lambder 9.0.1 → 9.0.3

package/CHANGELOG.md

@@ -9,6 +9,24 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [9.0.2] - 2026-09-27
+
+Nothing a handler or a caller does changes; the package, its docs and its
+tests are easier to find one's way in.
+
+### Changed
+
+- **The README names the one v9 break the compiler cannot find.** A refusal
+  is no longer stored under an idempotency key, so a retry after one runs the
+  handler again (the 9.0.1 entry has the detail).
+- **The signature map's module is `shared/wire/LambderApiSignatureMap`.** It
+  shared its file name with `api/LambderApiSignature`, which computes the
+  digests. The entries export the same names as before, so no import changes.
+- **Docs.** `docs/dynamodb-tables.md` is `docs/ddb-tables.md`, beside the
+  other `ddb-*` pages. `docs/responses.md` says that `compress: true` behind a
+  REST API needs `binaryMediaTypes: ["*/*"]`, as its compression does.
+- **Tests** sit in folders that mirror `src/`.
+
 ## [9.0.1] - 2026-09-27
 
 A major that gives an API handler one shape. It takes its context and returns

package/README.md

@@ -69,8 +69,9 @@ const company = await caller.api("getCompany", { slug: "acme" });
 - **Frontend hosting.** Serve a build from a folder, S3, R2 or any HTTP
   origin, with an app shell rendered through a build-pipeline-safe template
   engine.
-- **Direct uploads.** Files go from the browser straight to S3 on tickets
-  that pin their size, type and SHA-256, with a browser runner that hashes,
+- **Direct uploads.** Files go from the browser straight to S3, or to R2 on
+  presigned PUTs, on tickets that pin their size, type and SHA-256, with a
+  browser runner that hashes,
   retries and reports progress, and a memory bucket that holds tests and the
   mock to the same rules.
 - **Runs anywhere Lambda does.** API Gateway REST APIs (payload v1), HTTP APIs
@@ -163,11 +164,11 @@ guide that matches what you are building. The full index lives in
 | [The API core](./docs/api-core.md) | `LambderApiPipeline`: the one pipeline the server and the mock runtime run, the store interfaces, the transports |
 | [Frontend client](./docs/client.md) | `LambderCaller`: typed calls, failure outcomes, timeouts, guard inputs, request compression, transports |
 | [Frontend hosting](./docs/frontend-hosting.md) | File sources, `servePublicFiles`, `serveIndexHtml`, `res.templateFile` |
-| [Direct uploads](./docs/uploads.md) | Files the browser posts straight to S3 with tickets the server signs, verified before they count |
+| [Direct uploads](./docs/uploads.md) | Files the browser sends straight to S3 or R2 with tickets the server signs, verified before they count |
 | [Templating](./docs/templating.md) | `html`/`xml` tagged templates and `LambderTemplatingEngine` |
 | [Translations](./docs/i18n.md) | `createLambderI18n`: typed keys, extension, detection, on-demand languages, runtime dictionaries |
 | [The mock runtime](./docs/mock.md) | `LambderMockApp`: the typed contract served from mock handlers over the real pipeline, in the browser and in tests |
-| [DynamoDB tables](./docs/dynamodb-tables.md) | Table shapes, TTL and IAM for sessions, cache, rate limits and idempotency |
+| [DynamoDB tables](./docs/ddb-tables.md) | Table shapes, TTL and IAM for sessions, cache, rate limits and idempotency |
 | [Exports reference](./docs/exports.md) | Every name the five entry points export, grouped by purpose |
 
 ## Standalone modules
@@ -192,7 +193,9 @@ handler one shape: it takes its context and returns its output, says no with
 `refuse()`, and writes headers, cookies and log entries through the context,
 while the response builder stays with routes, hooks and error handlers. Every
 break and what to do about it is in the 9.0.1 entry, and the compiler finds
-most of them. An app still on v7 goes through the 8.0.2 entry first, which
+most of them. The one it cannot is a change of behavior: a refusal is no
+longer stored under an idempotency key, so a retry after one runs the handler
+again. An app still on v7 goes through the 8.0.2 entry first, which
 names the breaks of v8 the compiler cannot find, and one on v6 through the
 7.0.0 entry before that.
 

package/dist/api/LambderApiPipeline.d.ts

@@ -4,7 +4,7 @@ import type { LambderApiAnswer } from "./LambderApiAnswer.js";
 import type { LambderApiCallContext } from "./LambderApiCallContext.js";
 import type { LambderApiCallTrace } from "./LambderApiCallContext.js";
 import type { LambderApiDefinition } from "./LambderApiDefinition.js";
-import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import { type LambderApiGuard } from "./LambderApiGuards.js";
 import { type LambderApiRateLimitPolicyConfig, type LambderApiRateLimitsConfig, type LambderRateLimitChargeResult, type LambderRateLimitChargeSubject } from "./LambderApiRateLimits.js";
 import { type LambderApiIdempotencyConfig } from "./LambderApiIdempotency.js";

package/dist/api/LambderApiPipeline.js

@@ -1,5 +1,5 @@
 import { restoreCompressedPayload } from "./LambderApiRequest.js";
-import { lookupApiSignature } from "../shared/wire/LambderApiSignature.js";
+import { lookupApiSignature } from "../shared/wire/LambderApiSignatureMap.js";
 import { apiNotFoundAnswer, invalidPayloadAnswer, refusalAnswer, sessionExpiredAnswer, validationAnswer, versionExpiredAnswer, } from "./LambderApiEnvelope.js";
 import { LambderApiValidationRefusal, isLambderApiValidationRefusal } from "./LambderApiValidationRefusal.js";
 import { isLambderApiRefusal } from "../shared/wire/LambderApiRefusal.js";

package/dist/api/LambderApiSignature.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { toGuardEntries } from "./LambderApiGuards.js";
-import { API_SIGNATURE_HEX_LENGTH, EXTENSIBLE_ENUM_META_KEY } from "../shared/wire/LambderApiSignature.js";
+import { API_SIGNATURE_HEX_LENGTH, EXTENSIBLE_ENUM_META_KEY } from "../shared/wire/LambderApiSignatureMap.js";
 import { sha256HexOf } from "../shared/util/LambderTextDigest.js";
 import { canonicalJson } from "../shared/util/canonicalJson.js";
 /*

package/dist/client/LambderCaller.d.ts

@@ -4,7 +4,7 @@ import type { LambderApiContractShape } from '../shared/wire/LambderApiContract.
 import { type LambderApiOutcome, type LambderValidationError } from '../shared/wire/LambderApiOutcome.js';
 import { type LambderCallArgs, type LambderContractOutputOf, type LambderGuardInputsProviderOption, type LambderSharedCallOptions } from '../shared/wire/LambderCallOptions.js';
 import { type LambderApiTransport } from '../shared/transport/LambderApiTransport.js';
-import { type LambderApiSignatureMap } from '../shared/wire/LambderApiSignature.js';
+import { type LambderApiSignatureMap } from '../shared/wire/LambderApiSignatureMap.js';
 export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError } from '../shared/wire/LambderApiOutcome.js';
 export type { LambderProvidedGuardInputs, LambderGuardInputsProvider } from '../shared/wire/LambderCallOptions.js';
 /** A handler told that something happened, with nothing to hand it. */

package/dist/client/LambderCaller.js

@@ -8,7 +8,7 @@ import { createCallAbort } from '../shared/util/LambderCallAbort.js';
 import { coerceToError } from '../shared/wire/LambderCrashDetail.js';
 import { isLambderTransportFailure } from '../shared/transport/LambderApiTransport.js';
 import { DEFAULT_SESSION_TOKEN_COOKIE_KEY, DEFAULT_SESSION_CSRF_COOKIE_KEY } from '../shared/wire/LambderSessionCookieNames.js';
-import { readApiSignature } from '../shared/wire/LambderApiSignature.js';
+import { readApiSignature } from '../shared/wire/LambderApiSignatureMap.js';
 import { LambderReloadLoopBreaker, RELOAD_LOOP_WINDOW_MS } from './LambderReloadLoopBreaker.js';
 import { lambderFetchTransport } from './lambderFetchTransport.js';
 /**

package/dist/client/LambderUploadRunner.d.ts

@@ -60,9 +60,9 @@ export type LambderUploadRunnerOptions<Reference, Receipt> = {
         maxDelayMs?: number;
     };
     /**
-     * How long a post may be open and move nothing before it counts as
-     * dropped. Default: 60 seconds. Watched where XMLHttpRequest exists,
-     * which reports a body's progress; a runtime with only fetch posts
+     * How long an upload to storage may be open and move nothing before it
+     * counts as dropped. Default: 60 seconds. Watched where XMLHttpRequest exists,
+     * which reports a body's progress; a runtime with only fetch uploads
      * unwatched.
      */
     stallTimeoutMs?: number;
@@ -91,6 +91,6 @@ export declare class LambderUploadRunner<Reference, Receipt> {
     }): Promise<Receipt>;
     /** Forgets a confirmed upload through the app's endpoint, when it declared one. */
     discard(receipt: Receipt): Promise<void>;
-    /** One post of the file to storage. Never throws: every ending is an outcome. */
-    private post;
+    /** One upload of the file to storage, in the ticket's form. Never throws: every ending is an outcome. */
+    private send;
 }

package/dist/client/LambderUploadRunner.js

@@ -90,7 +90,7 @@ export class LambderUploadRunner {
         for (;;) {
             stopIfCancelled();
             report("uploading");
-            const outcome = await this.post(issued.ticket, file, signal, (sentBytes) => report("uploading", sentBytes));
+            const outcome = await this.send(issued.ticket, file, signal, (sentBytes) => report("uploading", sentBytes));
             if (outcome.kind === "stored")
                 break;
             if (outcome.kind === "cancelled")
@@ -124,22 +124,29 @@ export class LambderUploadRunner {
     async discard(receipt) {
         await this.options.discardUpload?.(receipt);
     }
-    /** One post of the file to storage. Never throws: every ending is an outcome. */
-    post(ticket, file, signal, onSent) {
+    /** One upload of the file to storage, in the ticket's form. Never throws: every ending is an outcome. */
+    send(ticket, file, signal, onSent) {
         if (signal?.aborted)
             return Promise.resolve({ kind: "cancelled" });
-        const form = new FormData();
-        for (const [name, value] of Object.entries(ticket.formFields))
-            form.append(name, value);
-        // Storage ignores every field that comes after the file.
-        form.append("file", file);
+        let request;
+        if (ticket.method === "PUT") {
+            request = { method: "PUT", url: ticket.uploadUrl, body: file, headers: ticket.headers };
+        }
+        else {
+            const form = new FormData();
+            for (const [name, value] of Object.entries(ticket.formFields))
+                form.append(name, value);
+            // Storage ignores every field that comes after the file.
+            form.append("file", file);
+            request = { method: "POST", url: ticket.uploadUrl, body: form, headers: {} };
+        }
         return typeof XMLHttpRequest === "function"
-            ? postWithXhr(ticket.uploadUrl, form, file.size, this.stallTimeoutMs, signal, onSent)
-            : postWithFetch(ticket.uploadUrl, form, file.size, signal, onSent);
+            ? sendWithXhr(request, file.size, this.stallTimeoutMs, signal, onSent)
+            : sendWithFetch(request, file.size, signal, onSent);
     }
 }
 /** XMLHttpRequest rather than fetch where it exists: fetch cannot report how much of a request body has been sent. */
-const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => new Promise((resolve) => {
+const sendWithXhr = ({ method, url, body, headers }, fileBytes, stallTimeoutMs, signal, onSent) => new Promise((resolve) => {
     const request = new XMLHttpRequest();
     let stalled = false;
     let stallTimer;
@@ -158,7 +165,7 @@ const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => ne
     };
     request.upload.onprogress = (event) => {
         watchForStall();
-        // `loaded` counts the form's own framing too, a little over the file.
+        // A form's `loaded` counts its own framing too, a little over the file.
         onSent(Math.min(event.loaded, fileBytes));
     };
     request.onload = () => {
@@ -173,18 +180,20 @@ const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => ne
     signal?.addEventListener("abort", cancel, { once: true });
     watchForStall();
     try {
-        request.open("POST", url);
-        request.send(form);
+        request.open(method, url);
+        for (const [name, value] of Object.entries(headers))
+            request.setRequestHeader(name, value);
+        request.send(body);
     }
     catch {
         // A URL the browser will not open, or a request it will not send, answers nothing.
         settle({ kind: "unreachable" });
     }
 });
-const postWithFetch = async (url, form, fileBytes, signal, onSent) => {
+const sendWithFetch = async ({ method, url, body, headers }, fileBytes, signal, onSent) => {
     let response;
     try {
-        response = await fetch(url, { method: "POST", body: form, signal });
+        response = await fetch(url, { method, body, headers, signal });
     }
     catch {
         return signal?.aborted ? { kind: "cancelled" } : { kind: "unreachable" };

package/dist/client.d.ts

@@ -15,8 +15,8 @@ export type { LambderApiTransport, LambderApiTransportRequest, LambderTransportF
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
-export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignatureMap.js";
+export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignatureMap.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
@@ -46,4 +46,4 @@ export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";
 export type { LambderUploadRunnerOptions, LambderUploadProgress, LambderUploadPhase, LambderUploadFailureReason } from "./client/LambderUploadRunner.js";
 export { checkUploadRule } from "./shared/contracts/LambderUploadBucket.js";
-export type { LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadRuleVerdict } from "./shared/contracts/LambderUploadBucket.js";
+export type { LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadMethod, LambderUploadRuleVerdict } from "./shared/contracts/LambderUploadBucket.js";

package/dist/client.js

@@ -16,7 +16,7 @@ export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCook
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
 // The per-endpoint signature map a build ships with, how a caller reads it, the
 // mark a shared schema sets on an enum its readers let grow, and the reload-loop window.
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignatureMap.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export { createIdempotencyKey, createIdempotencyKeyScope } from "./shared/wire/LambderIdempotencyKeyScope.js";

package/dist/core/Lambder.d.ts

@@ -13,7 +13,7 @@ import { type LambderPipelineBackends, type LambderPipelineBackendSwap } from ".
 import type { LambderFileSource } from "../shared/contracts/LambderFileSource.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
 import { type LambderApiSignatureEntry } from "../api/LambderApiSignature.js";
-import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import type { LambderApiOptionEntries } from "../shared/wire/LambderApiOptionEntries.js";
 import type { LambderApiIdempotencyOption } from "../shared/wire/LambderApiOptionValues.js";
 import type { LambderApiGuard, LambderGuardMetaMap, LambderGuardsOption, LambderGuardDataOf, LambderGuardInputsOf } from "../api/LambderApiGuards.js";

package/dist/core/Lambder.js

@@ -14,7 +14,7 @@ import { isLambderApiRefusal } from "../shared/wire/LambderApiRefusal.js";
 import { LambderApiPipeline } from "../api/LambderApiPipeline.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
 import { apiSignatureOf } from "../api/LambderApiSignature.js";
-import { apiNameKeyOf } from "../shared/wire/LambderApiSignature.js";
+import { apiNameKeyOf } from "../shared/wire/LambderApiSignatureMap.js";
 import { assertPlainData } from "../shared/util/assertPlainData.js";
 import { apiNotFoundAnswer, buildApiEnvelope, envelopeAnswer, refusalAnswer, sessionExpiredAnswer, } from "../api/LambderApiEnvelope.js";
 import { LambderApiOutputValidationError } from "../api/LambderApiOutputValidationError.js";

package/dist/core/LambderCreateOptions.d.ts

@@ -1,5 +1,5 @@
 import type { z } from "zod";
-import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import type { Context } from "aws-lambda";
 import type LambderResolver from "./LambderResolver.js";
 import type LambderResponseBuilder from "./LambderResponseBuilder.js";

package/dist/index.d.ts

@@ -34,8 +34,8 @@ export type { LambderApiCallContext, LambderApiCallTrace, LambderResponseTools }
 export type { LambderApiDefinition } from "./api/LambderApiDefinition.js";
 export { apiSignatureOf } from "./api/LambderApiSignature.js";
 export type { LambderApiSignatureEntry } from "./api/LambderApiSignature.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
-export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignatureMap.js";
+export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignatureMap.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export { buildApiEnvelope, envelopeAnswer, refusalAnswer, validationAnswer, apiNotFoundAnswer, sessionExpiredAnswer, versionExpiredAnswer, invalidPayloadAnswer, crashAnswer, API_ANSWER_CONTENT_TYPE, } from "./api/LambderApiEnvelope.js";
@@ -88,7 +88,7 @@ export type { LambderS3UploadBucketOptions } from "./stores/LambderS3UploadBucke
 export { LambderMemoryUploadBucket } from "./stores/LambderMemoryUploadBucket.js";
 export type { LambderMemoryUploadBucketOptions, LambderMemoryUploadObject } from "./stores/LambderMemoryUploadBucket.js";
 export { checkUploadRule } from "./shared/contracts/LambderUploadBucket.js";
-export type { LambderUploadBucket, LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadVerdict, LambderUploadRuleVerdict, LambderUploadObjectOptions, LambderUploadContentDisposition, } from "./shared/contracts/LambderUploadBucket.js";
+export type { LambderUploadBucket, LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadMethod, LambderUploadVerdict, LambderUploadRuleVerdict, LambderUploadObjectOptions, LambderUploadContentDisposition, } from "./shared/contracts/LambderUploadBucket.js";
 export { LambderUploadFileFactsSchema, LambderUploadTicketSchema } from "./shared/wire/LambderUploadSchemas.js";
 export { refuseUnacceptedUpload } from "./shared/wire/LambderUploadRefusal.js";
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";

package/dist/index.js

@@ -24,7 +24,7 @@ export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader
 export { createApiCallContext } from "./api/LambderApiCallContext.js";
 // Per-endpoint signatures: what a client build ships with, digested from the server's own registrations.
 export { apiSignatureOf } from "./api/LambderApiSignature.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignatureMap.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export { buildApiEnvelope, envelopeAnswer, refusalAnswer, validationAnswer, apiNotFoundAnswer, sessionExpiredAnswer, versionExpiredAnswer, invalidPayloadAnswer, crashAnswer, API_ANSWER_CONTENT_TYPE, } from "./api/LambderApiEnvelope.js";

package/dist/invoke/LambderInvokeCaller.d.ts

@@ -22,7 +22,7 @@
  */
 import type { APIGatewayProxyEventV2, Context } from "aws-lambda";
 import { type LambderInvokeFailure, type LambderInvokeOutcome } from "./LambderInvokeOutcome.js";
-import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import type { LambdaClient, LambdaClientConfig } from "@aws-sdk/client-lambda";
 import type { LambderApiContractShape } from "../shared/wire/LambderApiContract.js";
 import { type LambderCallArgs, type LambderContractOutputOf, type LambderGuardInputsProviderOption, type LambderSharedCallOptions } from "../shared/wire/LambderCallOptions.js";

package/dist/invoke/LambderInvokeCaller.js

@@ -22,7 +22,7 @@
  */
 import { classifyDeliveryFailure, describeFailure, errorFromFunctionError, LambderInvokeError, parseFunctionError, } from "./LambderInvokeOutcome.js";
 import { DEFAULT_SESSION_TOKEN_COOKIE_KEY } from "../shared/wire/LambderSessionCookieNames.js";
-import { readApiSignature } from "../shared/wire/LambderApiSignature.js";
+import { readApiSignature } from "../shared/wire/LambderApiSignatureMap.js";
 import { resolveApiOutcome } from "../shared/wire/LambderApiOutcome.js";
 import { mergeGuardInputs, } from "../shared/wire/LambderCallOptions.js";
 import { beginIdempotentAttempt, IDEMPOTENT_ATTEMPT_NOT_SENT } from "../shared/wire/LambderIdempotencyKeyScope.js";

package/dist/mock/LambderMockCreateOptions.d.ts

@@ -1,5 +1,5 @@
 import type { z } from "zod";
-import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import type { LambderApiResponseConfig } from "../shared/wire/LambderApiContract.js";
 import type { LambderHttpStatusCode } from "../shared/wire/LambderHttpStatus.js";
 import type { MaybePromise } from "../shared/util/LambderTypeUtilities.js";

package/dist/shared/contracts/LambderUploadBucket.d.ts

@@ -13,14 +13,29 @@ export type LambderUploadFileFacts = {
     /** SHA-256 of the file's bytes as base64, the form storage checks an upload against: 43 characters and one pad. */
     sha256Base64: string;
 };
-/** Everything the browser needs to post one file to storage, and until when. */
+/**
+ * Everything the browser needs to send one file to storage, and until when,
+ * in one of the two forms a store signs. `POST` is a form (S3's presigned
+ * POST), `PUT` the file as the body of a signed URL (a presigned PUT, which
+ * Cloudflare R2 and other stores without POST policies take).
+ */
 export type LambderUploadTicket = {
+    method: "POST";
     uploadUrl: string;
     /** Sent as form fields ahead of the file, which storage wants last. */
     formFields: Record<string, string>;
     /** Epoch milliseconds after which storage refuses the ticket. */
     expiresAt: number;
+} | {
+    method: "PUT";
+    uploadUrl: string;
+    /** Sent exactly as given, each one signed into the URL; the browser adds the length itself. */
+    headers: Record<string, string>;
+    /** Epoch milliseconds after which storage refuses the ticket. */
+    expiresAt: number;
 };
+/** How a bucket's tickets send a file: the `method` of the tickets it signs. */
+export type LambderUploadMethod = LambderUploadTicket["method"];
 /** What a bucket holds under a key, compared with what the browser said it would upload. */
 export type LambderUploadVerdict = {
     verified: true;
@@ -38,7 +53,7 @@ export type LambderUploadContentDisposition = {
 };
 /**
  * What storage keeps beside an object's bytes. A ticket pins every one of
- * these in its signed policy, so the browser posts them unchanged.
+ * these in its signature, so the browser sends them unchanged.
  */
 export type LambderUploadObjectOptions = {
     /**
@@ -91,7 +106,7 @@ export interface LambderUploadBucket {
      * Signs a ticket for exactly the file the browser described, or refuses
      * (a LambderApiRefusal, code `lambder/upload-empty`,
      * `lambder/upload-type-rejected` or `lambder/upload-too-large`) when the
-     * rule does not accept it. Storage then enforces every fact: the post
+     * rule does not accept it. Storage then enforces every fact: the upload
      * fails unless the body has that byte size, that content type and that
      * SHA-256, so what verifies later is what was described here. `object`
      * is what the stored object carries besides, pinned the same way, and

package/dist/shared/contracts/LambderUploadBucket.js

@@ -4,7 +4,7 @@
  *
  * An API payload tops out near a few megabytes once a file is base64, and a
  * Lambda's request body at six, so anything larger (a scanned lease, a
- * signed PDF, a video) is posted by the browser to the bucket itself, with a
+ * signed PDF, a video) is sent by the browser to the bucket itself, with a
  * ticket the server signed beforehand. The ticket pins everything about the
  * upload: the key, the exact byte size, the content type and the SHA-256 of
  * the bytes, all enforced by the storage, so the browser can only ever store
@@ -12,7 +12,7 @@
  *
  * The conversation is the same three steps whatever the app stores: the
  * browser describes the file (LambderUploadFileFacts), the app's endpoint
- * answers with a ticket (LambderUploadTicket), and after the post the app's
+ * answers with a ticket (LambderUploadTicket), and after the upload the app's
  * confirm endpoint asks the bucket what arrived before its record counts as
  * uploaded. The server half is a LambderUploadBucket, the browser half is
  * LambderUploadRunner.

package/dist/shared/wire/LambderUploadObjectFields.d.ts

@@ -1,6 +1,6 @@
 import type { LambderUploadObjectOptions } from "../contracts/LambderUploadBucket.js";
 /**
- * What a ticket's form carries for the stored object, in the fields S3's
+ * What a POST ticket's form carries for the stored object, in the fields S3's
  * presigned POST reads them from: the tag set as the XML `tagging` field,
  * each metadata entry as `x-amz-meta-<name>` (lowercased, as S3 keeps it),
  * `Cache-Control` and `Content-Disposition`. Both buckets build their
@@ -8,3 +8,12 @@ import type { LambderUploadObjectOptions } from "../contracts/LambderUploadBucke
  * every field is pinned by the ticket like the key and the checksum.
  */
 export declare const uploadObjectFormFields: (object: LambderUploadObjectOptions | undefined) => Record<string, string>;
+/**
+ * What a PUT ticket's headers carry for the stored object, as a presigned
+ * PUT sends them: the tag set as the URL-encoded `x-amz-tagging`, each
+ * metadata entry as `x-amz-meta-<name>` (lowercased), `cache-control` and
+ * `content-disposition`. Names are lowercase, as a signature lists them. Both
+ * buckets build their PUT tickets' headers with this, and every one is signed
+ * into the URL like the checksum.
+ */
+export declare const uploadObjectHeaders: (object: LambderUploadObjectOptions | undefined) => Record<string, string>;

package/dist/shared/wire/LambderUploadObjectFields.js

@@ -1,7 +1,7 @@
 import { contentDispositionHeader } from "../util/LambderContentDisposition.js";
 import { escapeXmlText } from "../util/escapeXmlText.js";
 /**
- * What a ticket's form carries for the stored object, in the fields S3's
+ * What a POST ticket's form carries for the stored object, in the fields S3's
  * presigned POST reads them from: the tag set as the XML `tagging` field,
  * each metadata entry as `x-amz-meta-<name>` (lowercased, as S3 keeps it),
  * `Cache-Control` and `Content-Disposition`. Both buckets build their
@@ -22,3 +22,24 @@ export const uploadObjectFormFields = (object) => {
         fields["Content-Disposition"] = contentDispositionHeader(object.contentDisposition);
     return fields;
 };
+/**
+ * What a PUT ticket's headers carry for the stored object, as a presigned
+ * PUT sends them: the tag set as the URL-encoded `x-amz-tagging`, each
+ * metadata entry as `x-amz-meta-<name>` (lowercased), `cache-control` and
+ * `content-disposition`. Names are lowercase, as a signature lists them. Both
+ * buckets build their PUT tickets' headers with this, and every one is signed
+ * into the URL like the checksum.
+ */
+export const uploadObjectHeaders = (object) => {
+    const headers = {};
+    const tags = Object.entries(object?.tags ?? {});
+    if (tags.length)
+        headers["x-amz-tagging"] = new URLSearchParams(tags).toString();
+    for (const [name, value] of Object.entries(object?.metadata ?? {}))
+        headers[`x-amz-meta-${name.toLowerCase()}`] = value;
+    if (object?.cacheControl !== undefined)
+        headers["cache-control"] = object.cacheControl;
+    if (object?.contentDisposition)
+        headers["content-disposition"] = contentDispositionHeader(object.contentDisposition);
+    return headers;
+};

package/dist/shared/wire/LambderUploadSchemas.d.ts

@@ -5,8 +5,14 @@ export declare const LambderUploadFileFactsSchema: z.ZodObject<{
     byteSize: z.ZodNumber;
     sha256Base64: z.ZodString;
 }, z.core.$strip>;
-export declare const LambderUploadTicketSchema: z.ZodObject<{
+export declare const LambderUploadTicketSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"POST">;
     uploadUrl: z.ZodURL;
     formFields: z.ZodRecord<z.ZodString, z.ZodString>;
     expiresAt: z.ZodNumber;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    method: z.ZodLiteral<"PUT">;
+    uploadUrl: z.ZodURL;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>], "method">;

package/dist/shared/wire/LambderUploadSchemas.js

@@ -21,10 +21,21 @@ export const LambderUploadFileFactsSchema = z.object({
     /** SHA-256 of the file's bytes as base64: 32 bytes are always 43 characters and one pad. */
     sha256Base64: z.string().regex(/^[A-Za-z0-9+/]{43}=$/),
 });
-export const LambderUploadTicketSchema = z.object({
-    uploadUrl: z.url(),
-    /** Sent as form fields ahead of the file, which storage wants last. */
-    formFields: z.record(z.string(), z.string()),
-    /** Epoch milliseconds after which storage refuses the ticket. */
-    expiresAt: z.number().int(),
-});
+export const LambderUploadTicketSchema = z.discriminatedUnion("method", [
+    z.object({
+        method: z.literal("POST"),
+        uploadUrl: z.url(),
+        /** Sent as form fields ahead of the file, which storage wants last. */
+        formFields: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+    z.object({
+        method: z.literal("PUT"),
+        uploadUrl: z.url(),
+        /** Sent exactly as given, each one signed into the URL. */
+        headers: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+]);

package/dist/stores/LambderMemoryUploadBucket.d.ts

@@ -1,4 +1,4 @@
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderMemoryUploadBucketOptions = {
     /**
      * The URL tickets and download links point under, which a mock's MSW
@@ -14,6 +14,8 @@ export type LambderMemoryUploadBucketOptions = {
     downloadLifetimeSeconds?: number;
     /** The clock tickets and links expire by, injectable so a test can move past an expiry without waiting. Default: Date.now. */
     now?: () => number;
+    /** How the browser sends a file, as LambderS3UploadBucket's option: a `POST` form or a `PUT`. Default: `POST`. */
+    uploadMethod?: LambderUploadMethod;
 };
 /** What the memory bucket holds under a key, for a test to assert on: the object's facts and what it carries. */
 export type LambderMemoryUploadObject = {
@@ -34,7 +36,11 @@ export type LambderMemoryUploadObject = {
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -47,11 +53,12 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     readonly baseUrl: string;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly now;
     private readonly objects;
     private readonly tickets;
     private readonly links;
-    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now }?: LambderMemoryUploadBucketOptions);
+    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now, uploadMethod }?: LambderMemoryUploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -88,12 +95,19 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     /** Forgets every object, ticket and link. */
     reset(): void;
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     handleStorageRequest(request: Request): Promise<Response | null>;
     private acceptUpload;
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    private acceptPut;
     private serveDownload;
 }

package/dist/stores/LambderMemoryUploadBucket.js

@@ -1,10 +1,10 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
 import { escapeXmlText } from "../shared/util/escapeXmlText.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { sha256Base64Of } from "../shared/util/LambderTextDigest.js";
-/** The form field that names the ticket a post was signed with: the memory bucket's stand-in for S3's signed policy. */
+/** The form field, or for a PUT the query parameter, that names the ticket an upload was signed with: the memory bucket's stand-in for S3's signature. */
 const TICKET_FIELD = "x-lambder-upload-ticket";
 /** The query parameter that names the link a download was issued with: the stand-in for S3's presigned query string. */
 const LINK_PARAMETER = "x-lambder-download-link";
@@ -21,7 +21,11 @@ const LINK_PARAMETER = "x-lambder-download-link";
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -34,11 +38,12 @@ export class LambderMemoryUploadBucket {
     baseUrl;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     now;
     objects = new Map();
     tickets = new Map();
     links = new Map();
-    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now } = {}) {
+    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now, uploadMethod = "POST" } = {}) {
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
         assertSignatureLifetime(downloadLifetimeSeconds, "downloadLifetimeSeconds");
         const url = new URL(baseUrl ?? `https://upload-bucket-${crypto.randomUUID()}.invalid/`);
@@ -47,6 +52,7 @@ export class LambderMemoryUploadBucket {
         this.baseUrl = url.href.endsWith("/") ? url.href : `${url.href}/`;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
         this.now = now;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object = {} }) {
@@ -56,6 +62,19 @@ export class LambderMemoryUploadBucket {
         refuseUnacceptedUpload(uploadRule, fileFacts);
         const ticketId = crypto.randomUUID();
         const expiresAt = this.now() + lifetimeSeconds * 1000;
+        const issued = { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, object };
+        if (this.uploadMethod === "PUT") {
+            // The headers a presigned PUT signs, so a client sends the same ones to either.
+            const headers = {
+                "content-type": fileFacts.mimeType,
+                "x-amz-checksum-sha256": fileFacts.sha256Base64,
+                ...uploadObjectHeaders(object),
+            };
+            this.tickets.set(ticketId, { ...issued, pinned: headers });
+            const uploadUrl = new URL(`${this.baseUrl}${encodeObjectKey(objectKey)}`);
+            uploadUrl.searchParams.set(TICKET_FIELD, ticketId);
+            return { method: "PUT", uploadUrl: uploadUrl.href, headers, expiresAt };
+        }
         // The fields S3's ticket carries, so a client posts the same form to either.
         const formFields = {
             key: objectKey,
@@ -65,8 +84,8 @@ export class LambderMemoryUploadBucket {
             ...uploadObjectFormFields(object),
             [TICKET_FIELD]: ticketId,
         };
-        this.tickets.set(ticketId, { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, formFields, object });
-        return { uploadUrl: this.baseUrl, formFields, expiresAt };
+        this.tickets.set(ticketId, { ...issued, pinned: formFields });
+        return { method: "POST", uploadUrl: this.baseUrl, formFields, expiresAt };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const object = this.objects.get(objectKey);
@@ -125,10 +144,10 @@ export class LambderMemoryUploadBucket {
         this.links.clear();
     }
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     async handleStorageRequest(request) {
         const url = new URL(request.url);
@@ -143,6 +162,8 @@ export class LambderMemoryUploadBucket {
         }
         if (request.method === "POST" && objectKey === "")
             return this.acceptUpload(request);
+        if (request.method === "PUT")
+            return this.acceptPut(request, objectKey, url.searchParams.get(TICKET_FIELD));
         if (request.method === "GET" || request.method === "HEAD")
             return this.serveDownload(objectKey, url.searchParams.get(LINK_PARAMETER), request.method === "HEAD");
         return storageError(405, "MethodNotAllowed", "The specified method is not allowed against this resource.");
@@ -176,10 +197,10 @@ export class LambderMemoryUploadBucket {
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         if (this.now() >= ticket.expiresAt)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy expired.");
-        const extra = [...fields.keys()].filter((name) => !(name in ticket.formFields));
+        const extra = [...fields.keys()].filter((name) => !(name in ticket.pinned));
         if (extra.length)
             return storageError(403, "AccessDenied", `Invalid according to Policy: Extra input fields: ${extra.join(", ")}`);
-        const pinned = Object.entries(ticket.formFields).every(([name, value]) => fields.get(name) === value);
+        const pinned = Object.entries(ticket.pinned).every(([name, value]) => fields.get(name) === value);
         if (!pinned)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         const body = new Uint8Array(await file.arrayBuffer());
@@ -193,6 +214,33 @@ export class LambderMemoryUploadBucket {
         this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
         return new Response(null, { status: 204 });
     }
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    async acceptPut(request, objectKey, ticketId) {
+        const ticket = ticketId === null ? undefined : this.tickets.get(ticketId);
+        const mismatch = () => storageError(403, "SignatureDoesNotMatch", "The request signature we calculated does not match the signature you provided. Check your key and signing method.");
+        if (!ticket || ticket.objectKey !== objectKey)
+            return mismatch();
+        if (this.now() >= ticket.expiresAt)
+            return storageError(403, "AccessDenied", "Request has expired");
+        const unsigned = [...request.headers.keys()].filter((name) => name.startsWith("x-amz-") && !(name in ticket.pinned));
+        if (unsigned.length)
+            return storageError(403, "AccessDenied", `There were headers present in the request which were not signed: ${unsigned.join(", ")}`);
+        if (!Object.entries(ticket.pinned).every(([name, value]) => request.headers.get(name) === value))
+            return mismatch();
+        const body = new Uint8Array(await request.arrayBuffer());
+        if (body.byteLength !== ticket.byteSize)
+            return mismatch();
+        const sha256Base64 = await sha256Base64Of(body);
+        if (sha256Base64 !== ticket.sha256Base64)
+            return storageError(400, "BadDigest", "The SHA256 you specified did not match the calculated checksum.");
+        this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
+        return new Response(null, { status: 200 });
+    }
     serveDownload(objectKey, linkId, headOnly) {
         const link = linkId === null ? undefined : this.links.get(linkId);
         if (!link || link.objectKey !== objectKey)

package/dist/stores/LambderS3UploadBucket.d.ts

@@ -1,5 +1,5 @@
 import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderS3UploadBucketOptions = {
     bucket: string;
     /** A ready client, e.g. one shared with the rest of the app. */
@@ -10,6 +10,14 @@ export type LambderS3UploadBucketOptions = {
     ticketLifetimeSeconds?: number;
     /** How long a download link reads the object, unless a link says otherwise. Default: 300 seconds. */
     downloadLifetimeSeconds?: number;
+    /**
+     * How the browser sends a file: `POST`, a presigned POST, which S3 takes;
+     * or `PUT`, a presigned PUT, for a store that has no POST policies
+     * (Cloudflare R2). Both pin the same facts. Default: `POST`. The bucket
+     * cannot tell S3 from another store behind an endpoint, so a store that
+     * refuses POST is named here.
+     */
+    uploadMethod?: LambderUploadMethod;
 };
 /**
  * An S3 bucket browsers upload to directly (see LambderUploadBucket).
@@ -17,7 +25,10 @@ export type LambderS3UploadBucketOptions = {
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -32,12 +43,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
     private readonly bucket;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly clientConfig;
     private client;
     private clientSdk;
     private presignedPostSdk;
     private requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds }: LambderS3UploadBucketOptions);
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds, uploadMethod }: LambderS3UploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -45,6 +57,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
         lifetimeSeconds?: number;
         object?: LambderUploadObjectOptions;
     }): Promise<LambderUploadTicket>;
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    private issuePutTicket;
     verifyUploadedObject({ objectKey, fileFacts }: {
         objectKey: string;
         fileFacts: Pick<LambderUploadFileFacts, "byteSize" | "sha256Base64">;

package/dist/stores/LambderS3UploadBucket.js

@@ -1,6 +1,6 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { withInstallHint } from "./LambderSdkInstallHint.js";
 /** The S3 error names that mean nothing is stored under the key: HeadObject answers NotFound, the other calls NoSuchKey. */
@@ -11,7 +11,10 @@ const MISSING_OBJECT_ERROR_NAMES = ["NotFound", "NoSuchKey"];
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -26,12 +29,13 @@ export class LambderS3UploadBucket {
     bucket;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     clientConfig;
     client;
     clientSdk;
     presignedPostSdk;
     requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300 }) {
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, uploadMethod = "POST" }) {
         if (!bucket.trim())
             throw new Error("bucket is required");
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
@@ -41,12 +45,15 @@ export class LambderS3UploadBucket {
         this.clientConfig = clientConfig;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object }) {
         assertPinnedObjectKey(objectKey);
         assertSignatureLifetime(lifetimeSeconds, "lifetimeSeconds");
         assertObjectOptions(object);
         refuseUnacceptedUpload(uploadRule, fileFacts);
+        if (this.uploadMethod === "PUT")
+            return this.issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object);
         const [{ client }, { createPresignedPost }] = await Promise.all([this.s3(), this.loadPresignedPostSdk()]);
         const post = await createPresignedPost(client, {
             Bucket: this.bucket,
@@ -61,7 +68,47 @@ export class LambderS3UploadBucket {
             },
             Conditions: [["content-length-range", fileFacts.byteSize, fileFacts.byteSize]],
         });
-        return { uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+        return { method: "POST", uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+    }
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    async issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object) {
+        const headers = {
+            "content-type": fileFacts.mimeType,
+            "x-amz-checksum-sha256": fileFacts.sha256Base64,
+            ...uploadObjectHeaders(object),
+        };
+        const [{ sdk, client }, { getSignedUrl }] = await Promise.all([this.s3(), this.loadRequestPresignerSdk()]);
+        const tags = Object.entries(object?.tags ?? {});
+        const metadata = Object.entries(object?.metadata ?? {});
+        const uploadUrl = await getSignedUrl(client, new sdk.PutObjectCommand({
+            Bucket: this.bucket,
+            Key: objectKey,
+            ContentType: fileFacts.mimeType,
+            ContentLength: fileFacts.byteSize,
+            ChecksumSHA256: fileFacts.sha256Base64,
+            ...(tags.length ? { Tagging: new URLSearchParams(tags).toString() } : {}),
+            ...(metadata.length ? { Metadata: Object.fromEntries(metadata.map(([name, value]) => [name.toLowerCase(), value])) } : {}),
+            ...(object?.cacheControl !== undefined ? { CacheControl: object.cacheControl } : {}),
+            ...(object?.contentDisposition ? { ContentDisposition: contentDispositionHeader(object.contentDisposition) } : {}),
+        }), {
+            expiresIn: lifetimeSeconds,
+            signableHeaders: new Set([...Object.keys(headers), "content-length"]),
+            unhoistableHeaders: new Set(Object.keys(headers).filter((name) => name.startsWith("x-amz-"))),
+        });
+        // What the URL is signed for must be what the ticket sends, or the
+        // store refuses every upload with it: said here, where it is written,
+        // rather than as a refused upload in a browser.
+        const signed = (new URL(uploadUrl).searchParams.get("X-Amz-SignedHeaders") ?? "").split(";").filter((name) => name !== "host" && name !== "content-length");
+        const sent = Object.keys(headers);
+        if (signed.length !== sent.length || !sent.every((name) => signed.includes(name))) {
+            throw new Error(`LambderS3UploadBucket: a PUT ticket's URL is signed for [${signed.join(", ")}] but the ticket sends [${sent.join(", ")}]`);
+        }
+        return { method: "PUT", uploadUrl, headers, expiresAt: Date.now() + lifetimeSeconds * 1000 };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const { sdk, client } = await this.s3();

package/dist/testing/LambderTestVisitor.d.ts

@@ -5,7 +5,7 @@ import { type LambderLambdaHttpResult } from "../invoke/LambderLambdaEvent.js";
 import type { LambderCreatedSession } from "../session/LambderSessionManager.js";
 import { LambderCookieJar } from "../shared/transport/LambderCookieJar.js";
 import type { LambderApiContractShape } from "../shared/wire/LambderApiContract.js";
-import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
 import type { LambderGuardInputsProviderOption } from "../shared/wire/LambderCallOptions.js";
 /**
  * How one visitor differs from the next. Everything is optional: a visitor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "9.0.1",
+  "version": "9.0.3",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [