alchemy 0.49.1 → 0.50.0

package/src/cloudflare/bucket.ts

@@ -1,18 +1,24 @@
-import { AwsClient } from "aws4fetch";
+import { isDeepStrictEqual } from "node:util";
 import type { Context } from "../context.ts";
 import { Resource, ResourceKind } from "../resource.ts";
 import { bind } from "../runtime/bind.ts";
-import type { Secret } from "../secret.ts";
-import { logger } from "../util/logger.ts";
 import { withExponentialBackoff } from "../util/retry.ts";
-import { CloudflareApiError, handleApiError } from "./api-error.ts";
-import { type CloudflareApi, createCloudflareApi } from "./api.ts";
+import { CloudflareApiError } from "./api-error.ts";
+import {
+  extractCloudflareError,
+  extractCloudflareResult,
+} from "./api-response.ts";
+import {
+  createCloudflareApi,
+  type CloudflareApi,
+  type CloudflareApiOptions,
+} from "./api.ts";
 import type { Bound } from "./bound.ts";
 
 /**
  * Properties for creating or updating an R2 Bucket
  */
-export interface BucketProps {
+export interface BucketProps extends CloudflareApiOptions {
   /**
    * Name of the bucket
    * Names can only contain lowercase letters (a-z), numbers (0-9), and hyphens (-)
@@ -28,6 +34,12 @@ export interface BucketProps {
    */
   locationHint?: string;
 
+  /**
+   * Optional storage class for the bucket
+   * Indicates the storage class for the bucket
+   */
+  storageClass?: "Standard" | "InfrequentAccess";
+
   /**
    * Optional jurisdiction for the bucket
    * Determines the regulatory jurisdiction the bucket data falls under
@@ -55,50 +67,62 @@ export interface BucketProps {
   empty?: boolean;
 
   /**
-   * API Token to use for the bucket
+   * Whether to adopt an existing bucket
    */
-  apiToken?: Secret;
+  adopt?: boolean;
 
   /**
-   * API Key to use for the bucket
+   * CORS rules for the bucket
    */
-  apiKey?: Secret;
+  cors?: R2BucketCORSRule[];
 
   /**
-   * Email to use for the bucket
+   * Whether to emulate the bucket locally when Alchemy is running in watch mode.
    */
-  email?: string;
+  dev?: {
+    /**
+     * Whether to run the bucket remotely instead of locally
+     * @default false
+     */
+    remote?: boolean;
+  };
+}
 
+interface R2BucketCORSRule {
   /**
-   * Account ID to use for the bucket
+   * Identifier for this rule.
    */
-  accountId?: string;
+  id?: string;
 
   /**
-   * Access Key to use for the bucket
+   * Object specifying allowed origins, methods and headers for this CORS rule.
    */
-  accessKey?: Secret;
+  allowed: {
+    /**
+     * Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.
+     */
+    methods: ("GET" | "PUT" | "POST" | "DELETE" | "HEAD")[];
 
-  /**
-   * Secret Access Key to use for the bucket
-   */
-  secretAccessKey?: Secret;
+    /**
+     * Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.
+     */
+    origins: string[];
+
+    /**
+     * Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.
+     */
+    headers?: string[];
+  };
 
   /**
-   * Whether to adopt an existing bucket
+   * Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.
    */
-  adopt?: boolean;
+  exposeHeaders?: string[];
 
   /**
-   * Whether to emulate the bucket locally when Alchemy is running in watch mode.
+   * Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.
    */
-  dev?: {
-    /**
-     * Whether to run the bucket remotely instead of locally
-     * @default false
-     */
-    remote?: boolean;
-  };
+  maxAgeSeconds?: number;
 }
 
 /**
@@ -125,6 +149,11 @@ export type R2BucketResource = Resource<"cloudflare::R2Bucket"> &
      * Time at which the bucket was created
      */
     creationDate: Date;
+
+    /**
+     * The `r2.dev` subdomain for the bucket, if `allowPublicAccess` is true
+     */
+    domain: string | undefined;
   };
 
 export function isBucket(resource: Resource): resource is R2BucketResource {
@@ -204,126 +233,93 @@ const R2BucketResource = Resource(
   ): Promise<R2BucketResource> {
     const api = await createCloudflareApi(props);
     const bucketName = props.name || this.id;
-
-    if (this.phase === "delete") {
-      if (props.delete !== false) {
-        if (props.empty) {
-          logger.log("Emptying R2 bucket:", bucketName);
-          const r2Client = await createR2Client({
-            ...props,
-            accountId: api.accountId,
-            accessKeyId: props.accessKey ?? this.output.accessKey,
-            secretAccessKey:
-              props.secretAccessKey ?? this.output.secretAccessKey,
-          });
-          // Empty the bucket first by deleting all objects
-          await emptyBucket(r2Client, bucketName, props.jurisdiction);
+    const allowPublicAccess = props.allowPublicAccess === true;
+
+    switch (this.phase) {
+      case "create": {
+        const bucket = await createBucket(api, bucketName, props).catch(
+          async (err) => {
+            if (
+              err instanceof CloudflareApiError &&
+              err.status === 409 &&
+              props.adopt
+            ) {
+              return await getBucket(api, bucketName, props);
+            }
+            throw err;
+          },
+        );
+        const domain = await putManagedDomain(
+          api,
+          bucketName,
+          allowPublicAccess,
+          props.jurisdiction,
+        );
+        if (props.cors?.length) {
+          await putBucketCORS(api, bucketName, props);
         }
-
-        await deleteBucket(api, bucketName, props);
+        return this({
+          name: bucketName,
+          location: bucket.location,
+          creationDate: new Date(bucket.creation_date),
+          jurisdiction: bucket.jurisdiction,
+          allowPublicAccess,
+          domain,
+          type: "r2_bucket",
+          accountId: api.accountId,
+          cors: props.cors,
+          dev: props.dev,
+        });
       }
-
-      // Return void (a deleted bucket has no content)
-      return this.destroy();
-    }
-    if (this.phase === "create") {
-      try {
-        await createBucket(api, bucketName, props);
-      } catch (err) {
-        if (err instanceof CloudflareApiError && err.status === 409) {
-          if (!props.adopt) {
-            throw err;
+      case "update": {
+        if (bucketName !== this.output.name) {
+          throw new Error(
+            `Cannot update R2Bucket name after creation. Bucket name is immutable. Before: ${this.output.name}, After: ${bucketName}`,
+          );
+        }
+        let domain = this.output.domain;
+        if (!!domain !== allowPublicAccess) {
+          domain = await putManagedDomain(
+            api,
+            bucketName,
+            allowPublicAccess,
+            props.jurisdiction,
+          );
+        }
+        if (!isDeepStrictEqual(this.output.cors ?? [], props.cors ?? [])) {
+          await putBucketCORS(api, bucketName, props);
+        }
+        return this({
+          ...this.output,
+          allowPublicAccess,
+          dev: props.dev,
+          cors: props.cors,
+          domain,
+        });
+      }
+      case "delete": {
+        if (props.delete !== false) {
+          if (props.empty) {
+            await emptyBucket(api, bucketName, props);
           }
-        } else {
-          throw err;
+          await deleteBucket(api, bucketName, props);
         }
+        return this.destroy();
       }
     }
-
-    if (this.phase === "update" && bucketName !== this.output.name) {
-      throw new Error(
-        `Cannot update R2Bucket name after creation. Bucket name is immutable. Before: ${this.output.name}, After: ${bucketName}`,
-      );
-    }
-
-    await updatePublicAccess(
-      api,
-      bucketName,
-      props.allowPublicAccess === true,
-      props.jurisdiction,
-    );
-
-    return this({
-      name: bucketName,
-      location: props.locationHint || "default",
-      creationDate: new Date(),
-      jurisdiction: props.jurisdiction || "default",
-      type: "r2_bucket",
-      accountId: api.accountId,
-      dev: props.dev,
-    });
   },
 );
 
 /**
- * Configuration for R2 client to connect to Cloudflare R2
+ * The bucket information returned from the Cloudflare REST API
+ * @see https://developers.cloudflare.com/api/node/resources/r2/subresources/buckets/models/bucket/#(schema)
  */
-export interface R2ClientConfig {
-  accountId: string;
-  accessKeyId?: Secret;
-  secretAccessKey?: Secret;
-  jurisdiction?: string;
-}
-
-type R2Client = AwsClient & { accountId: string };
-
-/**
- * Creates an aws4fetch client configured for Cloudflare R2
- *
- * @see https://developers.cloudflare.com/r2/examples/aws/aws-sdk-js-v3/
- */
-export function createR2Client(config?: R2ClientConfig): Promise<R2Client> {
-  const accountId = config?.accountId ?? process.env.CLOUDFLARE_ACCOUNT_ID;
-  const accessKeyId =
-    config?.accessKeyId?.unencrypted || process.env.R2_ACCESS_KEY_ID;
-  const secretAccessKey =
-    config?.secretAccessKey?.unencrypted || process.env.R2_SECRET_ACCESS_KEY;
-
-  if (!accountId) {
-    throw new Error("CLOUDFLARE_ACCOUNT_ID environment variable is required");
-  }
-
-  if (!accessKeyId || !secretAccessKey) {
-    throw new Error(
-      "R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY environment variables are required",
-    );
-  }
-
-  // Create aws4fetch client with Cloudflare R2 endpoint
-  const client: any = new AwsClient({
-    accessKeyId,
-    secretAccessKey,
-    service: "s3",
-    region: "auto",
-  });
-  client.accountId = accountId;
-  return client;
-}
-
-interface CloudflareBucketResponse {
-  /**
-   * The bucket information returned from the Cloudflare REST API
-   * @see https://developers.cloudflare.com/api/node/resources/r2/subresources/buckets/models/bucket/#(schema)
-   */
-  result: {
-    creation_date: string;
-    location?: "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
-    name: string;
-    storage_class?: "Standard" | "InfrequentAccess";
-  };
-  success: boolean;
-  errors: Array<{ code: number; message: string }>;
-  messages: string[];
+interface R2BucketResult {
+  creation_date: string;
+  location: "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
+  name: string;
+  storage_class: "Standard" | "InfrequentAccess";
+  jurisdiction: "default" | "eu" | "fedramp";
 }
 
 /**
@@ -334,24 +330,14 @@ interface CloudflareBucketResponse {
  * @returns Modified headers object
  */
 export function withJurisdiction(
-  headers: Record<string, string>,
-  props: BucketProps | { jurisdiction?: string } | string | undefined,
+  props: { jurisdiction?: string },
+  headers: Record<string, string> = {},
 ): Record<string, string> {
-  // Clone the headers object to avoid modifying the original
-  const result = { ...headers };
-
-  let jurisdiction: string | undefined;
-  if (typeof props === "string") {
-    jurisdiction = props;
-  } else if (props && "jurisdiction" in props) {
-    jurisdiction = props.jurisdiction;
+  if (props.jurisdiction && props.jurisdiction !== "default") {
+    headers["cf-r2-jurisdiction"] = props.jurisdiction;
   }
 
-  if (jurisdiction && jurisdiction !== "default") {
-    result["cf-r2-jurisdiction"] = jurisdiction;
-  }
-
-  return result;
+  return headers;
 }
 
 /**
@@ -361,28 +347,12 @@ export async function getBucket(
   api: CloudflareApi,
   bucketName: string,
   props: BucketProps = {},
-): Promise<CloudflareBucketResponse> {
-  const headers = withJurisdiction({}, props);
-  const getResponse = await api.get(
-    `/accounts/${api.accountId}/r2/buckets/${bucketName}`,
-    { headers },
-  );
-
-  if (!getResponse.ok) {
-    return await handleApiError(getResponse, "get", "R2 bucket", bucketName);
-  }
-
-  if (getResponse.status === 200) {
-    return (await getResponse.json()) as CloudflareBucketResponse;
-  }
-
-  const errorData: any = await getResponse.json().catch(() => ({
-    errors: [{ message: getResponse.statusText }],
-  }));
-
-  throw new CloudflareApiError(
-    `Error getting R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || getResponse.statusText}`,
-    getResponse,
+): Promise<R2BucketResult> {
+  return await extractCloudflareResult<R2BucketResult>(
+    `get R2 bucket "${bucketName}"`,
+    api.get(`/accounts/${api.accountId}/r2/buckets/${bucketName}`, {
+      headers: withJurisdiction(props),
+    }),
   );
 }
 
@@ -393,34 +363,21 @@ export async function createBucket(
   api: CloudflareApi,
   bucketName: string,
   props: BucketProps = {},
-): Promise<CloudflareBucketResponse> {
-  // Create new R2 bucket
-  const createPayload: any = {
-    name: bucketName,
-  };
-
-  if (props.locationHint) {
-    createPayload.location_hint = props.locationHint;
-  }
-
-  const headers = withJurisdiction({}, props);
-
-  const createResponse = await api.post(
-    `/accounts/${api.accountId}/r2/buckets`,
-    createPayload,
-    { headers },
+): Promise<R2BucketResult> {
+  return await extractCloudflareResult<R2BucketResult>(
+    `create R2 bucket "${bucketName}"`,
+    api.post(
+      `/accounts/${api.accountId}/r2/buckets`,
+      {
+        name: bucketName,
+        locationHint: props.locationHint,
+        storageClass: props.storageClass,
+      },
+      {
+        headers: withJurisdiction(props),
+      },
+    ),
   );
-
-  if (!createResponse.ok) {
-    return await handleApiError(
-      createResponse,
-      "creating",
-      "R2 bucket",
-      bucketName,
-    );
-  }
-
-  return (await createResponse.json()) as CloudflareBucketResponse;
 }
 
 /**
@@ -430,195 +387,46 @@ export async function deleteBucket(
   api: CloudflareApi,
   bucketName: string,
   props: BucketProps,
-): Promise<void> {
-  // Delete R2 bucket
-  const headers = withJurisdiction({}, props);
-
-  const deleteResponse = await api.delete(
-    `/accounts/${api.accountId}/r2/buckets/${bucketName}`,
-    { headers },
-  );
-
-  if (!deleteResponse.ok && deleteResponse.status !== 404) {
-    const errorData: any = await deleteResponse.json().catch(() => ({
-      errors: [{ message: deleteResponse.statusText }],
-    }));
-    throw new CloudflareApiError(
-      `Error deleting R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || deleteResponse.statusText}`,
-      deleteResponse,
-    );
-  }
-}
-
-/**
- * List objects in an R2 bucket
- *
- * @param r2 R2Client instance
- * @param bucketName Name of the bucket
- * @param continuationToken Optional token for pagination
- * @param jurisdiction Optional jurisdiction for the bucket
- * @returns Object containing the list of objects and the next continuation token
- */
-export async function listObjects(
-  r2: R2Client,
-  bucketName: string,
-  continuationToken?: string,
-  jurisdiction?: string,
-): Promise<{ objects: { Key: string }[]; continuationToken?: string }> {
-  // List objects in the bucket
-  const url = new URL(
-    `https://${r2.accountId}.r2.cloudflarestorage.com/${bucketName}`,
-  );
-  if (continuationToken) {
-    url.searchParams.set("continuation-token", continuationToken);
-  }
-  url.searchParams.set("list-type", "2");
-
-  const headers = withJurisdiction({}, jurisdiction);
-
-  const listResponse = await r2.fetch(url.toString(), { headers });
-  if (!listResponse.ok) {
-    throw new CloudflareApiError(
-      `Failed to list objects: ${listResponse.statusText}`,
-      listResponse,
-    );
-  }
-
-  const responseText = await listResponse.text();
-
-  // Extract objects from XML response using regex
-  const keyRegex = /<Key>([^<]+)<\/Key>/g;
-  const objects: { Key: string }[] = [];
-  let match;
-  while ((match = keyRegex.exec(responseText)) !== null) {
-    objects.push({ Key: match[1] });
-  }
-
-  // Get continuation token if present using regex
-  const tokenMatch =
-    /<NextContinuationToken>([^<]+)<\/NextContinuationToken>/.exec(
-      responseText,
-    );
-  const nextContinuationToken = tokenMatch ? tokenMatch[1] : undefined;
-
-  return { objects, continuationToken: nextContinuationToken };
-}
-
-/**
- * Helper function to empty a bucket by deleting all objects
- */
-export async function emptyBucket(
-  r2: R2Client,
-  bucketName: string,
-  jurisdiction?: string,
-): Promise<void> {
-  let continuationToken: string | undefined;
-  let totalDeleted = 0;
-
+) {
   try {
-    do {
-      logger.log(`Listing objects in bucket ${bucketName}`);
-      // List objects in the bucket
-      const { objects, continuationToken: nextToken } = await listObjects(
-        r2,
-        bucketName,
-        continuationToken,
-        jurisdiction,
-      );
-
-      continuationToken = nextToken;
-
-      logger.log(`Found ${objects.length} objects in bucket ${bucketName}`);
-
-      // Delete objects in batches
-      if (objects.length > 0) {
-        // Process delete in batches of 1000 (S3 limit)
-        for (let i = 0; i < objects.length; i += 1000) {
-          const batch = objects.slice(i, i + 1000);
-
-          // Create DeleteObjects request XML
-          const deleteXml = `
-            <Delete>
-              ${batch.map((obj) => `<Object><Key>${obj.Key}</Key></Object>`).join("")}
-            </Delete>
-          `;
-
-          const deleteUrl = new URL(
-            `https://${r2.accountId}.r2.cloudflarestorage.com/${bucketName}?delete`,
-          );
-
-          logger.log(
-            `Deleting ${batch.length} objects from bucket ${bucketName}`,
-          );
-
-          const headers = withJurisdiction(
-            { "Content-Type": "application/xml" },
-            jurisdiction,
-          );
-
-          const deleteResponse = await r2.fetch(deleteUrl.toString(), {
-            method: "POST",
-            body: deleteXml,
-            headers,
-          });
-
-          if (!deleteResponse.ok) {
-            throw new CloudflareApiError(
-              `Failed to delete objects: ${deleteResponse.statusText}`,
-              deleteResponse,
-            );
-          }
-
-          totalDeleted += batch.length;
-        }
-      }
-    } while (continuationToken);
-
-    logger.log(
-      `Successfully emptied bucket ${bucketName}, deleted ${totalDeleted} objects total`,
+    await extractCloudflareResult(
+      `delete R2 bucket "${bucketName}"`,
+      api.delete(`/accounts/${api.accountId}/r2/buckets/${bucketName}`, {
+        headers: withJurisdiction(props),
+      }),
     );
   } catch (error) {
     if (error instanceof CloudflareApiError && error.status === 404) {
-      // the bucket was not found
       return;
     }
-    logger.error(`Failed to empty bucket ${bucketName}:`, error);
     throw error;
   }
 }
 
 /**
- * Update public access setting for a bucket
- *
- * This operation is not available through the S3 API for R2,
- * so we still use the Cloudflare API directly.
+ * Update the managed domain setting for a bucket
  */
-export async function updatePublicAccess(
+export async function putManagedDomain(
   api: CloudflareApi,
   bucketName: string,
-  allowPublicAccess: boolean,
+  enabled: boolean,
   jurisdiction?: string,
-): Promise<void> {
-  const headers = withJurisdiction({}, jurisdiction);
-
-  await withExponentialBackoff(
+) {
+  return await withExponentialBackoff(
     async () => {
-      const response = await api.put(
-        `/accounts/${api.accountId}/r2/buckets/${bucketName}/domains/managed`,
-        {
-          enabled: allowPublicAccess,
-        },
-        { headers },
+      const result = await extractCloudflareResult<{
+        bucketId: string;
+        domain: string;
+        enabled: boolean;
+      }>(
+        `put R2 bucket managed domain for "${bucketName}"`,
+        api.put(
+          `/accounts/${api.accountId}/r2/buckets/${bucketName}/domains/managed`,
+          { enabled },
+          { headers: withJurisdiction({ jurisdiction }) },
+        ),
       );
-
-      if (!response.ok) {
-        await handleApiError(
-          response,
-          "updating public access for",
-          "R2 bucket",
-          bucketName,
-        );
-      }
+      return result.enabled ? result.domain : undefined;
     },
     (err) => err.status === 404,
     10,
@@ -627,76 +435,72 @@ export async function updatePublicAccess(
 }
 
 /**
- * Set CORS configuration for a bucket using aws4fetch
+ * Delete all objects in a bucket
  */
-export async function setCorsConfiguration(
-  r2: R2Client,
+async function emptyBucket(
+  api: CloudflareApi,
   bucketName: string,
-  allowedOrigins: string[] = ["*"],
-  allowedMethods: string[] = ["GET", "HEAD", "PUT", "POST", "DELETE"],
-  allowedHeaders: string[] = ["*"],
-  maxAgeSeconds = 3600,
-  jurisdiction?: string,
-): Promise<void> {
-  try {
-    // Construct CORS XML configuration
-    const corsXml = `
-      <CORSConfiguration>
-        <CORSRule>
-          ${allowedOrigins.map((origin) => `<AllowedOrigin>${origin}</AllowedOrigin>`).join("")}
-          ${allowedMethods.map((method) => `<AllowedMethod>${method}</AllowedMethod>`).join("")}
-          ${allowedHeaders.map((header) => `<AllowedHeader>${header}</AllowedHeader>`).join("")}
-          <ExposeHeader>ETag</ExposeHeader>
-          <MaxAgeSeconds>${maxAgeSeconds}</MaxAgeSeconds>
-        </CORSRule>
-      </CORSConfiguration>
-    `;
-
-    const url = new URL(
-      `https://${r2.accountId}.r2.cloudflarestorage.com/${bucketName}?cors`,
-    );
-
-    const headers = withJurisdiction(
-      { "Content-Type": "application/xml" },
-      jurisdiction,
+  props: BucketProps,
+) {
+  let batch: Promise<unknown>[] = [];
+  for await (const key of listObjects(api, bucketName, props)) {
+    batch.push(
+      extractCloudflareResult(
+        `delete R2 object "${key}"`,
+        api.delete(
+          `/accounts/${api.accountId}/r2/buckets/${bucketName}/objects/${key}`,
+          { headers: withJurisdiction(props) },
+        ),
+      ),
     );
-
-    const response = await r2.fetch(url.toString(), {
-      method: "PUT",
-      body: corsXml,
-      headers,
-    });
-
-    if (!response.ok) {
-      throw new CloudflareApiError(
-        `Failed to set CORS configuration: ${response.statusText}`,
-        response,
-      );
+    if (batch.length >= 10) {
+      // this is an arbitary batch size, open to feedback
+      await Promise.all(batch);
+      batch = [];
     }
-
-    logger.log(`Successfully set CORS configuration for bucket ${bucketName}`);
-  } catch (error) {
-    logger.error(
-      `Failed to set CORS configuration for bucket ${bucketName}:`,
-      error,
-    );
-    throw error;
   }
+  await Promise.all(batch);
 }
 
 /**
- * Information about an R2 bucket returned by list operations
+ * Returns an async iterable of all object keys in a bucket,
+ * handling pagination automatically.
  */
-export interface R2BucketInfo {
-  /**
-   * Name of the bucket
-   */
-  Name: string;
-
-  /**
-   * Creation date of the bucket
-   */
-  CreationDate: Date;
+export async function* listObjects(
+  api: CloudflareApi,
+  bucketName: string,
+  props: { jurisdiction?: string },
+  cursor?: string,
+): AsyncGenerator<string> {
+  const params = new URLSearchParams({
+    per_page: "1000",
+  });
+  if (cursor) {
+    params.set("cursor", cursor);
+  }
+  const response = await api.get(
+    `/accounts/${api.accountId}/r2/buckets/${bucketName}/objects?${params.toString()}`,
+    { headers: withJurisdiction(props) },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `Failed to list objects in bucket "${bucketName}": ${await extractCloudflareError(response)}`,
+    );
+  }
+  const json: {
+    result: { key: string }[];
+    result_info?: {
+      cursor: string;
+      is_truncated: boolean;
+      per_page: number;
+    };
+  } = await response.json();
+  for (const object of json.result) {
+    yield object.key;
+  }
+  if (json.result_info?.is_truncated && json.result_info.cursor) {
+    yield* listObjects(api, bucketName, props, json.result_info.cursor);
+  }
 }
 
 /**
@@ -715,7 +519,7 @@ export async function listBuckets(
     direction?: "asc" | "desc";
     jurisdiction?: string;
   } = {},
-): Promise<R2BucketInfo[]> {
+) {
   // Build query parameters
   const params = new URLSearchParams();
 
@@ -738,39 +542,43 @@ export async function listBuckets(
   // Build URL with query parameters
   const path = `/accounts/${api.accountId}/r2/buckets${params.toString() ? `?${params.toString()}` : ""}`;
 
-  // Set jurisdiction header if provided
-  const headers = withJurisdiction({}, options.jurisdiction);
-
   // Make the API request
-  const response = await api.get(path, { headers });
-
-  if (!response.ok) {
-    throw new CloudflareApiError(
-      `Failed to list buckets: ${response.statusText}`,
-      response,
-    );
-  }
+  const result = await extractCloudflareResult<{
+    buckets: { name: string; creation_date: string }[];
+  }>(
+    "list R2 buckets",
+    api.get(path, {
+      headers: withJurisdiction(options),
+    }),
+  );
+  return result.buckets;
+}
 
-  const data = (await response.json()) as {
-    success: boolean;
-    errors?: Array<{ code: number; message: string }>;
-    result?: {
-      buckets: Array<{
-        name: string;
-        creation_date: string;
-        location?: string;
-      }>;
+export async function putBucketCORS(
+  api: CloudflareApi,
+  bucketName: string,
+  props: BucketProps,
+) {
+  let request: RequestInit;
+  if (props.cors?.length) {
+    request = {
+      method: "PUT",
+      body: JSON.stringify({ rules: props.cors }),
+      headers: withJurisdiction(props, {
+        "Content-Type": "application/json",
+      }),
+    };
+  } else {
+    request = {
+      method: "DELETE",
+      headers: withJurisdiction(props),
     };
-  };
-
-  if (!data.success) {
-    const errorMessage = data.errors?.[0]?.message || "Unknown error";
-    throw new Error(`Failed to list buckets: ${errorMessage}`);
   }
-
-  // Transform API response to R2BucketInfo objects
-  return (data.result?.buckets || []).map((bucket) => ({
-    Name: bucket.name,
-    CreationDate: new Date(bucket.creation_date),
-  }));
+  await extractCloudflareResult(
+    `${request.method} R2 bucket CORS rules for "${bucketName}"`,
+    api.fetch(
+      `/accounts/${api.accountId}/r2/buckets/${bucketName}/cors`,
+      request,
+    ),
+  );
 }