lambder 9.0.2 → 10.0.1

package/dist/shared/wire/LambderUploadObjectFields.js

@@ -1,7 +1,7 @@
 import { contentDispositionHeader } from "../util/LambderContentDisposition.js";
 import { escapeXmlText } from "../util/escapeXmlText.js";
 /**
- * What a ticket's form carries for the stored object, in the fields S3's
+ * What a POST ticket's form carries for the stored object, in the fields S3's
  * presigned POST reads them from: the tag set as the XML `tagging` field,
  * each metadata entry as `x-amz-meta-<name>` (lowercased, as S3 keeps it),
  * `Cache-Control` and `Content-Disposition`. Both buckets build their
@@ -22,3 +22,24 @@ export const uploadObjectFormFields = (object) => {
         fields["Content-Disposition"] = contentDispositionHeader(object.contentDisposition);
     return fields;
 };
+/**
+ * What a PUT ticket's headers carry for the stored object, as a presigned
+ * PUT sends them: the tag set as the URL-encoded `x-amz-tagging`, each
+ * metadata entry as `x-amz-meta-<name>` (lowercased), `cache-control` and
+ * `content-disposition`. Names are lowercase, as a signature lists them. Both
+ * buckets build their PUT tickets' headers with this, and every one is signed
+ * into the URL like the checksum.
+ */
+export const uploadObjectHeaders = (object) => {
+    const headers = {};
+    const tags = Object.entries(object?.tags ?? {});
+    if (tags.length)
+        headers["x-amz-tagging"] = new URLSearchParams(tags).toString();
+    for (const [name, value] of Object.entries(object?.metadata ?? {}))
+        headers[`x-amz-meta-${name.toLowerCase()}`] = value;
+    if (object?.cacheControl !== undefined)
+        headers["cache-control"] = object.cacheControl;
+    if (object?.contentDisposition)
+        headers["content-disposition"] = contentDispositionHeader(object.contentDisposition);
+    return headers;
+};

package/dist/shared/wire/LambderUploadSchemas.d.ts

@@ -5,8 +5,14 @@ export declare const LambderUploadFileFactsSchema: z.ZodObject<{
     byteSize: z.ZodNumber;
     sha256Base64: z.ZodString;
 }, z.core.$strip>;
-export declare const LambderUploadTicketSchema: z.ZodObject<{
+export declare const LambderUploadTicketSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"POST">;
     uploadUrl: z.ZodURL;
     formFields: z.ZodRecord<z.ZodString, z.ZodString>;
     expiresAt: z.ZodNumber;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    method: z.ZodLiteral<"PUT">;
+    uploadUrl: z.ZodURL;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>], "method">;

package/dist/shared/wire/LambderUploadSchemas.js

@@ -21,10 +21,21 @@ export const LambderUploadFileFactsSchema = z.object({
     /** SHA-256 of the file's bytes as base64: 32 bytes are always 43 characters and one pad. */
     sha256Base64: z.string().regex(/^[A-Za-z0-9+/]{43}=$/),
 });
-export const LambderUploadTicketSchema = z.object({
-    uploadUrl: z.url(),
-    /** Sent as form fields ahead of the file, which storage wants last. */
-    formFields: z.record(z.string(), z.string()),
-    /** Epoch milliseconds after which storage refuses the ticket. */
-    expiresAt: z.number().int(),
-});
+export const LambderUploadTicketSchema = z.discriminatedUnion("method", [
+    z.object({
+        method: z.literal("POST"),
+        uploadUrl: z.url(),
+        /** Sent as form fields ahead of the file, which storage wants last. */
+        formFields: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+    z.object({
+        method: z.literal("PUT"),
+        uploadUrl: z.url(),
+        /** Sent exactly as given, each one signed into the URL. */
+        headers: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+]);

package/dist/stores/LambderMemoryUploadBucket.d.ts

@@ -1,4 +1,4 @@
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderMemoryUploadBucketOptions = {
     /**
      * The URL tickets and download links point under, which a mock's MSW
@@ -14,6 +14,8 @@ export type LambderMemoryUploadBucketOptions = {
     downloadLifetimeSeconds?: number;
     /** The clock tickets and links expire by, injectable so a test can move past an expiry without waiting. Default: Date.now. */
     now?: () => number;
+    /** How the browser sends a file, as LambderS3UploadBucket's option: a `POST` form or a `PUT`. Default: `POST`. */
+    uploadMethod?: LambderUploadMethod;
 };
 /** What the memory bucket holds under a key, for a test to assert on: the object's facts and what it carries. */
 export type LambderMemoryUploadObject = {
@@ -34,7 +36,11 @@ export type LambderMemoryUploadObject = {
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -47,11 +53,12 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     readonly baseUrl: string;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly now;
     private readonly objects;
     private readonly tickets;
     private readonly links;
-    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now }?: LambderMemoryUploadBucketOptions);
+    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now, uploadMethod }?: LambderMemoryUploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -88,12 +95,19 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     /** Forgets every object, ticket and link. */
     reset(): void;
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     handleStorageRequest(request: Request): Promise<Response | null>;
     private acceptUpload;
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    private acceptPut;
     private serveDownload;
 }

package/dist/stores/LambderMemoryUploadBucket.js

@@ -1,10 +1,10 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
 import { escapeXmlText } from "../shared/util/escapeXmlText.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { sha256Base64Of } from "../shared/util/LambderTextDigest.js";
-/** The form field that names the ticket a post was signed with: the memory bucket's stand-in for S3's signed policy. */
+/** The form field, or for a PUT the query parameter, that names the ticket an upload was signed with: the memory bucket's stand-in for S3's signature. */
 const TICKET_FIELD = "x-lambder-upload-ticket";
 /** The query parameter that names the link a download was issued with: the stand-in for S3's presigned query string. */
 const LINK_PARAMETER = "x-lambder-download-link";
@@ -21,7 +21,11 @@ const LINK_PARAMETER = "x-lambder-download-link";
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -34,11 +38,12 @@ export class LambderMemoryUploadBucket {
     baseUrl;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     now;
     objects = new Map();
     tickets = new Map();
     links = new Map();
-    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now } = {}) {
+    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now, uploadMethod = "POST" } = {}) {
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
         assertSignatureLifetime(downloadLifetimeSeconds, "downloadLifetimeSeconds");
         const url = new URL(baseUrl ?? `https://upload-bucket-${crypto.randomUUID()}.invalid/`);
@@ -47,6 +52,7 @@ export class LambderMemoryUploadBucket {
         this.baseUrl = url.href.endsWith("/") ? url.href : `${url.href}/`;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
         this.now = now;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object = {} }) {
@@ -56,6 +62,19 @@ export class LambderMemoryUploadBucket {
         refuseUnacceptedUpload(uploadRule, fileFacts);
         const ticketId = crypto.randomUUID();
         const expiresAt = this.now() + lifetimeSeconds * 1000;
+        const issued = { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, object };
+        if (this.uploadMethod === "PUT") {
+            // The headers a presigned PUT signs, so a client sends the same ones to either.
+            const headers = {
+                "content-type": fileFacts.mimeType,
+                "x-amz-checksum-sha256": fileFacts.sha256Base64,
+                ...uploadObjectHeaders(object),
+            };
+            this.tickets.set(ticketId, { ...issued, pinned: headers });
+            const uploadUrl = new URL(`${this.baseUrl}${encodeObjectKey(objectKey)}`);
+            uploadUrl.searchParams.set(TICKET_FIELD, ticketId);
+            return { method: "PUT", uploadUrl: uploadUrl.href, headers, expiresAt };
+        }
         // The fields S3's ticket carries, so a client posts the same form to either.
         const formFields = {
             key: objectKey,
@@ -65,8 +84,8 @@ export class LambderMemoryUploadBucket {
             ...uploadObjectFormFields(object),
             [TICKET_FIELD]: ticketId,
         };
-        this.tickets.set(ticketId, { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, formFields, object });
-        return { uploadUrl: this.baseUrl, formFields, expiresAt };
+        this.tickets.set(ticketId, { ...issued, pinned: formFields });
+        return { method: "POST", uploadUrl: this.baseUrl, formFields, expiresAt };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const object = this.objects.get(objectKey);
@@ -125,10 +144,10 @@ export class LambderMemoryUploadBucket {
         this.links.clear();
     }
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     async handleStorageRequest(request) {
         const url = new URL(request.url);
@@ -143,6 +162,8 @@ export class LambderMemoryUploadBucket {
         }
         if (request.method === "POST" && objectKey === "")
             return this.acceptUpload(request);
+        if (request.method === "PUT")
+            return this.acceptPut(request, objectKey, url.searchParams.get(TICKET_FIELD));
         if (request.method === "GET" || request.method === "HEAD")
             return this.serveDownload(objectKey, url.searchParams.get(LINK_PARAMETER), request.method === "HEAD");
         return storageError(405, "MethodNotAllowed", "The specified method is not allowed against this resource.");
@@ -176,10 +197,10 @@ export class LambderMemoryUploadBucket {
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         if (this.now() >= ticket.expiresAt)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy expired.");
-        const extra = [...fields.keys()].filter((name) => !(name in ticket.formFields));
+        const extra = [...fields.keys()].filter((name) => !(name in ticket.pinned));
         if (extra.length)
             return storageError(403, "AccessDenied", `Invalid according to Policy: Extra input fields: ${extra.join(", ")}`);
-        const pinned = Object.entries(ticket.formFields).every(([name, value]) => fields.get(name) === value);
+        const pinned = Object.entries(ticket.pinned).every(([name, value]) => fields.get(name) === value);
         if (!pinned)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         const body = new Uint8Array(await file.arrayBuffer());
@@ -193,6 +214,33 @@ export class LambderMemoryUploadBucket {
         this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
         return new Response(null, { status: 204 });
     }
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    async acceptPut(request, objectKey, ticketId) {
+        const ticket = ticketId === null ? undefined : this.tickets.get(ticketId);
+        const mismatch = () => storageError(403, "SignatureDoesNotMatch", "The request signature we calculated does not match the signature you provided. Check your key and signing method.");
+        if (!ticket || ticket.objectKey !== objectKey)
+            return mismatch();
+        if (this.now() >= ticket.expiresAt)
+            return storageError(403, "AccessDenied", "Request has expired");
+        const unsigned = [...request.headers.keys()].filter((name) => name.startsWith("x-amz-") && !(name in ticket.pinned));
+        if (unsigned.length)
+            return storageError(403, "AccessDenied", `There were headers present in the request which were not signed: ${unsigned.join(", ")}`);
+        if (!Object.entries(ticket.pinned).every(([name, value]) => request.headers.get(name) === value))
+            return mismatch();
+        const body = new Uint8Array(await request.arrayBuffer());
+        if (body.byteLength !== ticket.byteSize)
+            return mismatch();
+        const sha256Base64 = await sha256Base64Of(body);
+        if (sha256Base64 !== ticket.sha256Base64)
+            return storageError(400, "BadDigest", "The SHA256 you specified did not match the calculated checksum.");
+        this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
+        return new Response(null, { status: 200 });
+    }
     serveDownload(objectKey, linkId, headOnly) {
         const link = linkId === null ? undefined : this.links.get(linkId);
         if (!link || link.objectKey !== objectKey)

package/dist/stores/LambderS3UploadBucket.d.ts

@@ -1,5 +1,5 @@
 import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderS3UploadBucketOptions = {
     bucket: string;
     /** A ready client, e.g. one shared with the rest of the app. */
@@ -10,6 +10,14 @@ export type LambderS3UploadBucketOptions = {
     ticketLifetimeSeconds?: number;
     /** How long a download link reads the object, unless a link says otherwise. Default: 300 seconds. */
     downloadLifetimeSeconds?: number;
+    /**
+     * How the browser sends a file: `POST`, a presigned POST, which S3 takes;
+     * or `PUT`, a presigned PUT, for a store that has no POST policies
+     * (Cloudflare R2). Both pin the same facts. Default: `POST`. The bucket
+     * cannot tell S3 from another store behind an endpoint, so a store that
+     * refuses POST is named here.
+     */
+    uploadMethod?: LambderUploadMethod;
 };
 /**
  * An S3 bucket browsers upload to directly (see LambderUploadBucket).
@@ -17,7 +25,10 @@ export type LambderS3UploadBucketOptions = {
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -32,12 +43,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
     private readonly bucket;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly clientConfig;
     private client;
     private clientSdk;
     private presignedPostSdk;
     private requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds }: LambderS3UploadBucketOptions);
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds, uploadMethod }: LambderS3UploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -45,6 +57,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
         lifetimeSeconds?: number;
         object?: LambderUploadObjectOptions;
     }): Promise<LambderUploadTicket>;
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    private issuePutTicket;
     verifyUploadedObject({ objectKey, fileFacts }: {
         objectKey: string;
         fileFacts: Pick<LambderUploadFileFacts, "byteSize" | "sha256Base64">;

package/dist/stores/LambderS3UploadBucket.js

@@ -1,6 +1,6 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { withInstallHint } from "./LambderSdkInstallHint.js";
 /** The S3 error names that mean nothing is stored under the key: HeadObject answers NotFound, the other calls NoSuchKey. */
@@ -11,7 +11,10 @@ const MISSING_OBJECT_ERROR_NAMES = ["NotFound", "NoSuchKey"];
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -26,12 +29,13 @@ export class LambderS3UploadBucket {
     bucket;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     clientConfig;
     client;
     clientSdk;
     presignedPostSdk;
     requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300 }) {
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, uploadMethod = "POST" }) {
         if (!bucket.trim())
             throw new Error("bucket is required");
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
@@ -41,12 +45,15 @@ export class LambderS3UploadBucket {
         this.clientConfig = clientConfig;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object }) {
         assertPinnedObjectKey(objectKey);
         assertSignatureLifetime(lifetimeSeconds, "lifetimeSeconds");
         assertObjectOptions(object);
         refuseUnacceptedUpload(uploadRule, fileFacts);
+        if (this.uploadMethod === "PUT")
+            return this.issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object);
         const [{ client }, { createPresignedPost }] = await Promise.all([this.s3(), this.loadPresignedPostSdk()]);
         const post = await createPresignedPost(client, {
             Bucket: this.bucket,
@@ -61,7 +68,47 @@ export class LambderS3UploadBucket {
             },
             Conditions: [["content-length-range", fileFacts.byteSize, fileFacts.byteSize]],
         });
-        return { uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+        return { method: "POST", uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+    }
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    async issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object) {
+        const headers = {
+            "content-type": fileFacts.mimeType,
+            "x-amz-checksum-sha256": fileFacts.sha256Base64,
+            ...uploadObjectHeaders(object),
+        };
+        const [{ sdk, client }, { getSignedUrl }] = await Promise.all([this.s3(), this.loadRequestPresignerSdk()]);
+        const tags = Object.entries(object?.tags ?? {});
+        const metadata = Object.entries(object?.metadata ?? {});
+        const uploadUrl = await getSignedUrl(client, new sdk.PutObjectCommand({
+            Bucket: this.bucket,
+            Key: objectKey,
+            ContentType: fileFacts.mimeType,
+            ContentLength: fileFacts.byteSize,
+            ChecksumSHA256: fileFacts.sha256Base64,
+            ...(tags.length ? { Tagging: new URLSearchParams(tags).toString() } : {}),
+            ...(metadata.length ? { Metadata: Object.fromEntries(metadata.map(([name, value]) => [name.toLowerCase(), value])) } : {}),
+            ...(object?.cacheControl !== undefined ? { CacheControl: object.cacheControl } : {}),
+            ...(object?.contentDisposition ? { ContentDisposition: contentDispositionHeader(object.contentDisposition) } : {}),
+        }), {
+            expiresIn: lifetimeSeconds,
+            signableHeaders: new Set([...Object.keys(headers), "content-length"]),
+            unhoistableHeaders: new Set(Object.keys(headers).filter((name) => name.startsWith("x-amz-"))),
+        });
+        // What the URL is signed for must be what the ticket sends, or the
+        // store refuses every upload with it: said here, where it is written,
+        // rather than as a refused upload in a browser.
+        const signed = (new URL(uploadUrl).searchParams.get("X-Amz-SignedHeaders") ?? "").split(";").filter((name) => name !== "host" && name !== "content-length");
+        const sent = Object.keys(headers);
+        if (signed.length !== sent.length || !sent.every((name) => signed.includes(name))) {
+            throw new Error(`LambderS3UploadBucket: a PUT ticket's URL is signed for [${signed.join(", ")}] but the ticket sends [${sent.join(", ")}]`);
+        }
+        return { method: "PUT", uploadUrl, headers, expiresAt: Date.now() + lifetimeSeconds * 1000 };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const { sdk, client } = await this.s3();

package/dist/testing/LambderTestApp.d.ts

@@ -51,7 +51,7 @@ export type LambderTestAppOptions = {
  * (`lambderTestApp<SessionData, ApiContractType>(lambder)`), so the tests type
  * their calls against plain members rather than the chained intersection.
  */
-export type LambderTestedInstance<TSessionData, TContract> = Lambder<TSessionData, any, any, any, any, any, any, any> & {
+export type LambderTestedInstance<TSessionData, TContract> = Lambder<TSessionData, any, any, any, any, any, any, any, any, any> & {
     readonly ApiContract: TContract;
 };
 /**

package/dist/testing.d.ts

@@ -17,7 +17,7 @@
 export { lambderTestApp } from "./testing/LambderTestApp.js";
 export type { LambderTestApp, LambderTestAppOptions, LambderTestedInstance } from "./testing/LambderTestApp.js";
 export type { LambderTestVisitor, LambderTestVisitorOptions, LambderTestRequestInit } from "./testing/LambderTestVisitor.js";
-export { assertApiSuccess, assertApiFailure } from "./shared/wire/LambderOutcomeAssertions.js";
+export { assertApiSuccess, assertApiFailure, assertApiRefusal } from "./shared/wire/LambderOutcomeAssertions.js";
 export type { LambderExpectedFailure } from "./shared/wire/LambderOutcomeAssertions.js";
 export { lambderSessionStoreConformance } from "./testing/lambderSessionStoreConformance.js";
 export type { LambderSessionStoreConformanceOptions } from "./testing/lambderSessionStoreConformance.js";

package/dist/testing.js

@@ -15,7 +15,7 @@
  * writes itself.
  */
 export { lambderTestApp } from "./testing/LambderTestApp.js";
-export { assertApiSuccess, assertApiFailure } from "./shared/wire/LambderOutcomeAssertions.js";
+export { assertApiSuccess, assertApiFailure, assertApiRefusal } from "./shared/wire/LambderOutcomeAssertions.js";
 // The rules each store interface promises, as cases an app registers with its
 // own runner's `it` and `expect` to hold a store it writes over its own
 // database to the same rules Lambder's memory and DynamoDB stores meet.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "9.0.2",
+  "version": "10.0.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [