ghost 6.53.0 → 6.54.1

package/core/frontend/services/routing/taxonomy-router.js

@@ -2,7 +2,7 @@ const debug = require('@tryghost/debug')('routing:taxonomy-router');
 const config = require('../../../shared/config');
 const ParentRouter = require('./parent-router');
 const RSSRouter = require('./rss-router');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const controllers = require('./controllers');
 const middleware = require('./middleware');
 

package/core/frontend/services/rss/generate-feed.js

@@ -1,6 +1,6 @@
 const downsize = require('downsize-cjs');
 const RSS = require('rss');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const {routerManager} = require('../routing');
 
 const generateTags = function generateTags(data) {

package/core/frontend/services/sitemap/base-site-map-generator.js

@@ -2,7 +2,7 @@ const _ = require('lodash');
 const xml = require('xml');
 const moment = require('moment');
 const path = require('path');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const localUtils = require('./utils');
 
 // Sitemap specific xml namespace declarations that should not change
@@ -22,8 +22,27 @@ class BaseSiteMapGenerator {
         this.maxPerPage = 50000;
     }
 
-    hasCanonicalUrl(datum) {
-        return Boolean(datum?.canonical_url);
+    hasCanonicalUrl(datum, url) {
+        if (!datum?.canonical_url) {
+            return false;
+        }
+
+        // Sitemap data comes from raw knex queries which bypass model-layer
+        // attribute transforms, so canonical_url may still be transform-ready
+        // (__GHOST_URL__/...) and must be made absolute before comparing
+        const canonicalUrl = urlUtils.transformReadyToAbsolute(datum.canonical_url);
+
+        const normalizeUrl = (value) => {
+            const normalizedUrl = new URL(value);
+            normalizedUrl.pathname = normalizedUrl.pathname.replace(/\/+$/, '');
+            return normalizedUrl.href;
+        };
+
+        try {
+            return normalizeUrl(canonicalUrl) !== normalizeUrl(url);
+        } catch {
+            return canonicalUrl !== url;
+        }
     }
 
     generateXmlFromNodes(page) {
@@ -83,7 +102,7 @@ class BaseSiteMapGenerator {
         const lastModified = this.getLastModifiedForDatum(datum);
         const node = this.createUrlNodeFromDatum(url, datum, lastModified);
 
-        if (node && !this.hasCanonicalUrl(datum)) {
+        if (node && !this.hasCanonicalUrl(datum, url)) {
             this.updateLastModified(datum, lastModified);
             this.updateLookups(datum, node, lastModified);
             // force regeneration of xml

package/core/frontend/services/sitemap/site-map-index-generator.js

@@ -1,7 +1,7 @@
 const _ = require('lodash');
 const xml = require('xml');
 const moment = require('moment');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const localUtils = require('./utils');
 
 const XMLNS_DECLS = {

package/core/frontend/services/sitemap/site-map-manager.js

@@ -1,6 +1,6 @@
 const DomainEvents = require('@tryghost/domain-events');
 const errors = require('@tryghost/errors');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const {URLResourceUpdatedEvent} = require('../../../shared/events');
 const IndexMapGenerator = require('./site-map-index-generator');
 const PagesMapGenerator = require('./page-map-generator');
@@ -8,8 +8,8 @@ const PostsMapGenerator = require('./post-map-generator');
 const UsersMapGenerator = require('./user-map-generator');
 const TagsMapGenerator = require('./tags-map-generator');
 
-// This uses events from the routing service and the URL service
-const events = require('../../../server/lib/common/events');
+// Frontend-internal routing events (router.created / routers.reset)
+const routingEvents = require('../routing/events');
 
 // What the sitemap XML reads off each resource, beyond the columns URL
 // computation needs: lastmod dates, image nodes, and the canonical_url skip
@@ -42,6 +42,12 @@ class SiteMapManager {
         // loads would change boot order.
         this._urlService = options.urlService || null;
 
+        // Server events arrive through the proxy's narrow subscription
+        // surface (site.changed, url.added, url.removed). Injectable for
+        // tests; resolved at construction (not module load) for the same
+        // boot-order reason as the url service above.
+        this._serverEvents = options.serverEvents || require('../proxy').serverEvents;
+
         // Index state for the build path. _indexEpoch increments on every
         // invalidation signal; a build compares the epoch it started with so
         // an invalidated-while-running build never marks the index ready.
@@ -53,7 +59,7 @@ class SiteMapManager {
         // every rebuild can replay them after resetting the generators.
         this._routerEntries = [];
 
-        events.on('router.created', (router) => {
+        routingEvents.on('router.created', (router) => {
             if (router.name !== 'StaticRoutesRouter' && router.name !== 'CollectionRouter') {
                 return;
             }
@@ -76,7 +82,7 @@ class SiteMapManager {
         // current after the initial build, exactly as before this change —
         // deploying is a no-op until the lazy flip. Pure lazy fires no
         // events, so there the index empties and the next read rebuilds.
-        events.on('site.changed', () => {
+        this._serverEvents.on('site.changed', () => {
             if (this._getUrlService().isLazy()) {
                 this._invalidateIndex();
             }
@@ -88,15 +94,15 @@ class SiteMapManager {
             this[event.data.resourceType].updateURL(event.data);
         });
 
-        events.on('url.added', (obj) => {
+        this._serverEvents.on('url.added', (obj) => {
             this[obj.resource.config.type].addUrl(obj.url.absolute, obj.resource.data);
         });
 
-        events.on('url.removed', (obj) => {
+        this._serverEvents.on('url.removed', (obj) => {
             this[obj.resource.config.type].removeUrl(obj.url.absolute, obj.resource.data);
         });
 
-        events.on('routers.reset', () => {
+        routingEvents.on('routers.reset', () => {
             this.pages && this.pages.reset();
             this.posts && this.posts.reset();
             this.users && this.users.reset();

package/core/frontend/services/sitemap/utils.js

@@ -1,4 +1,4 @@
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 let sitemapsUtils;
 
 sitemapsUtils = {

package/core/frontend/services/theme-engine/middleware/update-global-template-options.js

@@ -1,5 +1,5 @@
 const hbs = require('../engine');
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 const settingsCache = require('../../../../shared/settings-cache');
 const customThemeSettingsCache = require('../../../../shared/custom-theme-settings-cache');
 const labs = require('../../../../shared/labs');

package/core/frontend/services/theme-engine/middleware/update-local-template-options.js

@@ -1,6 +1,6 @@
 const _ = require('lodash');
 const hbs = require('../engine');
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 const customThemeSettingsCache = require('../../../../shared/custom-theme-settings-cache');
 const preview = require('../preview');
 const labs = require('../../../../shared/labs');

package/core/frontend/utils/images.js

@@ -1,5 +1,5 @@
 const imageTransform = require('@tryghost/image-transform');
-const urlUtils = require('../../shared/url-utils');
+const urlUtils = require('../../shared/url-utils').default;
 const {isInternalImage} = require('../services/proxy');
 
 module.exports.detectInternalImage = function detectInternalImage(requestedImageUrl) {

package/core/frontend/web/middleware/admin-toolbar.js

@@ -1,5 +1,5 @@
 const crypto = require('crypto');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 
 const COOKIE_NAME = 'ghost-admin-toolbar';

package/core/frontend/web/middleware/handle-image-sizes.js

@@ -2,7 +2,7 @@ const _ = require('lodash');
 const path = require('path');
 const {NoContentError} = require('@tryghost/errors');
 const imageTransform = require('@tryghost/image-transform');
-const storage = require('../../../server/adapters/storage');
+const adapterManager = require('../../../server/services/adapter-manager').default;
 const activeTheme = require('../../services/theme-engine/active');
 const config = require('../../../shared/config');
 const {imageSize} = require('../../../server/lib/image');
@@ -104,7 +104,7 @@ module.exports = function handleImageSizes(req, res, next) {
         return redirectToOriginal();
     }
 
-    const storageInstance = storage.getStorage('images');
+    const storageInstance = adapterManager.getAdapter('storage:images');
     // CASE: unsupported storage adapter
     if (typeof storageInstance.saveRaw !== 'function') {
         return redirectToOriginal();

package/core/frontend/web/middleware/redirect-ghost-to-admin.js

@@ -1,6 +1,6 @@
 const express = require('../../../shared/express');
 const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 
 // Extract the core redirect logic for easier testing
 const handleAdminRedirect = function (req, res) {

package/core/frontend/web/routers/serve-favicon.js

@@ -3,7 +3,7 @@ const path = require('path');
 const crypto = require('crypto');
 const config = require('../../../shared/config');
 const {blogIcon} = require('../../services/proxy');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 
 const buildContentResponse = (ext, buf) => {

package/core/frontend/web/routers/serve-public-file.js

@@ -3,7 +3,7 @@ const fs = require('fs-extra');
 const path = require('path');
 const errors = require('@tryghost/errors');
 const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const tpl = require('@tryghost/tpl');
 const {cardAssets} = require('../../services/assets-minification');
 const themeEngine = require('../../services/theme-engine');

package/core/frontend/web/site.js

@@ -6,8 +6,8 @@ const {MemberPageViewEvent} = require('../../shared/events');
 
 // App requires
 const config = require('../../shared/config');
-const storage = require('../../server/adapters/storage');
-const urlUtils = require('../../shared/url-utils');
+const adapterManager = require('../../server/services/adapter-manager').default;
+const urlUtils = require('../../shared/url-utils').default;
 const sitemapHandler = require('../services/sitemap/handler');
 const serveFavicon = require('./routers/serve-favicon');
 const servePublicFiles = require('./routers/serve-public-file');
@@ -96,11 +96,11 @@ module.exports = function setupSiteApp(routerConfig) {
     siteApp.use(createLlmsDiscovery({settingsCache, labs}));
 
     // Serve site images using the storage adapter
-    siteApp.use(STATIC_IMAGE_URL_PREFIX, mw.handleImageSizes, storage.getStorage('images').serve());
+    siteApp.use(STATIC_IMAGE_URL_PREFIX, mw.handleImageSizes, adapterManager.getAdapter('storage:images').serve());
     // Serve site media using the storage adapter
-    siteApp.use(STATIC_MEDIA_URL_PREFIX, storage.getStorage('media').serve());
+    siteApp.use(STATIC_MEDIA_URL_PREFIX, adapterManager.getAdapter('storage:media').serve());
     // Serve site files using the storage adapter
-    siteApp.use(STATIC_FILES_URL_PREFIX, storage.getStorage('files').serve());
+    siteApp.use(STATIC_FILES_URL_PREFIX, adapterManager.getAdapter('storage:files').serve());
 
     // /member/.well-known/* serves files (e.g. jwks.json) so it needs to be mounted before the prettyUrl mw to avoid trailing slashes
     siteApp.use(

package/core/server/adapters/cache/AdapterCacheMemoryTTL.js

@@ -1,5 +1,5 @@
 const TTLCache = require('@isaacs/ttlcache');
-const Base = require('@tryghost/adapter-base-cache');
+const {CacheBase} = require('@tryghost/adapter-base-cache');
 
 /**
  * Cache adapter compatible wrapper around TTLCache
@@ -8,7 +8,7 @@ const Base = require('@tryghost/adapter-base-cache');
  * - it supports time-to-live (TTL)
  * - it supports a max number of items
  */
-class AdapterCacheMemoryTTL extends Base {
+class AdapterCacheMemoryTTL extends CacheBase {
     #cache;
 
     /**

package/core/server/adapters/cache/MemoryCache.js

@@ -1,6 +1,6 @@
-const Base = require('@tryghost/adapter-base-cache');
+const {CacheBase} = require('@tryghost/adapter-base-cache');
 
-class MemoryCache extends Base {
+class MemoryCache extends CacheBase {
     constructor() {
         super();
 

package/core/server/adapters/cache/Redis.js

@@ -3,7 +3,7 @@
  * The adapter-manager loads adapters by constructing a path from the config value.
  *
  * @see core/shared/config/defaults.json
- * @see core/server/services/adapter-manager/adapter-manager.js
+ * @see core/server/services/adapter-manager/adapter-manager.ts
  */
 const RedisCache = require('../lib/redis/AdapterCacheRedis');
 

package/core/server/adapters/cache/index.js

@@ -1,4 +1,4 @@
-const adapterManager = require('../../services/adapter-manager');
+const adapterManager = require('../../services/adapter-manager').default;
 
 /**
  * @param {'settings'|'theme'|'urls'} [feature] - name for the "feature" to enable through adapter, e.g.: settings cache

package/core/server/adapters/lib/redis/AdapterCacheRedis.js

@@ -1,5 +1,5 @@
 const crypto = require('crypto');
-const BaseCacheAdapter = require('@tryghost/adapter-base-cache');
+const {CacheBase} = require('@tryghost/adapter-base-cache');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 const metrics = require('@tryghost/metrics');
@@ -9,7 +9,7 @@ const redisStoreFactory = require('./redis-store-factory');
 
 const PREFIX_HASH_KEY = 'prefix_hash';
 
-class AdapterCacheRedis extends BaseCacheAdapter {
+class AdapterCacheRedis extends CacheBase {
     /**
      *
      * @param {Object} config

package/core/server/adapters/route-settings/FileStore.js

@@ -36,27 +36,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getBackupRouteSettingsFilePath = void 0;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 const zod_1 = require("zod");
-const date_fns_1 = require("date-fns");
 const errors = __importStar(require("@tryghost/errors"));
 const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const adapter_base_route_settings_1 = require("@tryghost/adapter-base-route-settings");
 const yaml_parser_1 = __importDefault(require("../../services/route-settings/yaml-parser"));
 const route_settings_parser_1 = require("../../services/route-settings/route-settings-parser");
+const utils_1 = require("./utils");
 const YAML_FILENAME = 'routes.yaml';
 const DEFAULT_SETTINGS_FILENAME = 'default-routes.yaml';
 const messages = {
     missingPaths: 'FileStore requires basePath and defaultSettingsBasePath.',
     ensureSettings: 'Error trying to access settings files in {path}.'
 };
-const getBackupRouteSettingsFilePath = (filePath) => {
-    const { dir, name, ext } = path_1.default.parse(filePath);
-    return path_1.default.join(dir, `${name}-${(0, date_fns_1.format)(new Date(), 'yyyy-MM-dd-HH-mm-ss')}${ext}`);
-};
-exports.getBackupRouteSettingsFilePath = getBackupRouteSettingsFilePath;
 // Validates the required paths sourced from config. Used by `FileStore.validate`.
 const configSchema = zod_1.z.object({
     basePath: zod_1.z.string({ error: (0, tpl_1.default)(messages.missingPaths) }).min(1, { error: (0, tpl_1.default)(messages.missingPaths) }),
@@ -98,7 +92,7 @@ class FileStore extends adapter_base_route_settings_1.RouteSettingsStoreBase {
         // config (nconf holds static values), so it's read from the raw input
         // rather than the validated schema output.
         this.getBackupFilePath = config.getBackupFilePath
-            ?? exports.getBackupRouteSettingsFilePath;
+            ?? utils_1.getBackupRouteSettingsFilePath;
     }
     async get() {
         const yamlPath = path_1.default.join(this.basePath, YAML_FILENAME);

package/core/server/adapters/route-settings/FileStore.ts

@@ -1,7 +1,6 @@
 import fs from 'fs-extra';
 import path from 'path';
 import {z} from 'zod';
-import {format} from 'date-fns';
 import * as errors from '@tryghost/errors';
 import tpl from '@tryghost/tpl';
 
@@ -9,6 +8,7 @@ import {RouteSettingsStoreBase, type RouteSettings} from '@tryghost/adapter-base
 
 import parseYaml from '../../services/route-settings/yaml-parser';
 import {parseRouteSettings} from '../../services/route-settings/route-settings-parser';
+import {getBackupRouteSettingsFilePath} from './utils';
 
 const YAML_FILENAME = 'routes.yaml';
 const DEFAULT_SETTINGS_FILENAME = 'default-routes.yaml';
@@ -18,11 +18,6 @@ const messages = {
     ensureSettings: 'Error trying to access settings files in {path}.'
 };
 
-export const getBackupRouteSettingsFilePath = (filePath: string): string => {
-    const {dir, name, ext} = path.parse(filePath);
-    return path.join(dir, `${name}-${format(new Date(), 'yyyy-MM-dd-HH-mm-ss')}${ext}`);
-};
-
 // Validates the required paths sourced from config. Used by `FileStore.validate`.
 const configSchema = z.object({
     basePath: z.string({error: tpl(messages.missingPaths)}).min(1, {error: tpl(messages.missingPaths)}),

package/core/server/adapters/route-settings/S3RouteSettingsStore.js

@@ -0,0 +1,206 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const client_s3_1 = require("@aws-sdk/client-s3");
+const zod_1 = require("zod");
+const tpl_1 = __importDefault(require("@tryghost/tpl"));
+const errors = __importStar(require("@tryghost/errors"));
+const adapter_base_route_settings_1 = require("@tryghost/adapter-base-route-settings");
+const yaml_parser_1 = __importDefault(require("../../services/route-settings/yaml-parser"));
+const route_settings_parser_1 = require("../../services/route-settings/route-settings-parser");
+const utils_1 = require("./utils");
+const YAML_FILENAME = 'routes.yaml';
+const DEFAULT_SETTINGS_FILENAME = 'default-routes.yaml';
+const CONTENT_TYPE = 'application/yaml; charset=utf-8';
+const messages = {
+    missingBucket: 'S3RouteSettingsStore requires a bucket name',
+    missingStaticFileURLPrefix: 'S3RouteSettingsStore requires a staticFileURLPrefix',
+    missingDefaultSettingsBasePath: 'S3RouteSettingsStore requires a defaultSettingsBasePath',
+    partialCredentials: 'S3RouteSettingsStore requires both accessKeyId and secretAccessKey when either is provided',
+    missingResponseBody: 'S3 GetObject returned no body',
+    ensureDefaults: 'Error trying to access the default settings file in {path}.'
+};
+const stripLeadingAndTrailingSlashes = (value = '') => value.replace(/^\/+|\/+$/g, '');
+const configSchema = zod_1.z.object({
+    bucket: zod_1.z.string({ error: (0, tpl_1.default)(messages.missingBucket) }).min(1, { error: (0, tpl_1.default)(messages.missingBucket) }),
+    staticFileURLPrefix: zod_1.z.string({ error: (0, tpl_1.default)(messages.missingStaticFileURLPrefix) })
+        .transform(stripLeadingAndTrailingSlashes)
+        .refine(value => value.length > 0, { error: (0, tpl_1.default)(messages.missingStaticFileURLPrefix) }),
+    defaultSettingsBasePath: zod_1.z.string({ error: (0, tpl_1.default)(messages.missingDefaultSettingsBasePath) })
+        .min(1, { error: (0, tpl_1.default)(messages.missingDefaultSettingsBasePath) }),
+    tenantPrefix: zod_1.z.string().transform(stripLeadingAndTrailingSlashes).optional(),
+    region: zod_1.z.string().optional(),
+    endpoint: zod_1.z.string().optional(),
+    forcePathStyle: zod_1.z.boolean().optional(),
+    accessKeyId: zod_1.z.string().optional(),
+    secretAccessKey: zod_1.z.string().optional(),
+    sessionToken: zod_1.z.string().optional()
+}).refine((config) => {
+    const hasAccessKey = Boolean(config.accessKeyId);
+    const hasSecretKey = Boolean(config.secretAccessKey);
+    const hasSessionToken = Boolean(config.sessionToken);
+    const hasCredentialPair = hasAccessKey && hasSecretKey;
+    return !((hasAccessKey || hasSecretKey || hasSessionToken) && !hasCredentialPair);
+}, { error: (0, tpl_1.default)(messages.partialCredentials) });
+/**
+ * Remote store for route settings backed by an S3-compatible bucket (MinIO in
+ * tests, GCS in production). Reads and writes the operator's original
+ * `routes.yaml` verbatim.
+ */
+class S3RouteSettingsStore extends adapter_base_route_settings_1.RouteSettingsStoreBase {
+    client;
+    bucket;
+    staticFileURLPrefix;
+    tenantPrefix;
+    defaultSettingsBasePath;
+    static parseConfig(config) {
+        const result = configSchema.safeParse(config);
+        if (!result.success) {
+            throw new errors.IncorrectUsageError({
+                message: [...new Set(result.error.issues.map(issue => issue.message))].join('; ')
+            });
+        }
+        return result.data;
+    }
+    static validate(config) {
+        S3RouteSettingsStore.parseConfig(config);
+    }
+    constructor(config) {
+        super();
+        const options = S3RouteSettingsStore.parseConfig(config);
+        const hasCredentialPair = Boolean(options.accessKeyId) && Boolean(options.secretAccessKey);
+        this.bucket = options.bucket;
+        this.staticFileURLPrefix = options.staticFileURLPrefix;
+        this.tenantPrefix = options.tenantPrefix ?? '';
+        this.defaultSettingsBasePath = options.defaultSettingsBasePath;
+        const clientConfig = {
+            region: options.region,
+            endpoint: options.endpoint,
+            forcePathStyle: options.forcePathStyle
+        };
+        if (hasCredentialPair) {
+            clientConfig.credentials = {
+                accessKeyId: options.accessKeyId,
+                secretAccessKey: options.secretAccessKey,
+                sessionToken: options.sessionToken
+            };
+        }
+        // `s3Client` is a test-only injection seam — it never comes from config
+        // (nconf holds static values), so it's read from the raw input rather
+        // than the validated schema output.
+        const injectedClient = config?.s3Client;
+        this.client = injectedClient || new client_s3_1.S3Client(clientConfig);
+    }
+    async get() {
+        let body;
+        try {
+            const response = await this.client.send(new client_s3_1.GetObjectCommand({
+                Bucket: this.bucket,
+                Key: this.buildKey()
+            }));
+            if (!response.Body) {
+                throw new errors.InternalServerError({
+                    message: (0, tpl_1.default)(messages.missingResponseBody)
+                });
+            }
+            body = await response.Body.transformToString('utf-8');
+        }
+        catch (err) {
+            if (this._isNotFound(err)) {
+                const defaultContent = await this.readDefaultSettings();
+                return (0, route_settings_parser_1.parseRouteSettings)((0, yaml_parser_1.default)(defaultContent), defaultContent);
+            }
+            throw err;
+        }
+        return (0, route_settings_parser_1.parseRouteSettings)((0, yaml_parser_1.default)(body), body);
+    }
+    async replace(settings) {
+        const key = this.buildKey();
+        if (await this._canonicalExists()) {
+            await this.client.send(new client_s3_1.CopyObjectCommand({
+                Bucket: this.bucket,
+                Key: (0, utils_1.getBackupRouteSettingsFilePath)(key),
+                CopySource: `${this.bucket}/${key}`
+            }));
+        }
+        await this.client.send(new client_s3_1.PutObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+            Body: settings.yamlSource,
+            ContentType: CONTENT_TYPE
+        }));
+    }
+    buildKey() {
+        const parts = [this.tenantPrefix, this.staticFileURLPrefix, YAML_FILENAME].filter(Boolean);
+        return parts.join('/');
+    }
+    async _canonicalExists() {
+        try {
+            await this.client.send(new client_s3_1.HeadObjectCommand({
+                Bucket: this.bucket,
+                Key: this.buildKey()
+            }));
+            return true;
+        }
+        catch (err) {
+            if (this._isNotFound(err)) {
+                return false;
+            }
+            throw err;
+        }
+    }
+    async readDefaultSettings() {
+        const defaultFilePath = path_1.default.join(this.defaultSettingsBasePath, DEFAULT_SETTINGS_FILENAME);
+        try {
+            return await fs_extra_1.default.readFile(defaultFilePath, 'utf8');
+        }
+        catch (err) {
+            throw new errors.InternalServerError({
+                message: (0, tpl_1.default)(messages.ensureDefaults, { path: this.defaultSettingsBasePath }),
+                err: err,
+                context: err.path
+            });
+        }
+    }
+    _isNotFound(err) {
+        return err instanceof client_s3_1.NotFound || err instanceof client_s3_1.NoSuchKey;
+    }
+}
+exports.default = S3RouteSettingsStore;