@ultimat3/storage 30.8.0 → 31.0.0

package/src/driver-local.ts

@@ -25,12 +25,14 @@ import {
   type StorageListEntry,
   type StorageObject,
   type StorageRead,
+  type StreamOptions,
   sha256Base64,
   signedByteBound,
   toBytes,
 } from './driver';
 import { listLocalPage } from './driver-local-list';
 import { localPartStore } from './driver-local-multipart';
+import { streamPinned } from './driver-local-open';
 import {
   etagOfFile,
   headObject,
@@ -60,7 +62,8 @@ import {
   ObjectLockedError,
   requestedLock,
 } from './object-lock';
-import { assertSafeKey } from './path';
+import { assertLocalKey, assertSafeKey } from './path';
+
 import { assertPutStream, type PutStreamOptions } from './put-stream';
 import {
   assertGetOptions,
@@ -70,6 +73,11 @@ import {
   servedRange,
   streamedRange,
 } from './range';
+import {
+  assertWithinRequestCeiling,
+  type RequestCeiling,
+  screenRequestCeiling,
+} from './request-ceiling';
 import type { SignedUrlVerification } from './signed-url';
 import { buildSignedUrl, signedUrlBaseFor, verifySignedUrl } from './signed-url';
 import { resolveSigningSecret } from './signing-secret';
@@ -77,6 +85,9 @@ import { DEFAULT_MAX_UPLOAD_BYTES } from './upload';
 
 const DRIVER_NAME = 'local';
 
+/** Every key this disk touches: the shared rule, then Windows' own (`assertLocalKey`). */
+const safeKey = (key: string): string => assertLocalKey(assertSafeKey(key));
+
 export interface LocalDriverOptions {
   /** Directory the disk owns outright. Created on first write. */
   readonly root: string;
@@ -112,6 +123,14 @@ export interface LocalDriverOptions {
    * is the uploader's, not this process's. Defaults to `maxPutBytes`; past it, `stream()`.
    */
   readonly maxGetBytes?: number | undefined;
+  /**
+   * The most ONE request to this server carries — the app's `http.maxRequestBodyBytes`, which this
+   * package cannot import. A signed PUT lands on this process, so a single-request grant past it is
+   * refused at signing (`X_STORAGE_TOO_LARGE`, naming `grantMultipart`). Unset, nothing is refused
+   * here and the route's own `X_BODY_TOO_LARGE` answers the upload. A function is read at each
+   * signing: the CLI's disk is built before the app's `configureHttp` runs.
+   */
+  readonly maxRequestBytes?: RequestCeiling | undefined;
   /**
    * The per-key queue every read and write of this disk waits in. Defaults to the disk's own
    * `keyedQueue()`; a test passes one it also holds, to park a key deterministically.
@@ -136,6 +155,7 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
     1,
   );
   const clock = options.clock ?? systemClock;
+  const maxRequestBytes = screenRequestCeiling('local', options.maxRequestBytes);
   const oneAtATime = options.queue ?? keyedQueue();
   // What `defineStorage` registered this driver as — the name a refusal's `disk('…')` must use.
   let registered = DRIVER_NAME;
@@ -189,7 +209,7 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
       },
 
       async put(key: string, body: StorageBody, putOptions?: PutOptions): Promise<StorageObject> {
-        const safe = assertSafeKey(key);
+        const safe = safeKey(key);
         refuseUnsupportedPut(putOptions);
         assertPutOptions(DRIVER_NAME, putOptions);
         assertObjectLockOptions(DRIVER_NAME, putOptions, clock);
@@ -233,7 +253,7 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
         body: ReadableStream<Uint8Array>,
         streamOptions: PutStreamOptions,
       ): Promise<StorageObject> {
-        const safe = assertSafeKey(key);
+        const safe = safeKey(key);
         const maxBytes = assertPutStream(DRIVER_NAME, body, streamOptions);
         const input = { root, key: safe, disk: registered, body, maxBytes, clock };
         return putLocalStream(input, streamOptions, (then) =>
@@ -245,12 +265,12 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
       },
 
       async stat(key: string): Promise<StorageObject | undefined> {
-        const entry = await measured(assertSafeKey(key));
+        const entry = await measured(safeKey(key));
         return entry && { ...entry, contentType: entry.contentType ?? DEFAULT_CONTENT_TYPE };
       },
 
       async get(key: string, getOptions?: GetOptions): Promise<StorageRead> {
-        const safe = assertSafeKey(key);
+        const safe = safeKey(key);
         assertGetOptions(DRIVER_NAME, getOptions);
         const range = getOptions?.range;
         // Queued behind this key's writers: an object is two files, and a read between a put()'s
@@ -281,16 +301,26 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
         });
       },
 
-      async stream(key: string): Promise<ReadableStream<Uint8Array>> {
-        const safe = assertSafeKey(key);
+      async stream(key: string, options?: StreamOptions): Promise<ReadableStream<Uint8Array>> {
+        const safe = safeKey(key);
+        const etag = options?.etag;
+        if (etag !== undefined) return streamPinned({ root, key: safe, disk: registered, etag });
         const file = Bun.file(filePath(safe));
         if (!(await file.exists())) throw objectNotFound(registered, safe);
         return file.stream();
       },
 
-      async streamRange(key: string, range: ByteRange): Promise<ReadableStream<Uint8Array>> {
-        const safe = assertSafeKey(key);
+      async streamRange(
+        key: string,
+        range: ByteRange,
+        options?: StreamOptions,
+      ): Promise<ReadableStream<Uint8Array>> {
+        const safe = safeKey(key);
         assertStreamRange(DRIVER_NAME, range);
+        const etag = options?.etag;
+        if (etag !== undefined) {
+          return streamPinned({ root, key: safe, disk: registered, etag, range });
+        }
         const file = Bun.file(filePath(safe));
         if (!(await file.exists())) throw objectNotFound(registered, safe);
         const [first, last] = streamedRange(DRIVER_NAME, safe, range, file.size);
@@ -299,8 +329,8 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
 
       /** A real file copy — `Bun.write` from a `BunFile` never routes the bytes through the heap. */
       async copy(from: string, to: string, options?: CopyOptions): Promise<StorageObject> {
-        const source = assertSafeKey(from);
-        const destination = assertSafeKey(to);
+        const source = safeKey(from);
+        const destination = safeKey(to);
         // Measured AND read in one turn on both keys. Measured in the source's turn and read in the
         // destination's, a put() of the source in between committed its NEW bytes under the OLD
         // etag and type — a pair no marker flags, so every later `get()` of the copy trusted it.
@@ -338,7 +368,7 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
       },
 
       async delete(key: string): Promise<void> {
-        const safe = assertSafeKey(key);
+        const safe = safeKey(key);
         // Idempotent by contract: a missing key is already in the desired state. A REFUSED unlink
         // is not — a read-only mount or a root this process cannot write reports the bytes gone
         // when they are still on disk, which is the one lie an erasure sweep must never repeat.
@@ -360,12 +390,12 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
       },
 
       async exists(key: string): Promise<boolean> {
-        return Bun.file(filePath(assertSafeKey(key))).exists();
+        return Bun.file(filePath(safeKey(key))).exists();
       },
 
       /** From the sidecar, as recorded — a lapsed retention is still reported, as S3 reports it. */
       async retentionOf(key: string): Promise<ObjectLock> {
-        const safe = assertSafeKey(key);
+        const safe = safeKey(key);
         return oneAtATime(safe, async () => {
           if (!(await Bun.file(filePath(safe)).exists())) throw objectNotFound(registered, safe);
           return lockOfSidecar(await readSidecar(root, safe));
@@ -384,12 +414,14 @@ export function localDriver(options: LocalDriverOptions): StorageDriver {
       },
 
       async signedUrl(key: string, urlOptions?: SignedUrlOptions): Promise<string> {
+        const bound = signedByteBound(DRIVER_NAME, urlOptions);
+        assertWithinRequestCeiling(DRIVER_NAME, maxRequestBytes(), { ...urlOptions, bound });
         return buildSignedUrl({
           secret,
-          key: assertSafeKey(key),
+          key: safeKey(key),
           method: urlOptions?.method,
           expiresInMs: urlOptions?.expiresInMs,
-          maxBytes: signedByteBound(DRIVER_NAME, urlOptions),
+          maxBytes: bound,
           contentType: urlOptions?.contentType,
           part: urlOptions?.part,
           baseUrl,

package/src/driver-memory.ts

@@ -31,6 +31,7 @@ import {
   type StorageListEntry,
   type StorageObject,
   type StorageRead,
+  type StreamOptions,
   sha256Base64,
   signedByteBound,
   toBytes,
@@ -40,6 +41,7 @@ import { keyInTheWay } from './driver-memory-conflict';
 import { memoryPartStore } from './driver-memory-multipart';
 import { checksumMismatch, getTooLarge, keyConflict, objectNotFound, putFailed } from './errors';
 import { objectChanged } from './errors-promote';
+import { revisionChanged } from './errors-stream';
 import { withStagedMultipart } from './multipart-staged';
 import {
   assertObjectLockOptions,
@@ -58,6 +60,7 @@ import {
   servedRange,
   streamedRange,
 } from './range';
+import { assertWithinRequestCeiling, screenRequestCeiling } from './request-ceiling';
 import type { SignedUrlVerification } from './signed-url';
 import { buildSignedUrl, signedUrlBaseFor, verifySignedUrl } from './signed-url';
 import { resolveSigningSecret } from './signing-secret';
@@ -110,6 +113,7 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
     1,
   );
   const clock = options.clock ?? systemClock;
+  const maxRequestBytes = screenRequestCeiling(DRIVER_NAME, options.maxRequestBytes);
   let baseUrl = options.baseUrl ?? signedUrlBaseFor(DRIVER_NAME);
   const secret = resolveSigningSecret(DRIVER_NAME, options);
   const stored = new Map<string, Stored>();
@@ -136,8 +140,16 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
     if (blocking !== undefined) throw keyConflict(registered, key, blocking);
   };
 
-  /** Both writes end here, with no await between the checks and the write. */
-  const commit = (safe: string, bytes: Uint8Array, putOptions?: PutOptions): StorageObject => {
+  /**
+   * Both writes end here, with no await between the checks and the write. `owned` is a buffer this
+   * disk built itself (`putStream`'s one concatenation), kept as is rather than copied a third time.
+   */
+  const commit = (
+    safe: string,
+    bytes: Uint8Array,
+    putOptions?: PutOptions,
+    owned = false,
+  ): StorageObject => {
     const object: StorageObject = {
       key: safe,
       size: bytes.byteLength,
@@ -152,7 +164,7 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
     refuseOverwrite(safe, 'overwrite');
     // A copy in, as a file write is: the caller's buffer and metadata are the caller's to reuse.
     stored.set(safe, {
-      bytes: bytes.slice(),
+      bytes: owned ? bytes : bytes.slice(),
       object: snapshot(object),
       lock: requestedLock(putOptions),
     });
@@ -164,6 +176,14 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
     if (hit === undefined) throw objectNotFound(registered, key);
     return hit;
   };
+  /** `found`, held to the revision a streamed read was pinned to. */
+  const pinned = (key: string, options: StreamOptions | undefined): Stored => {
+    const hit = found(key);
+    const etag = options?.etag;
+    if (etag !== undefined && hit.object.etag !== etag)
+      throw revisionChanged(registered, key, etag);
+    return hit;
+  };
 
   return withStagedMultipart(
     {
@@ -230,7 +250,10 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
             'await disk.putStream(key, stream, { maxBytes })   # with a fresh stream',
           );
         });
-        return commit(safe, new Uint8Array(Bun.concatArrayBuffers(chunks)), streamOptions);
+        // The chunks are dropped once concatenated: one copy of the body, owned by the map.
+        const bytes = new Uint8Array(Bun.concatArrayBuffers(chunks));
+        chunks.length = 0;
+        return commit(safe, bytes, streamOptions, true);
       },
 
       async stat(key: string): Promise<StorageObject | undefined> {
@@ -255,15 +278,20 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
         return { object: snapshot(hit.object), bytes: hit.bytes.slice() };
       },
 
-      async stream(key: string): Promise<ReadableStream<Uint8Array>> {
-        const hit = found(assertSafeKey(key));
+      async stream(key: string, options?: StreamOptions): Promise<ReadableStream<Uint8Array>> {
+        const safe = assertSafeKey(key);
+        const hit = pinned(safe, options);
         return new Blob([hit.bytes.slice()]).stream();
       },
 
-      async streamRange(key: string, range: ByteRange): Promise<ReadableStream<Uint8Array>> {
+      async streamRange(
+        key: string,
+        range: ByteRange,
+        options?: StreamOptions,
+      ): Promise<ReadableStream<Uint8Array>> {
         const safe = assertSafeKey(key);
         assertStreamRange(DRIVER_NAME, range);
-        const hit = found(safe);
+        const hit = pinned(safe, options);
         const [first, last] = streamedRange(DRIVER_NAME, safe, range, hit.bytes.byteLength);
         return new Blob([hit.bytes.slice(first, last + 1)]).stream();
       },
@@ -323,12 +351,14 @@ export function memoryStorageDriver(options: MemoryStorageDriverOptions = {}): M
       },
 
       async signedUrl(key: string, urlOptions?: SignedUrlOptions): Promise<string> {
+        const bound = signedByteBound(DRIVER_NAME, urlOptions);
+        assertWithinRequestCeiling(DRIVER_NAME, maxRequestBytes(), { ...urlOptions, bound });
         return buildSignedUrl({
           secret,
           key: assertSafeKey(key),
           method: urlOptions?.method,
           expiresInMs: urlOptions?.expiresInMs,
-          maxBytes: signedByteBound(DRIVER_NAME, urlOptions),
+          maxBytes: bound,
           contentType: urlOptions?.contentType,
           part: urlOptions?.part,
           baseUrl,

package/src/driver-s3-copy-parts.ts

@@ -0,0 +1,177 @@
+// Single responsibility: an s3 copy past CopyObject's 5 GiB ceiling — a signed HEAD for the
+// source's own headers and revision, CreateMultipartUpload carrying those headers, UploadPartCopy
+// over byte ranges all pinned to that one revision, then Complete. Every exit but a landed Complete
+// aborts the upload, so a failed copy leaves no parts billing.
+
+import { copySourceOf, MAX_COPY_OBJECT_BYTES, signedCopy } from './driver-s3-copy';
+import {
+  abortS3Upload,
+  completeS3Upload,
+  createS3Upload,
+  type S3UploadTarget,
+  xmlText,
+} from './driver-s3-multipart';
+import {
+  isAnswered,
+  multipartEtagOf,
+  type S3Stat,
+  sentObject,
+  settleComplete,
+} from './driver-s3-settle';
+import { type S3Refusal, type S3WireOptions, sendSigned, xmlField } from './driver-s3-signed';
+
+/** The smallest part a large copy cuts: 512 MiB, so 5 TiB (S3's object ceiling) fits 10,000. */
+export const COPY_PART_BYTES = 512 * 1024 ** 2;
+const MAX_PARTS = 10_000;
+/** UploadPartCopy is server-side, so this bounds requests in flight, never bytes held. */
+const COPY_CONCURRENCY = 4;
+
+/** The headers CopyObject's COPY directive carries, which a multipart Create must restate. */
+const CARRIED = [
+  'content-type',
+  'cache-control',
+  'content-disposition',
+  'content-encoding',
+  'content-language',
+  'expires',
+] as const;
+
+export interface S3PartCopy {
+  readonly source: string;
+  /** The caller's revision; absent, the HEAD's own etag pins every part to one revision. */
+  readonly ifMatch?: string | undefined;
+  /** The disk's HEAD, asked only when the Complete's answer was lost. */
+  readonly stat: S3Stat;
+  /** Injected in tests; production cuts `COPY_PART_BYTES` or `size / 10,000`, the larger. */
+  readonly partBytes?: number | undefined;
+}
+
+/** The part size: the floor, grown only when 10,000 of it cannot hold the object. */
+export const copyPartBytes = (size: number, floor = COPY_PART_BYTES): number =>
+  Math.max(floor, Math.ceil(size / MAX_PARTS));
+
+/** Copy `source` onto `target.key` in parts. A refusal goes to `target.refused`, never bare. */
+export async function copyS3InParts(target: S3UploadTarget, copy: S3PartCopy): Promise<void> {
+  const { wire, refused } = target;
+  const head = await sendSigned(wire, {
+    method: 'HEAD',
+    key: copy.source,
+    headers: copy.ifMatch === undefined ? {} : { 'if-match': copy.ifMatch },
+  });
+  if (!head.ok) return refused(head.refusal);
+  const answer = head.response.headers;
+  const size = Number(answer.get('content-length') ?? Number.NaN);
+  if (!Number.isSafeInteger(size) || size < 0) {
+    return refused({
+      name: 'S3Error',
+      code: 'UnreadableAnswer',
+      message: 'the HEAD before a multipart copy carried no Content-Length',
+      statusCode: 200,
+    });
+  }
+  const etag = answer.get('etag') ?? copy.ifMatch;
+  const headers: Record<string, string> = {};
+  answer.forEach((value, name) => {
+    const lower = name.toLowerCase();
+    if (lower.startsWith('x-amz-meta-') || (CARRIED as readonly string[]).includes(lower)) {
+      headers[lower] = value;
+    }
+  });
+  const uploadId = await createS3Upload(target, headers);
+  const step = copyPartBytes(size, copy.partBytes);
+  const count = Math.max(1, Math.ceil(size / step));
+  const etags: string[] = new Array(count);
+  // Set by the first refused part: its siblings take no new range, and every one in flight settles
+  // before the abort — a part landing after it would bill against an upload nobody can see.
+  let stopped = false;
+  let next = 0;
+  const worker = async (): Promise<void> => {
+    for (let index = next++; index < count && !stopped; index = next++) {
+      const first = index * step;
+      const last = Math.min(size, first + step) - 1;
+      try {
+        etags[index] = await copyPart(target, uploadId, index + 1, {
+          'x-amz-copy-source': copySourceOf(wire, copy.source),
+          'x-amz-copy-source-range': `bytes=${first}-${last}`,
+          ...(etag === undefined ? {} : { 'x-amz-copy-source-if-match': etag }),
+        });
+      } catch (error) {
+        stopped = true;
+        throw error;
+      }
+    }
+  };
+  let settled = false;
+  try {
+    const workers = await Promise.allSettled(
+      Array.from({ length: Math.min(COPY_CONCURRENCY, count) }, worker),
+    );
+    const failed = workers.find((outcome) => outcome.status === 'rejected');
+    if (failed !== undefined) throw failed.reason;
+    const parts = etags.map((partEtag, index) => ({ partNumber: index + 1, etag: partEtag }));
+    await completeS3Upload(target, uploadId, parts).catch(async (lost: unknown) => {
+      if (isAnswered(lost)) throw lost;
+      // The answer was lost, not refused: the copy may have landed. Settled — abort included — by
+      // the disk's stat, exactly as a streamed put's lost Complete is.
+      settled = true;
+      const sent = sentObject(size, multipartEtagOf(etags), {
+        contentType: headers['content-type'],
+        cacheControl: headers['cache-control'],
+        metadata: Object.keys(headers).some((name) => name.startsWith('x-amz-meta-'))
+          ? {}
+          : undefined,
+      });
+      await settleComplete(copy.stat, { ...target, driver: 's3' }, uploadId, sent, lost);
+    });
+  } catch (error) {
+    if (!settled) await abortS3Upload(target, uploadId).catch(() => undefined);
+    throw error;
+  }
+}
+
+/** One UploadPartCopy, answering its etag — read off the body, where S3 puts it for a copy. */
+async function copyPart(
+  { wire, key, refused }: S3UploadTarget,
+  uploadId: string,
+  partNumber: number,
+  headers: Readonly<Record<string, string>>,
+): Promise<string> {
+  const result = await sendSigned(wire, {
+    method: 'PUT',
+    key,
+    query: { partNumber: String(partNumber), uploadId },
+    headers,
+  });
+  if (!result.ok) return refused(result.refusal);
+  const body = await result.response.text();
+  const etag = xmlField(body, 'ETag');
+  if (body.includes('<Error>') || etag === undefined) {
+    return refused({
+      name: 'S3Error',
+      code: xmlField(body, 'Code') ?? 'UnreadableAnswer',
+      message: xmlField(body, 'Message') ?? 'UploadPartCopy answered with no ETag',
+      statusCode: 200,
+    });
+  }
+  return xmlText(etag);
+}
+
+/** One copy, either way: CopyObject up to its 5 GiB ceiling, parts past it. Refusals to `refused`. */
+export async function copyS3(
+  wire: S3WireOptions,
+  copy: {
+    readonly source: string;
+    readonly destination: string;
+    readonly ifMatch: string | undefined;
+    readonly size: number;
+    readonly stat: S3Stat;
+  },
+  refused: (refusal: S3Refusal) => never,
+): Promise<void> {
+  if (copy.size > MAX_COPY_OBJECT_BYTES) {
+    const target = { wire, key: copy.destination, refused };
+    return copyS3InParts(target, { source: copy.source, ifMatch: copy.ifMatch, stat: copy.stat });
+  }
+  const refusal = await signedCopy(wire, copy.source, copy.destination, copy.ifMatch);
+  if (refusal !== undefined) refused(refusal);
+}

package/src/driver-s3-copy.ts

@@ -1,9 +1,17 @@
-// Single responsibility: the s3 copy that names a revision. `Bun.S3Client`'s `write` takes no
-// condition, and `x-amz-copy-source-if-match` is what lets the provider refuse an overwrite in the
-// one moment this process cannot see, so a revision-bound copy is a signed CopyObject.
+// Single responsibility: the s3 copy — ONE signed CopyObject, directive COPY, so the provider
+// carries the source's type, `Cache-Control` and `x-amz-meta-*` as local and memory do (Bun's
+// `write(S3File)` dropped both); `ifMatch` sends `x-amz-copy-source-if-match`. Past 5 GiB, CopyObject
+// refuses: `driver-s3-copy-parts.ts`.
 
 import { type S3Refusal, type S3WireOptions, sendSigned, xmlField } from './driver-s3-signed';
 
+/** CopyObject's own ceiling: S3 refuses a larger source with `InvalidRequest`. */
+export const MAX_COPY_OBJECT_BYTES = 5 * 1024 ** 3;
+
+/** `/<bucket>/<key>`, each segment escaped — the `x-amz-copy-source` CopyObject and UploadPartCopy name. */
+export const copySourceOf = (options: S3WireOptions, source: string): string =>
+  `/${encodeURIComponent(options.bucket)}/${source.split('/').map(encodeURIComponent).join('/')}`;
+
 /**
  * The provider's refusal, or `undefined` when the copy landed. A 200 is not yet a verdict: S3 sends
  * its headers before a long copy ends, so a failure can arrive as an `<Error>` inside a 200's body.
@@ -12,15 +20,14 @@ export async function signedCopy(
   options: S3WireOptions,
   source: string,
   destination: string,
-  ifMatch: string,
+  ifMatch?: string | undefined,
 ): Promise<S3Refusal | undefined> {
-  const path = source.split('/').map(encodeURIComponent).join('/');
   const result = await sendSigned(options, {
     method: 'PUT',
     key: destination,
     headers: {
-      'x-amz-copy-source': `/${encodeURIComponent(options.bucket)}/${path}`,
-      'x-amz-copy-source-if-match': ifMatch,
+      'x-amz-copy-source': copySourceOf(options, source),
+      ...(ifMatch === undefined ? {} : { 'x-amz-copy-source-if-match': ifMatch }),
     },
   });
   if (!result.ok) return result.refusal;

package/src/driver-s3-lock.ts

@@ -4,14 +4,12 @@
 // vocabulary. A plain `put()` never comes here: it stays on the Bun client.
 
 import { assert, describeValue } from '@ultimat3/core';
-import { DEFAULT_CONTENT_TYPE, type PutOptions } from './driver';
+import { DEFAULT_CONTENT_TYPE, HEADER_VALUE, type PutOptions } from './driver';
 import { type S3Refusal, type S3WireOptions, sendSigned, xmlField } from './driver-s3-signed';
 import { isRetentionMode, type ObjectLock } from './object-lock';
 
 /** RFC 9110 `token` — the only bytes an `x-amz-meta-<name>` header name may carry. */
 const HEADER_TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-/** Printable ASCII: S3 stores a metadata value as a header, and a CR or a non-ASCII byte is not one. */
-const HEADER_VALUE = /^[\x20-\x7e]*$/;
 
 /** The options only the signed PUT can carry. Any one of them routes the put off the Bun client. */
 export function needsSignedPut(options: PutOptions | undefined): boolean {