@yolk-sdk/emulators 0.1.0-canary.96

package/dist/r2-fixtures.d.mts

@@ -0,0 +1,36 @@
+import * as Schema from "effect/Schema";
+
+//#region src/r2-fixtures.d.ts
+/** A port failure as a fixture records it (mirrors `PortFailure` in `@yolk-sdk/conformance`). */
+type R2EmulatorFailure = {
+  readonly kind: 'expected' | 'error';
+  readonly code: string;
+  readonly message: string;
+  readonly status?: number;
+};
+type R2EmulatorFixtureFields = {
+  readonly id: string;
+  readonly port: string;
+  readonly method: string;
+  readonly request: Schema.Json;
+  readonly observed?: {
+    readonly account: string;
+    readonly date: string;
+  };
+  readonly note?: string;
+};
+/**
+ * One recorded `R2Presigner` or `R2ObjectClient` call (the plain-JSON shape of a `PortFixture`):
+ * exactly one of `response` or `failure`.
+ */
+type R2EmulatorFixture = (R2EmulatorFixtureFields & {
+  readonly response: Schema.Json;
+  readonly failure?: never;
+}) | (R2EmulatorFixtureFields & {
+  readonly failure: R2EmulatorFailure;
+  readonly response?: never;
+});
+declare const r2EmulatorFixtures: ReadonlyArray<R2EmulatorFixture>;
+//#endregion
+export { R2EmulatorFailure, R2EmulatorFixture, r2EmulatorFixtures };
+//# sourceMappingURL=r2-fixtures.d.mts.map

package/dist/r2-fixtures.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-fixtures.d.mts","names":[],"sources":["../src/r2-fixtures.ts"],"mappings":";;;;KAYY,iBAAA;EAAA,SACD,IAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGN,uBAAA;EAAA,SACM,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA;EAAA,SACA,OAAA,EAAS,MAAA,CAAO,IAAI;EAAA,SACpB,QAAA;IAAA,SAAsB,OAAA;IAAA,SAA0B,IAAA;EAAA;EAAA,SAChD,IAAA;AAAA;AAAI;AAOf;;;AAPe,KAOH,iBAAA,IACP,uBAAA;EAAA,SAAqC,QAAA,EAAU,MAAA,CAAO,IAAA;EAAA,SAAe,OAAA;AAAA,MACrE,uBAAA;EAAA,SACU,OAAA,EAAS,iBAAA;EAAA,SACT,QAAA;AAAA;AAAA,cAGF,kBAAA,EAAoB,aAAa,CAAC,iBAAA"}

package/dist/r2-fixtures.mjs

@@ -0,0 +1,245 @@
+//#region src/r2-fixtures.ts
+const r2EmulatorFixtures = [
+	{
+		id: "r2.presign.put-upload-url.presign.synthetic",
+		port: "R2Presigner",
+		method: "presignPutObject",
+		request: {
+			endpoint: "https://synthetic-account.r2.example.test",
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/presign.txt",
+			contentType: "text/plain"
+		},
+		response: { uploadUrl: "https://synthetic-account.r2.example.test/yolk-synthetic-bucket/yolk-conformance/run-synthetic/presign.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=yolk-synthetic-access-key-id%2F20260930%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260930T120000Z&X-Amz-Expires=900&X-Amz-Signature=yolk-synthetic-signature&X-Amz-SignedHeaders=content-type%3Bhost&x-id=PutObject" },
+		note: "Local SigV4 query signing (15-minute expiry, content-type signed); nothing sent to R2. Synthetic."
+	},
+	{
+		id: "r2.objects.get-max-bytes.within-budget.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "fixtures/synthetic-object.txt",
+			maxBytes: 1048576
+		},
+		response: {
+			etag: "\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"",
+			size: 44,
+			bodyBase64: "U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo="
+		},
+		note: "The seeded object within the budget. Synthetic."
+	},
+	{
+		id: "r2.objects.get-max-bytes.over-budget.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "fixtures/synthetic-object.txt",
+			maxBytes: 43
+		},
+		failure: {
+			kind: "error",
+			code: "response_too_large",
+			message: "The object is larger than maxBytes; no bytes were returned."
+		},
+		note: "The host stops at maxBytes (Content-Length or streamed count). Synthetic."
+	},
+	{
+		id: "r2.objects.get-expected-etag.plain.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "fixtures/synthetic-object.txt",
+			maxBytes: 1048576
+		},
+		response: {
+			etag: "\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"",
+			size: 44,
+			bodyBase64: "U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo="
+		},
+		note: "A plain read that learns the etag. Synthetic."
+	},
+	{
+		id: "r2.objects.get-expected-etag.current.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "fixtures/synthetic-object.txt",
+			expectedEtag: "\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"",
+			maxBytes: 1048576
+		},
+		response: {
+			etag: "\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"",
+			size: 44,
+			bodyBase64: "U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo="
+		},
+		note: "If-Match with the current etag. Synthetic."
+	},
+	{
+		id: "r2.objects.get-expected-etag.stale.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "fixtures/synthetic-object.txt",
+			expectedEtag: "\"00000000000000000000000000000000\"",
+			maxBytes: 1048576
+		},
+		failure: {
+			kind: "error",
+			code: "conflict",
+			message: "Precondition failed (If-Match)."
+		},
+		note: "If-Match with a stale etag: HTTP 412 or a binding onlyIf without body. Synthetic."
+	},
+	{
+		id: "r2.objects.get-missing-not-found.get.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/absent.txt",
+			maxBytes: 1048576
+		},
+		failure: {
+			kind: "error",
+			code: "not_found",
+			message: "No object with that key."
+		},
+		note: "HTTP 404 NoSuchKey, or a binding get answering null. Synthetic."
+	},
+	{
+		id: "r2.objects.create-if-absent.create.synthetic",
+		port: "R2ObjectClient",
+		method: "put",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/create-if-absent.txt",
+			condition: { kind: "absent" },
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBmaXJzdCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=",
+			maxUploadBytes: 1048576
+		},
+		response: {
+			etag: "\"c0ffee00c0ffee00c0ffee00c0ffee01\"",
+			size: 68
+		},
+		note: "PUT with If-None-Match: * on a fresh key. Synthetic."
+	},
+	{
+		id: "r2.objects.create-if-absent.create-again.synthetic",
+		port: "R2ObjectClient",
+		method: "put",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/create-if-absent.txt",
+			condition: { kind: "absent" },
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBzZWNvbmQgc3ludGhldGljIGJvZHksIG5ldmVyIHN0b3JlZA==",
+			maxUploadBytes: 1048576
+		},
+		failure: {
+			kind: "error",
+			code: "conflict",
+			message: "Precondition failed (If-None-Match)."
+		},
+		note: "The same key again: HTTP 412, or a binding put answering null. Synthetic."
+	},
+	{
+		id: "r2.objects.create-if-absent.read.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/create-if-absent.txt",
+			expectedEtag: "\"c0ffee00c0ffee00c0ffee00c0ffee01\"",
+			maxBytes: 1048576
+		},
+		response: {
+			etag: "\"c0ffee00c0ffee00c0ffee00c0ffee01\"",
+			size: 68,
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBmaXJzdCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU="
+		},
+		note: "The first bytes, unchanged. Synthetic."
+	},
+	{
+		id: "r2.objects.update-if-match.create.synthetic",
+		port: "R2ObjectClient",
+		method: "put",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/update-if-match.txt",
+			condition: { kind: "absent" },
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBvcmlnaW5hbCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=",
+			maxUploadBytes: 1048576
+		},
+		response: {
+			etag: "\"c0ffee00c0ffee00c0ffee00c0ffee02\"",
+			size: 71
+		},
+		note: "PUT with If-None-Match: * on a fresh key. Synthetic."
+	},
+	{
+		id: "r2.objects.update-if-match.stale.synthetic",
+		port: "R2ObjectClient",
+		method: "put",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/update-if-match.txt",
+			condition: {
+				kind: "etag",
+				etag: "\"00000000000000000000000000000000\""
+			},
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=",
+			maxUploadBytes: 1048576
+		},
+		failure: {
+			kind: "error",
+			code: "conflict",
+			message: "Precondition failed (If-Match)."
+		},
+		note: "PUT with a stale If-Match: HTTP 412, or a binding put answering null. Synthetic."
+	},
+	{
+		id: "r2.objects.update-if-match.current.synthetic",
+		port: "R2ObjectClient",
+		method: "put",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/update-if-match.txt",
+			condition: {
+				kind: "etag",
+				etag: "\"c0ffee00c0ffee00c0ffee00c0ffee02\""
+			},
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=",
+			maxUploadBytes: 1048576
+		},
+		response: {
+			etag: "\"c0ffee00c0ffee00c0ffee00c0ffee03\"",
+			size: 74
+		},
+		note: "PUT with the current If-Match: a new MD5 etag. Synthetic."
+	},
+	{
+		id: "r2.objects.update-if-match.read.synthetic",
+		port: "R2ObjectClient",
+		method: "get",
+		request: {
+			bucket: "yolk-synthetic-bucket",
+			key: "yolk-conformance/run-synthetic/update-if-match.txt",
+			expectedEtag: "\"c0ffee00c0ffee00c0ffee00c0ffee03\"",
+			maxBytes: 1048576
+		},
+		response: {
+			etag: "\"c0ffee00c0ffee00c0ffee00c0ffee03\"",
+			size: 74,
+			bodyBase64: "eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU="
+		},
+		note: "The replacement bytes under the new etag. Synthetic."
+	}
+];
+//#endregion
+export { r2EmulatorFixtures };
+
+//# sourceMappingURL=r2-fixtures.mjs.map

package/dist/r2-fixtures.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-fixtures.mjs","names":[],"sources":["../src/r2-fixtures.ts"],"sourcesContent":["/**\n * The R2 conformance fixtures, copied as data (internal; re-exported by `r2.ts`).\n *\n * Emulators never import SDK code: this is a verbatim copy of `r2ConformanceFixtures` from\n * `@yolk-sdk/connectors/r2-storage/conformance` (synthetic `PortFixture`s; none observed live).\n * The presigned URL carries only the canonical synthetic SigV4 placeholders\n * (`syntheticPortCredentialParams` of `@yolk-sdk/conformance`). `test/r2-conformance.test.ts`\n * fails when the two drift apart; update both together.\n */\nimport type * as Schema from 'effect/Schema'\n\n/** A port failure as a fixture records it (mirrors `PortFailure` in `@yolk-sdk/conformance`). */\nexport type R2EmulatorFailure = {\n  readonly kind: 'expected' | 'error'\n  readonly code: string\n  readonly message: string\n  readonly status?: number\n}\n\ntype R2EmulatorFixtureFields = {\n  readonly id: string\n  readonly port: string\n  readonly method: string\n  readonly request: Schema.Json\n  readonly observed?: { readonly account: string; readonly date: string }\n  readonly note?: string\n}\n\n/**\n * One recorded `R2Presigner` or `R2ObjectClient` call (the plain-JSON shape of a `PortFixture`):\n * exactly one of `response` or `failure`.\n */\nexport type R2EmulatorFixture =\n  | (R2EmulatorFixtureFields & { readonly response: Schema.Json; readonly failure?: never })\n  | (R2EmulatorFixtureFields & {\n      readonly failure: R2EmulatorFailure\n      readonly response?: never\n    })\n\nexport const r2EmulatorFixtures: ReadonlyArray<R2EmulatorFixture> = [\n  {\n    id: 'r2.presign.put-upload-url.presign.synthetic',\n    port: 'R2Presigner',\n    method: 'presignPutObject',\n    request: {\n      endpoint: 'https://synthetic-account.r2.example.test',\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/presign.txt',\n      contentType: 'text/plain'\n    },\n    response: {\n      uploadUrl:\n        'https://synthetic-account.r2.example.test/yolk-synthetic-bucket/yolk-conformance/run-synthetic/presign.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=yolk-synthetic-access-key-id%2F20260930%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260930T120000Z&X-Amz-Expires=900&X-Amz-Signature=yolk-synthetic-signature&X-Amz-SignedHeaders=content-type%3Bhost&x-id=PutObject'\n    },\n    note: 'Local SigV4 query signing (15-minute expiry, content-type signed); nothing sent to R2. Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-max-bytes.within-budget.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'fixtures/synthetic-object.txt',\n      maxBytes: 1048576\n    },\n    response: {\n      etag: '\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"',\n      size: 44,\n      bodyBase64: 'U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo='\n    },\n    note: 'The seeded object within the budget. Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-max-bytes.over-budget.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'fixtures/synthetic-object.txt',\n      maxBytes: 43\n    },\n    failure: {\n      kind: 'error',\n      code: 'response_too_large',\n      message: 'The object is larger than maxBytes; no bytes were returned.'\n    },\n    note: 'The host stops at maxBytes (Content-Length or streamed count). Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-expected-etag.plain.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'fixtures/synthetic-object.txt',\n      maxBytes: 1048576\n    },\n    response: {\n      etag: '\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"',\n      size: 44,\n      bodyBase64: 'U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo='\n    },\n    note: 'A plain read that learns the etag. Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-expected-etag.current.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'fixtures/synthetic-object.txt',\n      expectedEtag: '\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"',\n      maxBytes: 1048576\n    },\n    response: {\n      etag: '\"a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5\"',\n      size: 44,\n      bodyBase64: 'U3ludGhldGljIGNvbmZvcm1hbmNlIG9iamVjdDogc2FmZSB0byByZWFkLgo='\n    },\n    note: 'If-Match with the current etag. Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-expected-etag.stale.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'fixtures/synthetic-object.txt',\n      expectedEtag: '\"00000000000000000000000000000000\"',\n      maxBytes: 1048576\n    },\n    failure: {\n      kind: 'error',\n      code: 'conflict',\n      message: 'Precondition failed (If-Match).'\n    },\n    note: 'If-Match with a stale etag: HTTP 412 or a binding onlyIf without body. Synthetic.'\n  },\n  {\n    id: 'r2.objects.get-missing-not-found.get.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/absent.txt',\n      maxBytes: 1048576\n    },\n    failure: {\n      kind: 'error',\n      code: 'not_found',\n      message: 'No object with that key.'\n    },\n    note: 'HTTP 404 NoSuchKey, or a binding get answering null. Synthetic.'\n  },\n  {\n    id: 'r2.objects.create-if-absent.create.synthetic',\n    port: 'R2ObjectClient',\n    method: 'put',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/create-if-absent.txt',\n      condition: {\n        kind: 'absent'\n      },\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBmaXJzdCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=',\n      maxUploadBytes: 1048576\n    },\n    response: {\n      etag: '\"c0ffee00c0ffee00c0ffee00c0ffee01\"',\n      size: 68\n    },\n    note: 'PUT with If-None-Match: * on a fresh key. Synthetic.'\n  },\n  {\n    id: 'r2.objects.create-if-absent.create-again.synthetic',\n    port: 'R2ObjectClient',\n    method: 'put',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/create-if-absent.txt',\n      condition: {\n        kind: 'absent'\n      },\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBzZWNvbmQgc3ludGhldGljIGJvZHksIG5ldmVyIHN0b3JlZA==',\n      maxUploadBytes: 1048576\n    },\n    failure: {\n      kind: 'error',\n      code: 'conflict',\n      message: 'Precondition failed (If-None-Match).'\n    },\n    note: 'The same key again: HTTP 412, or a binding put answering null. Synthetic.'\n  },\n  {\n    id: 'r2.objects.create-if-absent.read.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/create-if-absent.txt',\n      expectedEtag: '\"c0ffee00c0ffee00c0ffee00c0ffee01\"',\n      maxBytes: 1048576\n    },\n    response: {\n      etag: '\"c0ffee00c0ffee00c0ffee00c0ffee01\"',\n      size: 68,\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBmaXJzdCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU='\n    },\n    note: 'The first bytes, unchanged. Synthetic.'\n  },\n  {\n    id: 'r2.objects.update-if-match.create.synthetic',\n    port: 'R2ObjectClient',\n    method: 'put',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/update-if-match.txt',\n      condition: {\n        kind: 'absent'\n      },\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiBvcmlnaW5hbCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=',\n      maxUploadBytes: 1048576\n    },\n    response: {\n      etag: '\"c0ffee00c0ffee00c0ffee00c0ffee02\"',\n      size: 71\n    },\n    note: 'PUT with If-None-Match: * on a fresh key. Synthetic.'\n  },\n  {\n    id: 'r2.objects.update-if-match.stale.synthetic',\n    port: 'R2ObjectClient',\n    method: 'put',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/update-if-match.txt',\n      condition: {\n        kind: 'etag',\n        etag: '\"00000000000000000000000000000000\"'\n      },\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=',\n      maxUploadBytes: 1048576\n    },\n    failure: {\n      kind: 'error',\n      code: 'conflict',\n      message: 'Precondition failed (If-Match).'\n    },\n    note: 'PUT with a stale If-Match: HTTP 412, or a binding put answering null. Synthetic.'\n  },\n  {\n    id: 'r2.objects.update-if-match.current.synthetic',\n    port: 'R2ObjectClient',\n    method: 'put',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/update-if-match.txt',\n      condition: {\n        kind: 'etag',\n        etag: '\"c0ffee00c0ffee00c0ffee00c0ffee02\"'\n      },\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU=',\n      maxUploadBytes: 1048576\n    },\n    response: {\n      etag: '\"c0ffee00c0ffee00c0ffee00c0ffee03\"',\n      size: 74\n    },\n    note: 'PUT with the current If-Match: a new MD5 etag. Synthetic.'\n  },\n  {\n    id: 'r2.objects.update-if-match.read.synthetic',\n    port: 'R2ObjectClient',\n    method: 'get',\n    request: {\n      bucket: 'yolk-synthetic-bucket',\n      key: 'yolk-conformance/run-synthetic/update-if-match.txt',\n      expectedEtag: '\"c0ffee00c0ffee00c0ffee00c0ffee03\"',\n      maxBytes: 1048576\n    },\n    response: {\n      etag: '\"c0ffee00c0ffee00c0ffee00c0ffee03\"',\n      size: 74,\n      bodyBase64:\n        'eW9say1jb25mb3JtYW5jZSBydW4tc3ludGhldGljOiByZXBsYWNlbWVudCBzeW50aGV0aWMgYm9keSwgc2FmZSB0byBkZWxldGU='\n    },\n    note: 'The replacement bytes under the new etag. Synthetic.'\n  }\n]\n"],"mappings":";AAuCA,MAAa,qBAAuD;CAClE;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,UAAU;GACV,QAAQ;GACR,KAAK;GACL,aAAa;EACf;EACA,UAAU,EACR,WACE,sZACJ;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,UAAU;EACZ;EACA,UAAU;GACR,MAAM;GACN,MAAM;GACN,YAAY;EACd;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,UAAU;EACZ;EACA,SAAS;GACP,MAAM;GACN,MAAM;GACN,SAAS;EACX;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,UAAU;EACZ;EACA,UAAU;GACR,MAAM;GACN,MAAM;GACN,YAAY;EACd;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,cAAc;GACd,UAAU;EACZ;EACA,UAAU;GACR,MAAM;GACN,MAAM;GACN,YAAY;EACd;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,cAAc;GACd,UAAU;EACZ;EACA,SAAS;GACP,MAAM;GACN,MAAM;GACN,SAAS;EACX;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,UAAU;EACZ;EACA,SAAS;GACP,MAAM;GACN,MAAM;GACN,SAAS;EACX;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW,EACT,MAAM,SACR;GACA,YACE;GACF,gBAAgB;EAClB;EACA,UAAU;GACR,MAAM;GACN,MAAM;EACR;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW,EACT,MAAM,SACR;GACA,YACE;GACF,gBAAgB;EAClB;EACA,SAAS;GACP,MAAM;GACN,MAAM;GACN,SAAS;EACX;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,cAAc;GACd,UAAU;EACZ;EACA,UAAU;GACR,MAAM;GACN,MAAM;GACN,YACE;EACJ;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW,EACT,MAAM,SACR;GACA,YACE;GACF,gBAAgB;EAClB;EACA,UAAU;GACR,MAAM;GACN,MAAM;EACR;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW;IACT,MAAM;IACN,MAAM;GACR;GACA,YACE;GACF,gBAAgB;EAClB;EACA,SAAS;GACP,MAAM;GACN,MAAM;GACN,SAAS;EACX;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW;IACT,MAAM;IACN,MAAM;GACR;GACA,YACE;GACF,gBAAgB;EAClB;EACA,UAAU;GACR,MAAM;GACN,MAAM;EACR;EACA,MAAM;CACR;CACA;EACE,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,KAAK;GACL,cAAc;GACd,UAAU;EACZ;EACA,UAAU;GACR,MAAM;GACN,MAAM;GACN,YACE;EACJ;EACA,MAAM;CACR;AACF"}

package/dist/r2-guard.d.mts

@@ -0,0 +1,43 @@
+import * as Schema from "effect/Schema";
+
+//#region src/r2-guard.d.ts
+type JsonObject = Schema.JsonObject;
+/**
+ * The credential field names of the shared port scan (`isPortCredentialKey`): `credential(s)`
+ * plus the credential field names, AWS-style `accessKeyId` / `secretAccessKey` / `sessionToken`
+ * included. One regular-expression source per name; matched whole and case-insensitively.
+ */
+declare const r2CredentialKeyNames: ReadonlyArray<string>;
+/** True for a key whose whole value is a credential (dropped, never compared or recorded). */
+declare const isR2CredentialKey: (key: string) => boolean;
+/**
+ * The credential query or form parameter names of the shared port scan (`hasLiveCredentialParam`).
+ * One regular-expression source per name.
+ */
+declare const r2CredentialParamNames: ReadonlyArray<string>;
+/**
+ * The shared scan's token patterns (`bearerPattern` and `apiKeyPatterns`): a bearer token, common
+ * API-key prefixes, JSON Web Tokens, and PEM private keys.
+ */
+declare const r2TokenPatterns: ReadonlyArray<RegExp>;
+/** True when `text` carries a credential or repeats a guarded value. */
+declare const textCarriesCredential: (text: string, guarded: ReadonlyArray<string>) => boolean;
+/**
+ * The texts a number is matched by: as JavaScript prints it (`1e+21`, `12345678`) and, for an
+ * integer, its full digit string (`1000000000000000000000`).
+ */
+declare const numberTexts: (value: number) => ReadonlyArray<string>;
+/** The guarded values of every credential field of `value`, at any depth, deduplicated. */
+declare const guardedValues: (value: Schema.Json) => ReadonlyArray<string>;
+/** True when `value` holds an own `__proto__` key at any depth (an admission bypass otherwise). */
+declare const hasOwnProtoKey: (value: Schema.Json) => boolean;
+/**
+ * A copy without credential fields, at any depth (`redactPortPayload` of the shared scan), built
+ * with own data properties only (`Object.fromEntries`).
+ */
+declare const withoutCredentials: (value: JsonObject) => JsonObject;
+/** Every object key, string value, and number (`numberTexts`) of `value`. */
+declare const textsOf: (value: Schema.Json) => ReadonlyArray<string>;
+//#endregion
+export { guardedValues, hasOwnProtoKey, isR2CredentialKey, numberTexts, r2CredentialKeyNames, r2CredentialParamNames, r2TokenPatterns, textCarriesCredential, textsOf, withoutCredentials };
+//# sourceMappingURL=r2-guard.d.mts.map

package/dist/r2-guard.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-guard.d.mts","names":[],"sources":["../src/r2-guard.ts"],"mappings":";;;KAiBK,UAAA,GAAa,MAAA,CAAO,UAAU;;AAHS;;;;cAa/B,oBAAA,EAAsB,aAAa;AAAhD;AAAA,cA0Ba,iBAAA,GAAqB,GAAW;;;AA1BG;AA0BhD;cAMa,sBAAA,EAAwB,aAAa;;;AANL;AAM7C;cAwBa,eAAA,EAAiB,aAAa,CAAC,MAAA;;cAkJ/B,qBAAA,GAAyB,IAAA,UAAc,OAAA,EAAS,aAAa;AA1KxB;AAwBlD;;;AAxBkD,cAmLrC,WAAA,GAAe,KAAA,aAAgB,aAAa;AA3JP;AAAA,cA4LrC,aAAA,GAAiB,KAAA,EAAO,MAAA,CAAO,IAAA,KAAO,aAAa;;cAenD,cAAA,GAAkB,KAAA,EAAO,MAAA,CAAO,IAAI;;;;;cAkBpC,kBAAA,GAAsB,KAAA,EAAO,UAAA,KAAa,UAKpD;AAhF+E;AAAA,cAmFrE,OAAA,GAAW,KAAA,EAAO,MAAA,CAAO,IAAA,KAAO,aAAa"}

package/dist/r2-guard.mjs

@@ -0,0 +1,215 @@
+import { textClosureOutcome } from "./stateful-secrets.mjs";
+import { Predicate } from "effect";
+//#region src/r2-guard.ts
+/**
+* The credential guard of the R2 port emulator (internal; used by `r2.ts`, and imported by
+* `test/r2.test.ts` for the exhaustive parity tests).
+*
+* The copied lists here mirror `@yolk-sdk/conformance` (`isPortCredentialKey`, the credential query
+* parameter names of `hasLiveCredentialParam`, `bearerPattern`, and `apiKeyPatterns`) and the R2
+* conformance guard `findR2PortFixtureSecrets` (canonical placeholders and decodings). Emulators
+* never import SDK code, so `test/r2.test.ts` holds one sample per entry of every list here,
+* asserts the sample count equals the list length, and checks each sample against the shared
+* scan; a new entry without a sample fails.
+*
+* @experimental
+*/
+const isJsonObject = (value) => value !== null && Predicate.isObject(value) && !Array.isArray(value);
+/**
+* The credential field names of the shared port scan (`isPortCredentialKey`): `credential(s)`
+* plus the credential field names, AWS-style `accessKeyId` / `secretAccessKey` / `sessionToken`
+* included. One regular-expression source per name; matched whole and case-insensitively.
+*/
+const r2CredentialKeyNames = [
+	"credentials?",
+	"access[_-]?token",
+	"refresh[_-]?token",
+	"id[_-]?token",
+	"auth[_-]?token",
+	"api[_-]?token",
+	"session[_-]?token",
+	"private[_-]?token",
+	"bearer[_-]?token",
+	"oauth[_-]?token",
+	"token",
+	"client[_-]?secret",
+	"secret(?:[_-]?key)?",
+	"private[_-]?key",
+	"password",
+	"passwd",
+	"api[_-]?key",
+	"access[_-]?key[_-]?id",
+	"secret[_-]?access[_-]?key",
+	"authorization"
+];
+const credentialKeyPattern = new RegExp(`^(?:${r2CredentialKeyNames.join("|")})$`, "i");
+/** True for a key whose whole value is a credential (dropped, never compared or recorded). */
+const isR2CredentialKey = (key) => credentialKeyPattern.test(key);
+/**
+* The credential query or form parameter names of the shared port scan (`hasLiveCredentialParam`).
+* One regular-expression source per name.
+*/
+const r2CredentialParamNames = [
+	"api[_-]?key",
+	"key",
+	"token",
+	"access[_-]?token",
+	"refresh[_-]?token",
+	"id[_-]?token",
+	"auth",
+	"secret",
+	"password",
+	"client[_-]?secret",
+	"x-amz-signature",
+	"x-amz-credential",
+	"x-amz-security-token"
+];
+const credentialParamAt = new RegExp(`(?:^|[?&])(?:${r2CredentialParamNames.join("|")})=[^&#]`, "i");
+/**
+* The shared scan's token patterns (`bearerPattern` and `apiKeyPatterns`): a bearer token, common
+* API-key prefixes, JSON Web Tokens, and PEM private keys.
+*/
+const r2TokenPatterns = [
+	/\bbearer\s+[A-Za-z0-9._~+/=-]{8,}/i,
+	/\bsk-[A-Za-z0-9_-]{16,}/,
+	/\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/,
+	/\bxai-[A-Za-z0-9]{20,}/,
+	/\bvck_[A-Za-z0-9]{16,}/,
+	/\bgh[pousr]_[A-Za-z0-9]{20,}/,
+	/\bgithub_pat_[A-Za-z0-9_]{20,}/,
+	/\bAKIA[0-9A-Z]{16}\b/,
+	/\bAIza[0-9A-Za-z_-]{35}/,
+	/\bxox[abprs]-[A-Za-z0-9-]{10,}/,
+	/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
+	/-----BEGIN [A-Z ]*PRIVATE KEY-----/
+];
+/** The canonical placeholders (`syntheticPortCredentialParams`), as the fixtures write them. */
+const canonicalPlaceholders = new Map([["x-amz-signature", "yolk-synthetic-signature"], ["x-amz-credential", encodeURIComponent("yolk-synthetic-access-key-id/20260930/auto/s3/aws4_request")]]);
+const canonicalNamesAt = /(^|[?&])(x-amz-signature|x-amz-credential)=/gi;
+const canonicalValueEnd = /^(?:[&#\s"<>]|$)/;
+const withoutCanonicalPlaceholders = (text) => {
+	let masked = text;
+	for (const match of text.matchAll(canonicalNamesAt)) {
+		const nameStart = match.index + (match[1] ?? "").length;
+		const valueStart = match.index + match[0].length;
+		const placeholder = canonicalPlaceholders.get((match[2] ?? "").toLowerCase()) ?? "";
+		const valueEnd = valueStart + placeholder.length;
+		if (placeholder.length > 0 && text.startsWith(placeholder, valueStart) && canonicalValueEnd.test(text.slice(valueEnd))) {
+			const blank = " ".repeat(valueEnd - nameStart);
+			masked = `${masked.slice(0, nameStart)}${blank}${masked.slice(valueEnd)}`;
+		}
+	}
+	return masked;
+};
+const percentDecodedOnce = (text) => text.replace(/%([0-9A-Fa-f]{2})/g, (_match, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+const codePoint = (value) => String.fromCodePoint(Math.min(value, 1114111));
+const escapesDecodedOnce = (text) => text.replace(/\\u([0-9A-Fa-f]{4})|\\x([0-9A-Fa-f]{2})|\\\\|&#[xX]([0-9A-Fa-f]{1,6});?|&#([0-9]{1,7});?/g, (match, unicode, hex, entityHex, entity) => {
+	const hexDigits = unicode ?? hex ?? entityHex;
+	if (hexDigits !== void 0) return codePoint(Number.parseInt(hexDigits, 16));
+	if (entity !== void 0) return codePoint(Number.parseInt(entity, 10));
+	return match === "\\\\" ? "\\" : match;
+});
+const maxRoundsPerDecoding = 3;
+/** `text` and every variant within three percent rounds and three escape rounds, in any order. */
+const decodedVariants = (text) => {
+	const seen = new Set([text]);
+	let frontier = [{
+		text,
+		percent: 0,
+		escapes: 0
+	}];
+	while (frontier.length > 0) frontier = frontier.flatMap((variant) => [...variant.percent < maxRoundsPerDecoding ? [{
+		...variant,
+		text: percentDecodedOnce(variant.text),
+		percent: variant.percent + 1
+	}] : [], ...variant.escapes < maxRoundsPerDecoding ? [{
+		...variant,
+		text: escapesDecodedOnce(variant.text),
+		escapes: variant.escapes + 1
+	}] : []].filter((candidate) => {
+		if (seen.has(candidate.text)) return false;
+		seen.add(candidate.text);
+		return true;
+	}));
+	return [...seen];
+};
+const sigV4CredentialNames = /x-amz-credential|x-amz-signature|x-amz-security-token/i;
+/** True when `text` holds a SigV4 credential name, a credential parameter, or a token. */
+const credentialText = (text) => sigV4CredentialNames.test(text) || credentialParamAt.test(text) || r2TokenPatterns.some((pattern) => pattern.test(text));
+/**
+* True when `text`, once its exact canonical placeholder occurrences are blanked out, holds a
+* credential (`credentialText`) raw, in any variant within three percent and three escape rounds
+* (the R2 guard's decodings), or anywhere in the fail-closed closure of `textClosureOutcome`
+* (any depth of percent-encoding and JSON escaping; a work cap counts as a credential).
+*/
+const carriesCredential = (text) => {
+	const masked = withoutCanonicalPlaceholders(text);
+	return decodedVariants(masked).some(credentialText) || textClosureOutcome(masked, credentialText) !== "clear";
+};
+/**
+* True when `text` repeats a guarded value: raw, in any of R2's own decodings (`decodedVariants`:
+* percent, `\uXXXX` of any code point, `\xXX`, numeric HTML references, in any order), or
+* anywhere in the shared closure (a work cap counts as a repeat). Every non-empty value is
+* guarded: unlike the shared `textRepeatsSecret`, there is no minimum length.
+*/
+const repeatsGuardedValue = (text, guarded) => {
+	if (guarded.length === 0) return false;
+	const holds = (candidate) => guarded.some((value) => candidate.includes(value));
+	return decodedVariants(text).some(holds) || textClosureOutcome(text, holds) !== "clear";
+};
+/** True when `text` carries a credential or repeats a guarded value. */
+const textCarriesCredential = (text, guarded) => carriesCredential(text) || repeatsGuardedValue(text, guarded);
+const numericText = /^[+-]?(?:[0-9]+\.?[0-9]*|\.[0-9]+)(?:[eE][+-]?[0-9]+)?$/;
+/**
+* The texts a number is matched by: as JavaScript prints it (`1e+21`, `12345678`) and, for an
+* integer, its full digit string (`1000000000000000000000`).
+*/
+const numberTexts = (value) => Number.isSafeInteger(value) || !Number.isInteger(value) ? [String(value)] : [String(value), BigInt(value).toString()];
+/** A guarded value and, when it is numeric text (`0012345678`), the forms of its number. */
+const guardedForms = (value) => {
+	if (value.length === 0) return [];
+	const number = Number(value);
+	return numericText.test(value) && Number.isFinite(number) ? [value, ...numberTexts(number)] : [value];
+};
+/** Every key, string, and number under a credential field, at any depth (the values to guard). */
+const credentialSubtree = (value) => {
+	if (Predicate.isString(value)) return guardedForms(value);
+	if (Predicate.isNumber(value)) return numberTexts(value);
+	if (Array.isArray(value)) return value.flatMap(credentialSubtree);
+	return isJsonObject(value) ? Object.entries(value).flatMap(([key, item]) => [...guardedForms(key), ...credentialSubtree(item)]) : [];
+};
+/** The guarded values of every credential field of `value`, at any depth, deduplicated. */
+const guardedValues = (value) => {
+	const collect = (item) => {
+		if (Array.isArray(item)) return item.flatMap(collect);
+		if (!isJsonObject(item)) return [];
+		return Object.entries(item).flatMap(([key, child]) => isR2CredentialKey(key) ? credentialSubtree(child) : collect(child));
+	};
+	return [...new Set(collect(value))];
+};
+/** True when `value` holds an own `__proto__` key at any depth (an admission bypass otherwise). */
+const hasOwnProtoKey = (value) => {
+	if (Array.isArray(value)) return value.some(hasOwnProtoKey);
+	if (!isJsonObject(value)) return false;
+	return Object.hasOwn(value, "__proto__") || Object.values(value).some(hasOwnProtoKey);
+};
+const strippedOf = (value) => {
+	if (Array.isArray(value)) return value.map(strippedOf);
+	return isJsonObject(value) ? withoutCredentials(value) : value;
+};
+/**
+* A copy without credential fields, at any depth (`redactPortPayload` of the shared scan), built
+* with own data properties only (`Object.fromEntries`).
+*/
+const withoutCredentials = (value) => Object.fromEntries(Object.entries(value).flatMap(([key, item]) => isR2CredentialKey(key) ? [] : [[key, strippedOf(item)]]));
+/** Every object key, string value, and number (`numberTexts`) of `value`. */
+const textsOf = (value) => {
+	if (Predicate.isString(value)) return [value];
+	if (Predicate.isNumber(value)) return numberTexts(value);
+	if (Array.isArray(value)) return value.flatMap(textsOf);
+	return isJsonObject(value) ? Object.entries(value).flatMap(([key, item]) => [key, ...textsOf(item)]) : [];
+};
+//#endregion
+export { guardedValues, hasOwnProtoKey, isR2CredentialKey, numberTexts, r2CredentialKeyNames, r2CredentialParamNames, r2TokenPatterns, textCarriesCredential, textsOf, withoutCredentials };
+
+//# sourceMappingURL=r2-guard.mjs.map

package/dist/r2-guard.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-guard.mjs","names":[],"sources":["../src/r2-guard.ts"],"sourcesContent":["/**\n * The credential guard of the R2 port emulator (internal; used by `r2.ts`, and imported by\n * `test/r2.test.ts` for the exhaustive parity tests).\n *\n * The copied lists here mirror `@yolk-sdk/conformance` (`isPortCredentialKey`, the credential query\n * parameter names of `hasLiveCredentialParam`, `bearerPattern`, and `apiKeyPatterns`) and the R2\n * conformance guard `findR2PortFixtureSecrets` (canonical placeholders and decodings). Emulators\n * never import SDK code, so `test/r2.test.ts` holds one sample per entry of every list here,\n * asserts the sample count equals the list length, and checks each sample against the shared\n * scan; a new entry without a sample fails.\n *\n * @experimental\n */\nimport { Predicate } from 'effect'\nimport type * as Schema from 'effect/Schema'\nimport { textClosureOutcome } from './stateful-secrets.ts'\n\ntype JsonObject = Schema.JsonObject\n\nconst isJsonObject = (value: Schema.Json): value is JsonObject =>\n  value !== null && Predicate.isObject(value) && !Array.isArray(value)\n\n/**\n * The credential field names of the shared port scan (`isPortCredentialKey`): `credential(s)`\n * plus the credential field names, AWS-style `accessKeyId` / `secretAccessKey` / `sessionToken`\n * included. One regular-expression source per name; matched whole and case-insensitively.\n */\nexport const r2CredentialKeyNames: ReadonlyArray<string> = [\n  'credentials?',\n  'access[_-]?token',\n  'refresh[_-]?token',\n  'id[_-]?token',\n  'auth[_-]?token',\n  'api[_-]?token',\n  'session[_-]?token',\n  'private[_-]?token',\n  'bearer[_-]?token',\n  'oauth[_-]?token',\n  'token',\n  'client[_-]?secret',\n  'secret(?:[_-]?key)?',\n  'private[_-]?key',\n  'password',\n  'passwd',\n  'api[_-]?key',\n  'access[_-]?key[_-]?id',\n  'secret[_-]?access[_-]?key',\n  'authorization'\n]\n\nconst credentialKeyPattern = new RegExp(`^(?:${r2CredentialKeyNames.join('|')})$`, 'i')\n\n/** True for a key whose whole value is a credential (dropped, never compared or recorded). */\nexport const isR2CredentialKey = (key: string): boolean => credentialKeyPattern.test(key)\n\n/**\n * The credential query or form parameter names of the shared port scan (`hasLiveCredentialParam`).\n * One regular-expression source per name.\n */\nexport const r2CredentialParamNames: ReadonlyArray<string> = [\n  'api[_-]?key',\n  'key',\n  'token',\n  'access[_-]?token',\n  'refresh[_-]?token',\n  'id[_-]?token',\n  'auth',\n  'secret',\n  'password',\n  'client[_-]?secret',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token'\n]\n\n// A credential parameter: a name at the start or after `?` / `&`, `=`, and a value (any character\n// but `&` or `#`).\nconst credentialParamAt = new RegExp(`(?:^|[?&])(?:${r2CredentialParamNames.join('|')})=[^&#]`, 'i')\n\n/**\n * The shared scan's token patterns (`bearerPattern` and `apiKeyPatterns`): a bearer token, common\n * API-key prefixes, JSON Web Tokens, and PEM private keys.\n */\nexport const r2TokenPatterns: ReadonlyArray<RegExp> = [\n  /\\bbearer\\s+[A-Za-z0-9._~+/=-]{8,}/i,\n  /\\bsk-[A-Za-z0-9_-]{16,}/,\n  /\\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/,\n  /\\bxai-[A-Za-z0-9]{20,}/,\n  /\\bvck_[A-Za-z0-9]{16,}/,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}/,\n  /\\bgithub_pat_[A-Za-z0-9_]{20,}/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n  /\\bAIza[0-9A-Za-z_-]{35}/,\n  /\\bxox[abprs]-[A-Za-z0-9-]{10,}/,\n  /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}/,\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----/\n]\n\n// The SigV4 rules of the R2 conformance guard (`findR2PortFixtureSecrets` in\n// `@yolk-sdk/connectors/r2-storage/conformance`), copied: the exact canonical placeholder\n// occurrences are blanked out, then any credential name left in any decoding layer is refused.\n\n/** The canonical placeholders (`syntheticPortCredentialParams`), as the fixtures write them. */\nconst canonicalPlaceholders = new Map<string, string>([\n  ['x-amz-signature', 'yolk-synthetic-signature'],\n  [\n    'x-amz-credential',\n    encodeURIComponent('yolk-synthetic-access-key-id/20260930/auto/s3/aws4_request')\n  ]\n])\n\nconst canonicalNamesAt = /(^|[?&])(x-amz-signature|x-amz-credential)=/gi\n\nconst canonicalValueEnd = /^(?:[&#\\s\"<>]|$)/\n\nconst withoutCanonicalPlaceholders = (text: string): string => {\n  let masked = text\n\n  for (const match of text.matchAll(canonicalNamesAt)) {\n    const nameStart = match.index + (match[1] ?? '').length\n    const valueStart = match.index + match[0].length\n    const placeholder = canonicalPlaceholders.get((match[2] ?? '').toLowerCase()) ?? ''\n    const valueEnd = valueStart + placeholder.length\n\n    if (\n      placeholder.length > 0 &&\n      text.startsWith(placeholder, valueStart) &&\n      canonicalValueEnd.test(text.slice(valueEnd))\n    ) {\n      const blank = ' '.repeat(valueEnd - nameStart)\n\n      masked = `${masked.slice(0, nameStart)}${blank}${masked.slice(valueEnd)}`\n    }\n  }\n\n  return masked\n}\n\nconst percentDecodedOnce = (text: string): string =>\n  text.replace(/%([0-9A-Fa-f]{2})/g, (_match, hex: string) =>\n    String.fromCharCode(Number.parseInt(hex, 16))\n  )\n\nconst codePoint = (value: number): string => String.fromCodePoint(Math.min(value, 0x10ffff))\n\nconst escapesDecodedOnce = (text: string): string =>\n  text.replace(\n    /\\\\u([0-9A-Fa-f]{4})|\\\\x([0-9A-Fa-f]{2})|\\\\\\\\|&#[xX]([0-9A-Fa-f]{1,6});?|&#([0-9]{1,7});?/g,\n    (match, unicode?: string, hex?: string, entityHex?: string, entity?: string) => {\n      const hexDigits = unicode ?? hex ?? entityHex\n\n      if (hexDigits !== undefined) return codePoint(Number.parseInt(hexDigits, 16))\n\n      if (entity !== undefined) return codePoint(Number.parseInt(entity, 10))\n\n      return match === '\\\\\\\\' ? '\\\\' : match\n    }\n  )\n\nconst maxRoundsPerDecoding = 3\n\n/** `text` and every variant within three percent rounds and three escape rounds, in any order. */\nconst decodedVariants = (text: string): ReadonlyArray<string> => {\n  const seen = new Set<string>([text])\n\n  let frontier: ReadonlyArray<{ text: string; percent: number; escapes: number }> = [\n    { text, percent: 0, escapes: 0 }\n  ]\n\n  while (frontier.length > 0) {\n    frontier = frontier.flatMap(variant =>\n      [\n        ...(variant.percent < maxRoundsPerDecoding\n          ? [{ ...variant, text: percentDecodedOnce(variant.text), percent: variant.percent + 1 }]\n          : []),\n        ...(variant.escapes < maxRoundsPerDecoding\n          ? [{ ...variant, text: escapesDecodedOnce(variant.text), escapes: variant.escapes + 1 }]\n          : [])\n      ].filter(candidate => {\n        if (seen.has(candidate.text)) return false\n\n        seen.add(candidate.text)\n\n        return true\n      })\n    )\n  }\n\n  return [...seen]\n}\n\nconst sigV4CredentialNames = /x-amz-credential|x-amz-signature|x-amz-security-token/i\n\n/** True when `text` holds a SigV4 credential name, a credential parameter, or a token. */\nconst credentialText = (text: string): boolean =>\n  sigV4CredentialNames.test(text) ||\n  credentialParamAt.test(text) ||\n  r2TokenPatterns.some(pattern => pattern.test(text))\n\n/**\n * True when `text`, once its exact canonical placeholder occurrences are blanked out, holds a\n * credential (`credentialText`) raw, in any variant within three percent and three escape rounds\n * (the R2 guard's decodings), or anywhere in the fail-closed closure of `textClosureOutcome`\n * (any depth of percent-encoding and JSON escaping; a work cap counts as a credential).\n */\nconst carriesCredential = (text: string): boolean => {\n  const masked = withoutCanonicalPlaceholders(text)\n\n  return (\n    decodedVariants(masked).some(credentialText) ||\n    textClosureOutcome(masked, credentialText) !== 'clear'\n  )\n}\n\n/**\n * True when `text` repeats a guarded value: raw, in any of R2's own decodings (`decodedVariants`:\n * percent, `\\uXXXX` of any code point, `\\xXX`, numeric HTML references, in any order), or\n * anywhere in the shared closure (a work cap counts as a repeat). Every non-empty value is\n * guarded: unlike the shared `textRepeatsSecret`, there is no minimum length.\n */\nconst repeatsGuardedValue = (text: string, guarded: ReadonlyArray<string>): boolean => {\n  if (guarded.length === 0) return false\n\n  const holds = (candidate: string) => guarded.some(value => candidate.includes(value))\n\n  return decodedVariants(text).some(holds) || textClosureOutcome(text, holds) !== 'clear'\n}\n\n/** True when `text` carries a credential or repeats a guarded value. */\nexport const textCarriesCredential = (text: string, guarded: ReadonlyArray<string>): boolean =>\n  carriesCredential(text) || repeatsGuardedValue(text, guarded)\n\nconst numericText = /^[+-]?(?:[0-9]+\\.?[0-9]*|\\.[0-9]+)(?:[eE][+-]?[0-9]+)?$/\n\n/**\n * The texts a number is matched by: as JavaScript prints it (`1e+21`, `12345678`) and, for an\n * integer, its full digit string (`1000000000000000000000`).\n */\nexport const numberTexts = (value: number): ReadonlyArray<string> =>\n  Number.isSafeInteger(value) || !Number.isInteger(value)\n    ? [String(value)]\n    : [String(value), BigInt(value).toString()]\n\n/** A guarded value and, when it is numeric text (`0012345678`), the forms of its number. */\nconst guardedForms = (value: string): ReadonlyArray<string> => {\n  if (value.length === 0) return []\n\n  const number = Number(value)\n\n  return numericText.test(value) && Number.isFinite(number)\n    ? [value, ...numberTexts(number)]\n    : [value]\n}\n\n/** Every key, string, and number under a credential field, at any depth (the values to guard). */\nconst credentialSubtree = (value: Schema.Json): ReadonlyArray<string> => {\n  if (Predicate.isString(value)) return guardedForms(value)\n\n  if (Predicate.isNumber(value)) return numberTexts(value)\n\n  if (Array.isArray(value)) return value.flatMap(credentialSubtree)\n\n  return isJsonObject(value)\n    ? Object.entries(value).flatMap(([key, item]) => [\n        ...guardedForms(key),\n        ...credentialSubtree(item)\n      ])\n    : []\n}\n\n/** The guarded values of every credential field of `value`, at any depth, deduplicated. */\nexport const guardedValues = (value: Schema.Json): ReadonlyArray<string> => {\n  const collect = (item: Schema.Json): ReadonlyArray<string> => {\n    if (Array.isArray(item)) return item.flatMap(collect)\n\n    if (!isJsonObject(item)) return []\n\n    return Object.entries(item).flatMap(([key, child]) =>\n      isR2CredentialKey(key) ? credentialSubtree(child) : collect(child)\n    )\n  }\n\n  return [...new Set(collect(value))]\n}\n\n/** True when `value` holds an own `__proto__` key at any depth (an admission bypass otherwise). */\nexport const hasOwnProtoKey = (value: Schema.Json): boolean => {\n  if (Array.isArray(value)) return value.some(hasOwnProtoKey)\n\n  if (!isJsonObject(value)) return false\n\n  return Object.hasOwn(value, '__proto__') || Object.values(value).some(hasOwnProtoKey)\n}\n\nconst strippedOf = (value: Schema.Json): Schema.Json => {\n  if (Array.isArray(value)) return value.map(strippedOf)\n\n  return isJsonObject(value) ? withoutCredentials(value) : value\n}\n\n/**\n * A copy without credential fields, at any depth (`redactPortPayload` of the shared scan), built\n * with own data properties only (`Object.fromEntries`).\n */\nexport const withoutCredentials = (value: JsonObject): JsonObject =>\n  Object.fromEntries(\n    Object.entries(value).flatMap(([key, item]) =>\n      isR2CredentialKey(key) ? [] : [[key, strippedOf(item)]]\n    )\n  )\n\n/** Every object key, string value, and number (`numberTexts`) of `value`. */\nexport const textsOf = (value: Schema.Json): ReadonlyArray<string> => {\n  if (Predicate.isString(value)) return [value]\n\n  if (Predicate.isNumber(value)) return numberTexts(value)\n\n  if (Array.isArray(value)) return value.flatMap(textsOf)\n\n  return isJsonObject(value)\n    ? Object.entries(value).flatMap(([key, item]) => [key, ...textsOf(item)])\n    : []\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAM,gBAAgB,UACpB,UAAU,QAAQ,UAAU,SAAS,KAAK,KAAK,CAAC,MAAM,QAAQ,KAAK;;;;;;AAOrE,MAAa,uBAA8C;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,uBAAuB,IAAI,OAAO,OAAO,qBAAqB,KAAK,GAAG,EAAE,KAAK,GAAG;;AAGtF,MAAa,qBAAqB,QAAyB,qBAAqB,KAAK,GAAG;;;;;AAMxF,MAAa,yBAAgD;CAC3D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,MAAM,oBAAoB,IAAI,OAAO,gBAAgB,uBAAuB,KAAK,GAAG,EAAE,UAAU,GAAG;;;;;AAMnG,MAAa,kBAAyC;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAOA,MAAM,wBAAwB,IAAI,IAAoB,CACpD,CAAC,mBAAmB,0BAA0B,GAC9C,CACE,oBACA,mBAAmB,4DAA4D,CACjF,CACF,CAAC;AAED,MAAM,mBAAmB;AAEzB,MAAM,oBAAoB;AAE1B,MAAM,gCAAgC,SAAyB;CAC7D,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,KAAK,SAAS,gBAAgB,GAAG;EACnD,MAAM,YAAY,MAAM,SAAS,MAAM,MAAM,IAAI;EACjD,MAAM,aAAa,MAAM,QAAQ,MAAM,GAAG;EAC1C,MAAM,cAAc,sBAAsB,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,KAAK;EACjF,MAAM,WAAW,aAAa,YAAY;EAE1C,IACE,YAAY,SAAS,KACrB,KAAK,WAAW,aAAa,UAAU,KACvC,kBAAkB,KAAK,KAAK,MAAM,QAAQ,CAAC,GAC3C;GACA,MAAM,QAAQ,IAAI,OAAO,WAAW,SAAS;GAE7C,SAAS,GAAG,OAAO,MAAM,GAAG,SAAS,IAAI,QAAQ,OAAO,MAAM,QAAQ;EACxE;CACF;CAEA,OAAO;AACT;AAEA,MAAM,sBAAsB,SAC1B,KAAK,QAAQ,uBAAuB,QAAQ,QAC1C,OAAO,aAAa,OAAO,SAAS,KAAK,EAAE,CAAC,CAC9C;AAEF,MAAM,aAAa,UAA0B,OAAO,cAAc,KAAK,IAAI,OAAO,OAAQ,CAAC;AAE3F,MAAM,sBAAsB,SAC1B,KAAK,QACH,8FACC,OAAO,SAAkB,KAAc,WAAoB,WAAoB;CAC9E,MAAM,YAAY,WAAW,OAAO;CAEpC,IAAI,cAAc,KAAA,GAAW,OAAO,UAAU,OAAO,SAAS,WAAW,EAAE,CAAC;CAE5E,IAAI,WAAW,KAAA,GAAW,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;CAEtE,OAAO,UAAU,SAAS,OAAO;AACnC,CACF;AAEF,MAAM,uBAAuB;;AAG7B,MAAM,mBAAmB,SAAwC;CAC/D,MAAM,OAAO,IAAI,IAAY,CAAC,IAAI,CAAC;CAEnC,IAAI,WAA8E,CAChF;EAAE;EAAM,SAAS;EAAG,SAAS;CAAE,CACjC;CAEA,OAAO,SAAS,SAAS,GACvB,WAAW,SAAS,SAAQ,YAC1B,CACE,GAAI,QAAQ,UAAU,uBAClB,CAAC;EAAE,GAAG;EAAS,MAAM,mBAAmB,QAAQ,IAAI;EAAG,SAAS,QAAQ,UAAU;CAAE,CAAC,IACrF,CAAC,GACL,GAAI,QAAQ,UAAU,uBAClB,CAAC;EAAE,GAAG;EAAS,MAAM,mBAAmB,QAAQ,IAAI;EAAG,SAAS,QAAQ,UAAU;CAAE,CAAC,IACrF,CAAC,CACP,EAAE,QAAO,cAAa;EACpB,IAAI,KAAK,IAAI,UAAU,IAAI,GAAG,OAAO;EAErC,KAAK,IAAI,UAAU,IAAI;EAEvB,OAAO;CACT,CAAC,CACH;CAGF,OAAO,CAAC,GAAG,IAAI;AACjB;AAEA,MAAM,uBAAuB;;AAG7B,MAAM,kBAAkB,SACtB,qBAAqB,KAAK,IAAI,KAC9B,kBAAkB,KAAK,IAAI,KAC3B,gBAAgB,MAAK,YAAW,QAAQ,KAAK,IAAI,CAAC;;;;;;;AAQpD,MAAM,qBAAqB,SAA0B;CACnD,MAAM,SAAS,6BAA6B,IAAI;CAEhD,OACE,gBAAgB,MAAM,EAAE,KAAK,cAAc,KAC3C,mBAAmB,QAAQ,cAAc,MAAM;AAEnD;;;;;;;AAQA,MAAM,uBAAuB,MAAc,YAA4C;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CAEjC,MAAM,SAAS,cAAsB,QAAQ,MAAK,UAAS,UAAU,SAAS,KAAK,CAAC;CAEpF,OAAO,gBAAgB,IAAI,EAAE,KAAK,KAAK,KAAK,mBAAmB,MAAM,KAAK,MAAM;AAClF;;AAGA,MAAa,yBAAyB,MAAc,YAClD,kBAAkB,IAAI,KAAK,oBAAoB,MAAM,OAAO;AAE9D,MAAM,cAAc;;;;;AAMpB,MAAa,eAAe,UAC1B,OAAO,cAAc,KAAK,KAAK,CAAC,OAAO,UAAU,KAAK,IAClD,CAAC,OAAO,KAAK,CAAC,IACd,CAAC,OAAO,KAAK,GAAG,OAAO,KAAK,EAAE,SAAS,CAAC;;AAG9C,MAAM,gBAAgB,UAAyC;CAC7D,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAEhC,MAAM,SAAS,OAAO,KAAK;CAE3B,OAAO,YAAY,KAAK,KAAK,KAAK,OAAO,SAAS,MAAM,IACpD,CAAC,OAAO,GAAG,YAAY,MAAM,CAAC,IAC9B,CAAC,KAAK;AACZ;;AAGA,MAAM,qBAAqB,UAA8C;CACvE,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO,aAAa,KAAK;CAExD,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO,YAAY,KAAK;CAEvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,QAAQ,iBAAiB;CAEhE,OAAO,aAAa,KAAK,IACrB,OAAO,QAAQ,KAAK,EAAE,SAAS,CAAC,KAAK,UAAU,CAC7C,GAAG,aAAa,GAAG,GACnB,GAAG,kBAAkB,IAAI,CAC3B,CAAC,IACD,CAAC;AACP;;AAGA,MAAa,iBAAiB,UAA8C;CAC1E,MAAM,WAAW,SAA6C;EAC5D,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO,KAAK,QAAQ,OAAO;EAEpD,IAAI,CAAC,aAAa,IAAI,GAAG,OAAO,CAAC;EAEjC,OAAO,OAAO,QAAQ,IAAI,EAAE,SAAS,CAAC,KAAK,WACzC,kBAAkB,GAAG,IAAI,kBAAkB,KAAK,IAAI,QAAQ,KAAK,CACnE;CACF;CAEA,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC;AACpC;;AAGA,MAAa,kBAAkB,UAAgC;CAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,cAAc;CAE1D,IAAI,CAAC,aAAa,KAAK,GAAG,OAAO;CAEjC,OAAO,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,KAAK,EAAE,KAAK,cAAc;AACtF;AAEA,MAAM,cAAc,UAAoC;CACtD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,UAAU;CAErD,OAAO,aAAa,KAAK,IAAI,mBAAmB,KAAK,IAAI;AAC3D;;;;;AAMA,MAAa,sBAAsB,UACjC,OAAO,YACL,OAAO,QAAQ,KAAK,EAAE,SAAS,CAAC,KAAK,UACnC,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,CACxD,CACF;;AAGF,MAAa,WAAW,UAA8C;CACpE,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO,CAAC,KAAK;CAE5C,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO,YAAY,KAAK;CAEvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,QAAQ,OAAO;CAEtD,OAAO,aAAa,KAAK,IACrB,OAAO,QAAQ,KAAK,EAAE,SAAS,CAAC,KAAK,UAAU,CAAC,KAAK,GAAG,QAAQ,IAAI,CAAC,CAAC,IACtE,CAAC;AACP"}