType: blob.type
 ```
 
 stowage reports no progress, no upload id and no resume
-([spec 7.6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#76-uploads)).
+([spec 7.6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#76-uploads)).
 A caller who wants progress counts the bytes on their way into `put`:
 
 ```ts
@@ -152,10 +156,10 @@ await storage.put("videos/intro.mp4", response.body.pipeThrough(countBytes(conso
 
 ## Specification
 
-[`docs/spec.md` at `@stowage/adapter-s3@0.1.0`](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/docs/spec.md#7-stowageadapter-s3)
+[`docs/spec.md` at `@stowage/adapter-s3@0.2.0`](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/docs/spec.md#7-stowageadapter-s3)
 is the contract: a caller may rely on what it states and on nothing else this package happens to
-export. The [terms it uses](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.1.0/CONTEXT.md)
-and the [decisions behind it](https://github.com/stowage-js/stowage/tree/@stowage/adapter-s3@0.1.0/docs/adr)
+export. The [terms it uses](https://github.com/stowage-js/stowage/blob/@stowage/adapter-s3@0.2.0/CONTEXT.md)
+and the [decisions behind it](https://github.com/stowage-js/stowage/tree/@stowage/adapter-s3@0.2.0/docs/adr)
 are at the same tag.
 
 ## License

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Resolvable, ResolverOptions, Storage } from "@stowage/core";
+import { DeleteReport, PresignedPut, Resolvable, ResolverOptions, Storage } from "@stowage/core";
 //#region src/credentials.d.ts
 /**
  * Checked before signing: `accessKeyId` and `secretAccessKey` are non-empty strings, and no
@@ -76,6 +76,12 @@ interface S3PresignPutOptions {
 //#region src/index.d.ts
 export interface S3Storage extends Storage {
   readonly provider: "s3";
+  /**
+   * Sends at most one `DeleteObjects` per 1000 keys, plus at most one `DELETE` per key
+   * holding `U+FFFE` or `U+FFFF`, which XML carries neither raw nor as a reference. Those
+   * go after the batches, one after another.
+   */
+  delete(...keys: readonly string[]): Promise<DeleteReport>;
   /**
    * A URL a client holding no credential calls with a plain `GET` for this one key until
    * it expires. Whoever holds it may read the object: it is a bearer token. Sends no
@@ -87,9 +93,10 @@ export interface S3Storage extends Storage {
    * key until it expires. `contentType` and `contentLength` bind exactly: the provider
    * refuses a body of another type or another length, so a body of unknown length cannot
    * be uploaded through it. It signs `UNSIGNED-PAYLOAD` and no checksum, so the upload
-   * carries no integrity check. Sends no request.
+   * carries no integrity check. Resolves with the URL and the `content-type` the `PUT`
+   * sends beside the body. Sends no request.
    */
-  presignPut(key: string, options: S3PresignPutOptions): Promise<string>;
+  presignPut(key: string, options: S3PresignPutOptions): Promise<PresignedPut>;
 }
 export declare function s3Storage(options: S3AdapterOptions): S3Storage;
 //#endregion

package/dist/index.js

@@ -1,4 +1,4 @@
-import { StorageError, errorCodeForStatus, invalidKeyReason, isStorageError, isTransientStatus, withRetry } from "@stowage/core";
+import { StorageError, XmlSyntaxError, checkUserMetadata, decodeUserMetadataValue, encodeUserMetadataValue, errorCodeForStatus, invalidKeyReason, isStorageError, isTransientStatus, parseXml, rangeBoundsRefusal, rangeCoversWhole, rangeHeader, rangeStartRefusal, readEnvironment, uploadStream, wholeSizeOf, withRetry } from "@stowage/core";
 //#region src/storage-error.ts
 function s3Error(bucket, fields) {
 	return new StorageError({
@@ -267,7 +267,7 @@ const permanentRedirect = 301;
 const badRequest = 400;
 /** The longest key AWS S3 and R2 hold, in UTF-8 bytes, above which they answer `KeyTooLongError`. */
 const longestHeldKey = 1024;
-const utf8$5 = new TextEncoder();
+const utf8$4 = new TextEncoder();
 /**
 * What the provider's answer means, decided by its own code where the table recognizes
 * one and by the status where it does not. The message is the provider's word for word
@@ -280,7 +280,7 @@ function readProviderFailure(answer) {
 		code: "InvalidOption",
 		message: `The option \`region\` is not the bucket's${answer.bucketRegion === void 0 ? "" : `, which is \`${answer.bucketRegion}\``}: ${said}`
 	};
-	if (answer.method === "HEAD" && answer.status === badRequest && answer.key !== void 0 && utf8$5.encode(answer.key).byteLength > longestHeldKey) return {
+	if (answer.method === "HEAD" && answer.status === badRequest && answer.key !== void 0 && utf8$4.encode(answer.key).byteLength > longestHeldKey) return {
 		code: "InvalidKey",
 		message: `The key is longer than the ${longestHeldKey} bytes the provider holds: ${said}`
 	};
@@ -319,196 +319,6 @@ function readEmbeddedFailure(providerCode, providerMessage) {
 	};
 }
 //#endregion
-//#region src/xml.ts
-/** A document outside the subset ADR 0003 reads, reported rather than read around. */
-var XmlSyntaxError = class extends Error {
-	name = "XmlSyntaxError";
-};
-/**
-* The root element of an XML document of the subset S3 answers a listing with: elements,
-* attributes, text and comments under one optional declaration.
-*/
-function parseXml(document) {
-	const scanner = new Scanner(document);
-	scanner.skipDeclaration();
-	scanner.skipMisc();
-	const root = scanner.readElement();
-	scanner.skipMisc();
-	scanner.requireEnd();
-	return root;
-}
-const namePattern = /[:A-Z_a-z\u00C0-\uFFFF][:A-Z_a-z\u00C0-\uFFFF.\d-]*/uy;
-const whitespacePattern = /[ \t\r\n]*/y;
-const entityPattern = /&(?:#x([\da-fA-F]+)|#(\d+)|([A-Za-z]\w*));/uy;
-/** `Char` of XML 1.0, section 2.2: what a character reference may name. */
-function isXmlCharacter(codePoint) {
-	return codePoint === 9 || codePoint === 10 || codePoint === 13 || codePoint >= 32 && codePoint <= 55295 || codePoint >= 57344 && codePoint <= 65533 || codePoint >= 65536 && codePoint <= 1114111;
-}
-/** The five entities XML defines without a DTD, which is every one a document here has. */
-const predefinedEntities = /* @__PURE__ */ new Map([
-	["amp", "&"],
-	["lt", "<"],
-	["gt", ">"],
-	["quot", "\""],
-	["apos", "'"]
-]);
-const xmlEscapes = {
-	"&": "&amp;",
-	"<": "&lt;",
-	">": "&gt;",
-	"\"": "&quot;",
-	"'": "&apos;"
-};
-/** Text as it stands inside an element of a request document stowage writes. */
-function escapeXml(text) {
-	return text.replaceAll(/[&<>"']/gu, (character) => xmlEscapes[character] ?? character);
-}
-var Scanner = class {
-	#document;
-	#position = 0;
-	constructor(document) {
-		this.#document = document;
-	}
-	skipDeclaration() {
-		if (!this.#startsWith("<?xml")) return;
-		this.#position = this.#positionPast("?>", "The XML declaration is never closed");
-	}
-	/** Whitespace and comments, which are all that may stand beside the root element. */
-	skipMisc() {
-		for (;;) {
-			this.#skipWhitespace();
-			if (this.#startsWith("<!DOCTYPE")) throw this.#error("A DTD is refused");
-			if (!this.#startsWith("<!--")) return;
-			this.#skipComment();
-		}
-	}
-	requireEnd() {
-		if (this.#position < this.#document.length) throw this.#error("Something follows the root element");
-	}
-	readElement() {
-		this.#expect("<");
-		const name = this.#readName();
-		if (this.#readStartTagEnd() === "empty") return {
-			name,
-			children: [],
-			text: ""
-		};
-		const children = [];
-		let text = "";
-		for (;;) {
-			if (this.#position >= this.#document.length) throw this.#error(`The element <${name}> is never closed`);
-			if (this.#startsWith("</")) {
-				this.#position += 2;
-				this.#closeElement(name);
-				return {
-					name,
-					children,
-					text
-				};
-			}
-			if (this.#startsWith("<!--")) this.#skipComment();
-			else if (this.#startsWith("<![CDATA[")) throw this.#error("A CDATA section is refused");
-			else if (this.#startsWith("<")) children.push(this.readElement());
-			else text += this.#readText();
-		}
-	}
-	#closeElement(name) {
-		const closing = this.#readName();
-		if (closing !== name) throw this.#error(`The element <${name}> is closed by </${closing}>`);
-		this.#skipWhitespace();
-		this.#expect(">");
-	}
-	#readStartTagEnd() {
-		for (;;) {
-			const before = this.#position;
-			this.#skipWhitespace();
-			if (this.#startsWith("/>")) {
-				this.#position += 2;
-				return "empty";
-			}
-			if (this.#startsWith(">")) {
-				this.#position += 1;
-				return "open";
-			}
-			if (this.#position === before) throw this.#error("An attribute follows no whitespace");
-			this.#readName();
-			this.#skipWhitespace();
-			this.#expect("=");
-			this.#skipWhitespace();
-			this.#skipQuoted();
-		}
-	}
-	#skipQuoted() {
-		const quote = this.#document[this.#position];
-		if (quote !== "\"" && quote !== "'") throw this.#error("An attribute value is not quoted");
-		this.#position = this.#positionPast(quote, "An attribute value is never closed", 1);
-	}
-	/** Text up to the next markup, every `&` in it the start of an entity it decodes. */
-	#readText() {
-		const markup = this.#document.indexOf("<", this.#position);
-		const end = markup === -1 ? this.#document.length : markup;
-		let text = "";
-		while (this.#position < end) {
-			const ampersand = this.#document.indexOf("&", this.#position);
-			if (ampersand === -1 || ampersand >= end) {
-				text += this.#document.slice(this.#position, end);
-				this.#position = end;
-				break;
-			}
-			text += this.#document.slice(this.#position, ampersand);
-			this.#position = ampersand;
-			text += this.#readEntity();
-		}
-		return text;
-	}
-	#readEntity() {
-		entityPattern.lastIndex = this.#position;
-		const found = entityPattern.exec(this.#document);
-		if (found === null) throw this.#error("An `&` starts no entity");
-		const [entity, hex, decimal, name] = found;
-		if (name !== void 0) {
-			const character = predefinedEntities.get(name);
-			if (character === void 0) throw this.#error(`The entity ${entity} is not defined`);
-			this.#position = entityPattern.lastIndex;
-			return character;
-		}
-		const codePoint = hex === void 0 ? Number(decimal) : Number.parseInt(hex, 16);
-		if (!isXmlCharacter(codePoint)) throw this.#error(`The reference ${entity} names no character XML carries`);
-		this.#position = entityPattern.lastIndex;
-		return String.fromCodePoint(codePoint);
-	}
-	#skipComment() {
-		this.#position = this.#positionPast("-->", "A comment is never closed", 4);
-	}
-	#readName() {
-		namePattern.lastIndex = this.#position;
-		const found = namePattern.exec(this.#document);
-		if (found === null) throw this.#error("A name is missing where one belongs");
-		this.#position = namePattern.lastIndex;
-		return found[0];
-	}
-	#skipWhitespace() {
-		whitespacePattern.lastIndex = this.#position;
-		whitespacePattern.exec(this.#document);
-		this.#position = whitespacePattern.lastIndex;
-	}
-	#expect(literal) {
-		if (!this.#startsWith(literal)) throw this.#error(`\`${literal}\` is missing`);
-		this.#position += literal.length;
-	}
-	#positionPast(terminator, unterminated, offset = 0) {
-		const end = this.#document.indexOf(terminator, this.#position + offset);
-		if (end === -1) throw this.#error(unterminated);
-		return end + terminator.length;
-	}
-	#startsWith(literal) {
-		return this.#document.startsWith(literal, this.#position);
-	}
-	#error(message) {
-		return new XmlSyntaxError(`${message} (at character ${this.#position})`);
-	}
-};
-//#endregion
 //#region src/answer-document.ts
 /**
 * The root of the document a `200` carries, read through the parser of spec 7.4. S3 may
@@ -629,36 +439,24 @@ function compareFields(one, other) {
 //#region src/range.ts
 /** Refuses bounds the spec does not allow, before any request goes out (spec 4.3). */
 function requireRange(bucket, range) {
-	if (range === void 0) return;
-	const { start, end } = range;
-	if (!isOffset(start) || end !== void 0 && (!isOffset(end) || end < start)) throw optionError$1(bucket, "range", "takes two whole numbers from zero up, `start` at most `end`", "get");
-}
-/** The `Range` field of RFC 9110, both ends inclusive as `ByteRange` is. */
-function rangeHeader(range) {
-	return `bytes=${range.start}-${range.end ?? ""}`;
-}
-const contentRange = /^bytes (\d+)-(\d+)\/(\d+)$/u;
-/**
-* The size of the whole object out of a `206`'s `Content-Range`, which is what spec 4.4
-* has a ranged `get` report rather than the length of the range.
-*/
-function wholeSizeOf(response) {
-	const found = contentRange.exec(response.headers.get("content-range")?.trim() ?? "");
-	const size = Number(found?.[3]);
-	return Number.isSafeInteger(size) ? size : void 0;
+	const refusal = rangeBoundsRefusal(range);
+	if (refusal !== void 0) throw s3Error(bucket, {
+		...refusal,
+		operation: "get",
+		attempts: 0
+	});
 }
 /**
 * A provider that answers a ranged `GET` with `200` sent the whole object instead, which
-* RFC 9110 allows. Where the range covers the object, clipped as spec 4.3 clips it, that
-* is the body asked for. For an object the range starts beyond, which is how S3 answers a
-* range on an empty object, it is the refusal spec 4.3 names; for any other it is a body
-* the caller did not ask for.
+* RFC 9110 allows. Where the range covers the object, that is the body asked for. For an
+* object the range starts beyond, which is how S3 answers a range on an empty object, it is
+* the refusal spec 4.3 names; for any other it is a body the caller did not ask for.
 */
 function wholeAnswerFailure(bucket, key, range, size) {
-	if (range.start === 0 && size > 0 && (range.end === void 0 || range.end >= size - 1)) return;
-	if (range.start >= size) return s3Error(bucket, {
-		code: "InvalidRequest",
-		message: `The range starts beyond the ${size} bytes under the key ${JSON.stringify(key)}`,
+	if (rangeCoversWhole(range, size)) return void 0;
+	const refusal = rangeStartRefusal(range, size, key);
+	if (refusal !== void 0) return s3Error(bucket, {
+		...refusal,
 		operation: "get",
 		key,
 		attempts: 1
@@ -671,53 +469,26 @@ function wholeAnswerFailure(bucket, key, range, size) {
 		attempts: 1
 	});
 }
-function isOffset(value) {
-	return Number.isInteger(value) && value >= 0;
-}
 //#endregion
 //#region src/user-metadata.ts
 const headerPrefix = "x-amz-meta-";
-/** Spec 4.3 bounds the set at 2 KB of the header bytes it costs once it is encoded. */
-const headerByteLimit = 2048;
-/** The characters RFC 9110 allows in a field name, which is what a user metadata key is. */
-const httpToken = /^[!#$%&'*+.^_`|~\dA-Za-z-]+$/u;
-/**
-* What survives a header field as it stands: printable ASCII with no space at either end,
-* which HTTP trims, and no `=?`, which the reader would take for the start of an encoded
-* word.
-*/
-const travelsAsWritten = /^(?:[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?)?$/u;
-const encodedWordStart = "=?UTF-8?B?";
-const encodedWordEnd = "?=";
 /**
-* RFC 2047 bounds an encoded word at 75 characters; 45 bytes are 60 characters of base64,
-* which leaves room for the 12 the word's frame costs.
+* The header fields `userMetadata` travels in, refused before the request is signed in the
+* order of spec 4.3, which reads the refusals off what the storage declares. A key outside
+* ASCII is refused rather than sent, because R2 strips it on the way out and a write would
+* lose it silently (ADR 0014).
 */
-const bytesPerEncodedWord = 45;
-const utf8$4 = new TextEncoder();
-/**
-* The header fields `userMetadata` travels in, refused with `InvalidRequest` before the
-* request is signed where a key is no ASCII HTTP token or the whole set is above 2 KB of
-* encoded header bytes (spec 4.3). A key outside ASCII is refused rather than sent,
-* because R2 strips it on the way out and a write would lose it silently (ADR 0014).
-*/
-function userMetadataHeaders(bucket, userMetadata, key) {
-	const headers = [];
-	const held = Object.create(null);
-	let headerBytes = 0;
-	for (const [name, value] of Object.entries(userMetadata ?? {})) {
-		if (!httpToken.test(name)) throw refusal$1(bucket, `The user metadata key ${JSON.stringify(name)} is no ASCII HTTP token`, key);
-		const folded = name.toLowerCase();
-		if (folded in held) throw refusal$1(bucket, `The user metadata key ${JSON.stringify(folded)} is given more than once`, key);
-		const encoded = encodeValue(value);
-		held[folded] = value;
-		headers.push([`${headerPrefix}${folded}`, encoded]);
-		headerBytes += folded.length + encoded.length;
-	}
-	if (headerBytes > headerByteLimit) throw refusal$1(bucket, `The user metadata is ${headerBytes} encoded header bytes, above the limit of ${headerByteLimit}`, key);
+function userMetadataHeaders(bucket, userMetadata, key, capabilities) {
+	const check = checkUserMetadata(userMetadata, capabilities);
+	if ("refusal" in check) throw s3Error(bucket, {
+		...check.refusal,
+		operation: "put",
+		key,
+		attempts: 0
+	});
 	return {
-		headers,
-		held: Object.freeze(held)
+		headers: Object.entries(check.held).map(([name, value]) => [`${headerPrefix}${name}`, encodeUserMetadataValue(value)]),
+		held: check.held
 	};
 }
 /**
@@ -729,87 +500,10 @@ function readUserMetadata(headers) {
 	const held = Object.create(null);
 	for (const [name, value] of headers) {
 		if (!name.startsWith(headerPrefix)) continue;
-		held[name.slice(11)] = decodeValue(value);
+		held[name.slice(11)] = decodeUserMetadataValue(value);
 	}
 	return Object.freeze(held);
 }
-function encodeValue(value) {
-	if (travelsAsWritten.test(value) && !value.includes("=?")) return value;
-	return utf8PiecesOf(value).map((piece) => `${encodedWordStart}${btoa(String.fromCharCode(...piece))}${encodedWordEnd}`).join(" ");
-}
-/** The UTF-8 bytes in pieces of at most one encoded word, each ending on a character. */
-function utf8PiecesOf(value) {
-	const pieces = [];
-	let pending = [];
-	for (const character of value) {
-		const bytes = utf8$4.encode(character);
-		if (pending.length + bytes.length > bytesPerEncodedWord) {
-			pieces.push(Uint8Array.from(pending));
-			pending = [];
-		}
-		pending.push(...bytes);
-	}
-	pieces.push(Uint8Array.from(pending));
-	return pieces;
-}
-const encodedWord = /=\?([^?\s]+)\?([BbQq])\?([^?\s]*)\?=/gu;
-const whitespaceOnly = /^[ \t]+$/u;
-const hexPair = /^[\dA-Fa-f]{2}$/u;
-function decodeValue(value) {
-	let decoded = "";
-	let last = 0;
-	let previousWasEncoded = false;
-	for (const match of value.matchAll(encodedWord)) {
-		const between = value.slice(last, match.index);
-		const word = decodeWord(match[1] ?? "", match[2] ?? "", match[3] ?? "");
-		if (!(previousWasEncoded && word !== void 0 && whitespaceOnly.test(between))) decoded += between;
-		decoded += word ?? match[0];
-		previousWasEncoded = word !== void 0;
-		last = match.index + match[0].length;
-	}
-	return decoded + value.slice(last);
-}
-/** The text of one encoded word, or `undefined` where it names what cannot be read. */
-function decodeWord(charset, encoding, text) {
-	const bytes = encoding.toUpperCase() === "B" ? base64Bytes(text) : quotedBytes(text);
-	if (bytes === void 0) return void 0;
-	try {
-		return new TextDecoder(charset, { fatal: true }).decode(bytes);
-	} catch {
-		return;
-	}
-}
-function base64Bytes(text) {
-	try {
-		return Uint8Array.from(atob(text), (character) => character.charCodeAt(0));
-	} catch {
-		return;
-	}
-}
-/** The `Q` encoding: `_` is a space and `=XX` one byte in hex. */
-function quotedBytes(text) {
-	const bytes = [];
-	for (let index = 0; index < text.length; index += 1) {
-		const character = text[index];
-		if (character === "_") bytes.push(32);
-		else if (character === "=") {
-			const pair = text.slice(index + 1, index + 3);
-			if (!hexPair.test(pair)) return void 0;
-			bytes.push(Number.parseInt(pair, 16));
-			index += 2;
-		} else bytes.push(text.charCodeAt(index));
-	}
-	return Uint8Array.from(bytes);
-}
-function refusal$1(bucket, message, key) {
-	return s3Error(bucket, {
-		code: "InvalidRequest",
-		message,
-		operation: "put",
-		key,
-		attempts: 0
-	});
-}
 //#endregion
 //#region src/description.ts
 const defaultContentType = "application/octet-stream";
@@ -853,7 +547,7 @@ function unquotedEtag(etag) {
 }
 function sizeOf$1(bucket, key, operation, response) {
 	if (response.status === 206) {
-		const size = wholeSizeOf(response);
+		const size = wholeSizeOf(response.headers.get("content-range"));
 		if (size === void 0) throw incomplete(bucket, key, operation, "no size of the whole object");
 		return size;
 	}
@@ -916,21 +610,6 @@ function fromEnv(_options) {
 	};
 }
 /**
-* ADR 0007: `process.env` is the one route through Node, Bun, Deno's compatibility layer
-* and a Worker under `nodejs_compat`. A Worker without it has no `process` at all, and
-* Deno without `--allow-env` throws `NotCapable` rather than answering `undefined`, so
-* both leave the value empty. The three names are read one at a time, because
-* enumerating `process.env` needs the unscoped permission in Deno.
-*/
-function readEnvironment(name) {
-	try {
-		if (typeof process === "undefined") return "";
-		return process?.env?.[name] ?? "";
-	} catch {
-		return "";
-	}
-}
-/**
 * Spec 7.3: both required fields are non-empty strings and every key of the resolved
 * object is one of the three, checked before signing rather than a round trip later.
 */
@@ -957,6 +636,30 @@ function refusal(message) {
 	});
 }
 //#endregion
+//#region src/xml.ts
+/**
+* The five entities XML defines without a DTD. The core's parser keeps its table to itself,
+* and `readErrorDocument` decodes a failure's message without the parser.
+*/
+const predefinedEntities = /* @__PURE__ */ new Map([
+	["amp", "&"],
+	["lt", "<"],
+	["gt", ">"],
+	["quot", "\""],
+	["apos", "'"]
+]);
+const xmlEscapes = {
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&apos;"
+};
+/** Text as it stands inside an element of a request document stowage writes. */
+function escapeXml(text) {
+	return text.replaceAll(/[&<>"']/gu, (character) => xmlEscapes[character] ?? character);
+}
+//#endregion
 //#region src/error-document.ts
 /**
 * The `Code` and `Message` a provider answers a failed request with. The parser spec 7.4
@@ -1359,7 +1062,9 @@ function decodeCursor(cursor) {
 	}
 	if (!decoded.startsWith(cursorTag)) return void 0;
 	const position = decoded.slice(13);
-	return position.length > 0 && hexPosition.test(position) ? tokenOf(position) : void 0;
+	if (position.length === 0 || !hexPosition.test(position)) return void 0;
+	const token = tokenOf(position);
+	return token.isWellFormed() ? token : void 0;
 }
 function hexOf(token) {
 	const units = [];
@@ -1382,16 +1087,33 @@ function tokenOf(position) {
 function readListingDocument(answer, body) {
 	const root = parse(answer, body);
 	if (root.name !== "ListBucketResult") throw malformed(answer, `a <${root.name}> where a <ListBucketResult> belongs`);
+	const readName = nameReader(answer, textOf$1(root, "EncodingType"));
 	return {
-		objects: childrenNamed(root, "Contents").map((entry) => readEntry(answer, entry)),
+		objects: childrenNamed(root, "Contents").map((entry) => readEntry(answer, entry, readName)),
 		prefixes: childrenNamed(root, "CommonPrefixes").map((prefix) => {
 			const text = textOf$1(prefix, "Prefix");
 			if (text === void 0 || text === "") throw malformed(answer, "a pseudo-directory with no prefix");
-			return text;
+			return readName(text);
 		}),
 		continuationToken: continuationOf(answer, root)
 	};
 }
+/**
+* Spec 7.4: under `EncodingType` `url` a key and a prefix arrive as percent-encoded UTF-8,
+* a space in them possibly as `+`, which S3 never sends for a `+` of the key itself. The
+* continuation token and the elements the answer echoes are not names this reads.
+*/
+function nameReader(answer, encodingType) {
+	if (encodingType !== "url") return (text) => text;
+	return (text) => {
+		try {
+			return decodeURIComponent(text.replaceAll("+", " "));
+		} catch (failure) {
+			if (!(failure instanceof URIError)) throw failure;
+			throw malformed(answer, `the name ${JSON.stringify(text)}, which does not decode`, failure);
+		}
+	};
+}
 function parse(answer, body) {
 	try {
 		return parseXml(body);
@@ -1400,9 +1122,10 @@ function parse(answer, body) {
 		throw failure;
 	}
 }
-function readEntry(answer, entry) {
-	const key = textOf$1(entry, "Key");
-	if (key === void 0 || key === "") throw malformed(answer, "an object with no key");
+function readEntry(answer, entry, readName) {
+	const text = textOf$1(entry, "Key");
+	if (text === void 0 || text === "") throw malformed(answer, "an object with no key");
+	const key = readName(text);
 	const size = sizeOf(textOf$1(entry, "Size"));
 	if (size === void 0) throw malformed(answer, `the object under ${JSON.stringify(key)} with no size`);
 	const lastModified = Date.parse(textOf$1(entry, "LastModified") ?? "");
@@ -1516,7 +1239,11 @@ function readListRequest(bucket, options) {
 }
 async function requestPage(configuration, request) {
 	request.signal?.throwIfAborted();
-	const query = [["list-type", "2"], ["max-keys", String(request.pageSize)]];
+	const query = [
+		["list-type", "2"],
+		["max-keys", String(request.pageSize)],
+		["encoding-type", "url"]
+	];
 	if (request.prefix !== "") query.push(["prefix", request.prefix]);
 	if (request.delimiter !== void 0) query.push(["delimiter", request.delimiter]);
 	if (request.continuationToken !== void 0) query.push(["continuation-token", request.continuationToken]);
@@ -1696,24 +1423,56 @@ function compress(state, words, offset) {
 }
 //#endregion
 //#region src/delete.ts
-/** What one `DeleteObjects` names at most, and so what spec 4.1 sends one request per. */
+/** What one `DeleteObjects` names at most, and so what spec 7.1 sends one request per. */
 const keysPerRequest = 1e3;
+/**
+* The characters of a key XML 1.0 carries neither raw nor as a reference, which is what
+* is left of those outside its `Char` once spec 4.8 refused the controls (ADR 0027).
+*/
+const outsideXmlChar = /[\uFFFE\uFFFF]/u;
+/**
+* Spec 4.7 rejects the call for a failure that says nothing about the key: no response, a
+* credential the provider refuses, a bucket that is absent or lives in another region. A
+* missing key answers `204`, so `NotFound` names the bucket. What remains is what
+* `DeleteObjects` reports per key, `AccessDenied` among it.
+*/
+const requestWideCodes = /* @__PURE__ */ new Set([
+	"NetworkError",
+	"InvalidCredentials",
+	"Expired",
+	"NotFound",
+	"InvalidOption"
+]);
+/**
+* Spec 7.9 files a skewed clock under `InvalidRequest`, which otherwise concerns what one
+* request asked for, and every request after it would be signed against the same clock.
+*/
+const requestWideProviderCodes = /* @__PURE__ */ new Set(["RequestTimeTooSkewed"]);
+function failsTheRequestAsAWhole(failure) {
+	return requestWideCodes.has(failure.code) || failure.providerCode !== void 0 && requestWideProviderCodes.has(failure.providerCode);
+}
 const utf8$2 = new TextEncoder();
 /**
 * Spec 4.7: every key is reported, the invalid ones as `InvalidKey` without being sent,
 * and a failure of a request as a whole rejects the call instead of filling the report.
 */
-async function deleteKeys(configuration, keys, batch) {
+async function deleteKeys(configuration, keys, call) {
 	const failed = [];
-	const sendable = [];
+	const batched = [];
+	const alone = [];
 	for (const key of keys) {
-		const refusal = refusalOf(configuration.bucket, key, batch.operation);
-		if (refusal === void 0) sendable.push(key);
-		else failed.push(refusal);
+		const refusal = keyError(configuration.bucket, key, "addressable", call.operation);
+		if (refusal !== void 0) failed.push(refusal);
+		else if (outsideXmlChar.test(key)) alone.push(key);
+		else batched.push(key);
+	}
+	for (let offset = 0; offset < batched.length; offset += keysPerRequest) {
+		const slice = batched.slice(offset, offset + keysPerRequest);
+		failed.push(...await deleteBatch(configuration, slice, call));
 	}
-	for (let offset = 0; offset < sendable.length; offset += keysPerRequest) {
-		const slice = sendable.slice(offset, offset + keysPerRequest);
-		failed.push(...await deleteBatch(configuration, slice, batch));
+	for (const key of alone) {
+		const failure = await deleteAlone(configuration, key, call);
+		if (failure !== void 0) failed.push(failure);
 	}
 	return {
 		requested: keys.length,
@@ -1746,38 +1505,45 @@ async function deleteBelow(configuration, prefix, signal) {
 		failed
 	};
 }
-function refusalOf(bucket, key, operation) {
-	const invalid = keyError(bucket, key, "addressable", operation);
-	if (invalid !== void 0) return invalid;
-	if (key.isWellFormed()) return void 0;
-	return s3Error(bucket, {
-		code: "InvalidKey",
-		message: `The key ${JSON.stringify(key)} holds a lone surrogate, which has no UTF-8 form`,
-		operation,
-		key,
-		attempts: 0
-	});
-}
-async function deleteBatch(configuration, keys, batch) {
+async function deleteBatch(configuration, keys, call) {
 	if (keys.length === 0) return [];
-	batch.signal?.throwIfAborted();
+	call.signal?.throwIfAborted();
 	const body = utf8$2.encode(deleteDocument(keys));
 	const response = await send(configuration, {
 		method: "POST",
-		operation: batch.operation,
+		operation: call.operation,
 		query: [["delete", ""]],
 		headers: [["content-type", "application/xml"], ["content-md5", md5Base64(body)]],
 		body,
-		signal: batch.signal
+		signal: call.signal
 	});
 	const requestId = response.headers.get("x-amz-request-id") ?? void 0;
 	const answered = {
 		bucket: configuration.bucket,
-		operation: batch.operation,
+		operation: call.operation,
 		subject: "the deletion"
 	};
 	return (await readAnswerDocument(answered, response, "DeleteResult")).children.filter((child) => child.name === "Error").map((entry) => keyFailure(answered, entry, requestId));
 }
+/**
+* Spec 7.4: a key no `DeleteObjects` body can carry travels percent-encoded in the path,
+* where no XML parser at the provider sees it, on the budget of a request of its own.
+*/
+async function deleteAlone(configuration, key, call) {
+	call.signal?.throwIfAborted();
+	try {
+		await (await send(configuration, {
+			method: "DELETE",
+			operation: call.operation,
+			key,
+			signal: call.signal
+		})).body?.cancel();
+		return;
+	} catch (failure) {
+		if (isStorageError(failure) && !failsTheRequestAsAWhole(failure)) return failure;
+		throw failure;
+	}
+}
 /** `Quiet` has the provider answer with the keys it failed alone. */
 function deleteDocument(keys) {
 	return `<?xml version="1.0" encoding="UTF-8"?><Delete><Quiet>true</Quiet>${keys.map((key) => `<Object><Key>${escapeXml(key)}</Key></Object>`).join("")}</Delete>`;
@@ -1839,7 +1605,8 @@ async function presignGet(configuration, key, options) {
 * Spec 7.10: `PutObject` on a writable key, with the content type and the content length
 * bound through signed headers. Nothing else is signed in: no user metadata and no
 * checksum, which the browser would have to match exactly for a `403` that names nothing
-* (ADR 0011).
+* (ADR 0011). Of the two, only the content type is handed back to send beside the body
+* (spec 4.13).
 */
 async function presignPut(configuration, key, options) {
 	const operation = "presignPut";
@@ -1848,14 +1615,17 @@ async function presignPut(configuration, key, options) {
 	const expiresIn = readExpiresIn(configuration.bucket, given.expiresIn, operation);
 	const contentType = readText(configuration.bucket, given.contentType, "contentType", operation);
 	const contentLength = readContentLength(configuration.bucket, given.contentLength, operation);
-	return await presignedUrl(configuration, {
-		method: "PUT",
-		operation,
-		key,
-		query: [],
-		headers: [["content-type", contentType], ["content-length", contentLength]],
-		expiresIn
-	});
+	return {
+		url: await presignedUrl(configuration, {
+			method: "PUT",
+			operation,
+			key,
+			query: [],
+			headers: [["content-type", contentType], ["content-length", contentLength]],
+			expiresIn
+		}),
+		headers: { "content-type": contentType }
+	};
 }
 /**
 * Spec 7.10: nothing is sent, so the one failure left after the options is the
@@ -2003,95 +1773,6 @@ function reportingFailure(body, asStorageError) {
 	});
 }
 //#endregion
-//#region src/part-reader.ts
-/** Where a buffer starts before the stream has shown whether it fills a part. */
-const initialCapacity = 65536;
-/**
-* A stream read into parts of one size (spec 7.6). A part is known to be the last only
-* once the stream has ended behind it, so a full part looks one chunk ahead; that chunk
-* is the stream's own and becomes the start of the next part.
-*
-* A part handed back through `recycle` lends its buffer to a later one. Spec 7.6 bounds
-* an upload at `partSize × concurrency` of buffers, and a fresh buffer per part would
-* keep the settled ones alive until the collector noticed them.
-*
-* Until a part has filled, the buffer grows by doubling, because ADR 0009 has a body
-* shorter than a part allocate only what it needs. Once one has, the stream is known to
-* go as a multipart upload, and every buffer after it starts at the full part size.
-*/
-var PartReader = class {
-	#reader;
-	#partSize;
-	#signal;
-	#cancelOnAbort = () => {
-		this.#reader.cancel(this.#signal?.reason).catch(() => {});
-	};
-	#free = [];
-	#ahead;
-	#filledOnce = false;
-	constructor(stream, partSize, signal) {
-		this.#reader = stream.getReader();
-		this.#partSize = partSize;
-		this.#signal = signal;
-		signal?.addEventListener("abort", this.#cancelOnAbort, { once: true });
-	}
-	async next() {
-		let bytes = this.#freshBuffer();
-		let filled = 0;
-		while (filled < this.#partSize) {
-			const chunk = this.#ahead ?? await this.#read();
-			this.#ahead = void 0;
-			if (chunk === void 0) return {
-				bytes: bytes.subarray(0, filled),
-				last: true
-			};
-			const taken = Math.min(chunk.byteLength, this.#partSize - filled);
-			if (filled + taken > bytes.byteLength) bytes = this.#grown(bytes, filled + taken);
-			bytes.set(chunk.subarray(0, taken), filled);
-			filled += taken;
-			if (taken < chunk.byteLength) this.#ahead = chunk.subarray(taken);
-		}
-		this.#filledOnce = true;
-		this.#ahead ??= await this.#read();
-		return {
-			bytes,
-			last: this.#ahead === void 0
-		};
-	}
-	/** The part's request settled, so nothing reads its bytes any more. */
-	recycle(part) {
-		if (part.bytes.buffer.byteLength === this.#partSize) this.#free.push(part.bytes.buffer);
-	}
-	/** Spec 4.2 leaves the stream canceled where `put` rejects before reading it to its end. */
-	async cancel(reason) {
-		await this.#reader.cancel(reason).catch(() => {});
-	}
-	release() {
-		this.#signal?.removeEventListener("abort", this.#cancelOnAbort);
-		this.#reader.releaseLock();
-	}
-	#freshBuffer() {
-		const pooled = this.#free.pop();
-		if (pooled !== void 0) return new Uint8Array(pooled);
-		return new Uint8Array(this.#filledOnce ? this.#partSize : Math.min(this.#partSize, initialCapacity));
-	}
-	#grown(bytes, needed) {
-		let capacity = bytes.byteLength;
-		while (capacity < needed) capacity *= 2;
-		const larger = new Uint8Array(Math.min(capacity, this.#partSize));
-		larger.set(bytes);
-		return larger;
-	}
-	async #read() {
-		for (;;) {
-			const { done, value } = await this.#reader.read();
-			this.#signal?.throwIfAborted();
-			if (done) return void 0;
-			if (value.byteLength > 0) return value;
-		}
-	}
-};
-//#endregion
 //#region src/upload.ts
 /** The object's own headers, which a multipart upload sends with the request that starts it. */
 function objectHeaders(write) {
@@ -2114,18 +1795,19 @@ async function putObject(configuration, write, bytes) {
 * Spec 7.6: a stream is read into parts of `partSize`, and one that ends within the first
 * goes as the `PUT` held bytes get.
 */
-async function uploadStream(configuration, write, stream) {
-	const parts = new PartReader(stream, configuration.partSize, write.signal);
-	try {
-		const first = await parts.next();
-		if (first.last) return await putObject(configuration, write, first.bytes);
-		return await multipartUpload(configuration, write, parts, first);
-	} catch (failure) {
-		await parts.cancel(failure);
-		throw failure;
-	} finally {
-		parts.release();
-	}
+async function putStream(configuration, write, stream) {
+	return await uploadStream(stream, {
+		partSize: configuration.partSize,
+		concurrency: configuration.concurrency,
+		maxParts,
+		bucket: configuration.bucket,
+		provider: "s3",
+		key: write.key,
+		signal: write.signal
+	}, {
+		whole: async (bytes) => await putObject(configuration, write, bytes),
+		multipart: async (sendParts) => await multipartUpload(configuration, write, sendParts)
+	});
 }
 const s3Namespace = "http://s3.amazonaws.com/doc/2006-03-01/";
 /** The provider's limit on both sides, which ADR 0016 leaves no option to lift. */
@@ -2134,71 +1816,25 @@ const maxParts = 1e4;
 * Spec 7.6: a multipart upload aborts itself once it failed, after the parts in flight
 * and the source stream were canceled.
 */
-async function multipartUpload(configuration, write, parts, first) {
+async function multipartUpload(configuration, write, sendParts) {
 	const uploadId = await createUpload(configuration, write);
 	let sent;
 	try {
-		sent = await sendParts(configuration, write, uploadId, parts, first);
+		sent = await sendParts(async (index, bytes, signal) => {
+			const number = index + 1;
+			return {
+				number,
+				etag: await uploadPart(configuration, {
+					...write,
+					signal
+				}, uploadId, number, bytes)
+			};
+		});
 	} catch (failure) {
-		await parts.cancel(failure);
 		await abortUpload(configuration, write, uploadId);
 		throw failure;
 	}
-	return await completeUpload(configuration, write, uploadId, sent);
-}
-/**
-* Spec 7.6: `concurrency` parts in flight, and the next part read only once one of them
-* settled, so the part buffers never outnumber the parts in flight. The first failure
-* stops the parts still in flight, and is what the upload rejects with once they settled.
-*/
-async function sendParts(configuration, write, uploadId, parts, first) {
-	const stop = new AbortController();
-	const partWrite = {
-		...write,
-		signal: write.signal === void 0 ? stop.signal : AbortSignal.any([write.signal, stop.signal])
-	};
-	const inFlight = /* @__PURE__ */ new Set();
-	const uploaded = [];
-	let failure;
-	let size = 0;
-	const fail = (reason) => {
-		failure ??= { reason };
-		stop.abort();
-		parts.cancel(reason);
-	};
-	const sendPart = async (number, part) => {
-		try {
-			const etag = await uploadPart(configuration, partWrite, uploadId, number, part);
-			uploaded.push({
-				number,
-				etag
-			});
-		} catch (reason) {
-			fail(reason);
-		} finally {
-			parts.recycle(part);
-		}
-	};
-	try {
-		for (let number = 1, part = first; !stop.signal.aborted; number += 1) {
-			if (number === maxParts && !part.last) throw tooManyParts(configuration, write);
-			const sending = sendPart(number, part);
-			inFlight.add(sending);
-			sending.finally(() => inFlight.delete(sending));
-			size += part.bytes.byteLength;
-			if (part.last) break;
-			while (inFlight.size >= configuration.concurrency) await Promise.race(inFlight);
-			part = await parts.next();
-		}
-	} catch (reason) {
-		fail(reason);
-	}
-	await Promise.all(inFlight);
-	if (failure !== void 0) throw failure.reason;
-	return {
-		uploaded: uploaded.toSorted((one, other) => one.number - other.number),
-		size
-	};
+	return await completeUpload(configuration, write, uploadId, sent.results, sent.size);
 }
 async function createUpload(configuration, write) {
 	const response = await send(configuration, {
@@ -2214,13 +1850,13 @@ async function createUpload(configuration, write) {
 	if (uploadId === void 0 || uploadId === "") throw incompleteAnswer(configuration, write, response, subject, "no upload id");
 	return uploadId;
 }
-async function uploadPart(configuration, write, uploadId, number, part) {
+async function uploadPart(configuration, write, uploadId, number, bytes) {
 	const response = await send(configuration, {
 		method: "PUT",
 		operation: "put",
 		key: write.key,
 		query: [["partNumber", String(number)], ["uploadId", uploadId]],
-		body: part.bytes,
+		body: bytes,
 		signal: write.signal
 	});
 	await response.body?.cancel();
@@ -2228,7 +1864,7 @@ async function uploadPart(configuration, write, uploadId, number, part) {
 	if (etag === null || etag === "") throw incompleteAnswer(configuration, write, response, `part ${number}`, "no entity tag");
 	return etag;
 }
-async function completeUpload(configuration, write, uploadId, { uploaded, size }) {
+async function completeUpload(configuration, write, uploadId, uploaded, size) {
 	let response;
 	let document;
 	try {
@@ -2289,19 +1925,6 @@ function answeredRequest(configuration, write, subject) {
 		subject
 	};
 }
-/**
-* Spec 7.6: known once the last part the provider takes is full and the stream goes on.
-* ADR 0016 fixes the part size before the first part, so the way past it is a larger one.
-*/
-function tooManyParts(configuration, write) {
-	return s3Error(configuration.bucket, {
-		code: "InvalidRequest",
-		message: `The stream needs more than ${maxParts} parts of the configured \`partSize\` of ${configuration.partSize} bytes; a larger \`multipart.partSize\` carries it`,
-		operation: "put",
-		key: write.key,
-		attempts: 0
-	});
-}
 function incompleteAnswer(configuration, write, response, subject, missing) {
 	return s3Error(configuration.bucket, {
 		code: "ProviderError",
@@ -2322,7 +1945,8 @@ function s3Storage(options) {
 const s3Capabilities = Object.freeze([
 	"presignedUrls",
 	"rangeReads",
-	"userMetadata"
+	"userMetadata",
+	"userMetadataTokenKeys"
 ]);
 const utf8 = new TextEncoder();
 var SimpleStorageServiceStorage = class {
@@ -2347,12 +1971,12 @@ var SimpleStorageServiceStorage = class {
 		requireKnownOptions(this.bucket, options, putOptionKeys, "put");
 		const write = {
 			key,
-			userMetadata: userMetadataHeaders(this.bucket, options?.userMetadata, key),
+			userMetadata: userMetadataHeaders(this.bucket, options?.userMetadata, key, this.capabilities),
 			contentType: this.#readContentType(options?.contentType),
 			signal: options?.signal
 		};
 		options?.signal?.throwIfAborted();
-		if (isStream(body)) return await uploadStream(this.#configuration, write, body);
+		if (isStream(body)) return await putStream(this.#configuration, write, body);
 		return await putObject(this.#configuration, write, bytesOf(body));
 	}
 	async get(key, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stowage/adapter-s3",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "stowage adapter for one bucket of AWS S3 or Cloudflare R2, speaking the S3 wire protocol without an SDK.",
   "keywords": [
     "adapter",
@@ -35,7 +35,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@stowage/core": "^0.1.0"
+    "@stowage/core": "^0.2.0"
   },
   "engines": {
     "node": ">=24"