lambder 9.0.2 → 9.0.3

package/README.md

@@ -69,8 +69,9 @@ const company = await caller.api("getCompany", { slug: "acme" });
 - **Frontend hosting.** Serve a build from a folder, S3, R2 or any HTTP
   origin, with an app shell rendered through a build-pipeline-safe template
   engine.
-- **Direct uploads.** Files go from the browser straight to S3 on tickets
-  that pin their size, type and SHA-256, with a browser runner that hashes,
+- **Direct uploads.** Files go from the browser straight to S3, or to R2 on
+  presigned PUTs, on tickets that pin their size, type and SHA-256, with a
+  browser runner that hashes,
   retries and reports progress, and a memory bucket that holds tests and the
   mock to the same rules.
 - **Runs anywhere Lambda does.** API Gateway REST APIs (payload v1), HTTP APIs
@@ -163,7 +164,7 @@ guide that matches what you are building. The full index lives in
 | [The API core](./docs/api-core.md) | `LambderApiPipeline`: the one pipeline the server and the mock runtime run, the store interfaces, the transports |
 | [Frontend client](./docs/client.md) | `LambderCaller`: typed calls, failure outcomes, timeouts, guard inputs, request compression, transports |
 | [Frontend hosting](./docs/frontend-hosting.md) | File sources, `servePublicFiles`, `serveIndexHtml`, `res.templateFile` |
-| [Direct uploads](./docs/uploads.md) | Files the browser posts straight to S3 with tickets the server signs, verified before they count |
+| [Direct uploads](./docs/uploads.md) | Files the browser sends straight to S3 or R2 with tickets the server signs, verified before they count |
 | [Templating](./docs/templating.md) | `html`/`xml` tagged templates and `LambderTemplatingEngine` |
 | [Translations](./docs/i18n.md) | `createLambderI18n`: typed keys, extension, detection, on-demand languages, runtime dictionaries |
 | [The mock runtime](./docs/mock.md) | `LambderMockApp`: the typed contract served from mock handlers over the real pipeline, in the browser and in tests |

package/dist/client/LambderUploadRunner.d.ts

@@ -60,9 +60,9 @@ export type LambderUploadRunnerOptions<Reference, Receipt> = {
         maxDelayMs?: number;
     };
     /**
-     * How long a post may be open and move nothing before it counts as
-     * dropped. Default: 60 seconds. Watched where XMLHttpRequest exists,
-     * which reports a body's progress; a runtime with only fetch posts
+     * How long an upload to storage may be open and move nothing before it
+     * counts as dropped. Default: 60 seconds. Watched where XMLHttpRequest exists,
+     * which reports a body's progress; a runtime with only fetch uploads
      * unwatched.
      */
     stallTimeoutMs?: number;
@@ -91,6 +91,6 @@ export declare class LambderUploadRunner<Reference, Receipt> {
     }): Promise<Receipt>;
     /** Forgets a confirmed upload through the app's endpoint, when it declared one. */
     discard(receipt: Receipt): Promise<void>;
-    /** One post of the file to storage. Never throws: every ending is an outcome. */
-    private post;
+    /** One upload of the file to storage, in the ticket's form. Never throws: every ending is an outcome. */
+    private send;
 }

package/dist/client/LambderUploadRunner.js

@@ -90,7 +90,7 @@ export class LambderUploadRunner {
         for (;;) {
             stopIfCancelled();
             report("uploading");
-            const outcome = await this.post(issued.ticket, file, signal, (sentBytes) => report("uploading", sentBytes));
+            const outcome = await this.send(issued.ticket, file, signal, (sentBytes) => report("uploading", sentBytes));
             if (outcome.kind === "stored")
                 break;
             if (outcome.kind === "cancelled")
@@ -124,22 +124,29 @@ export class LambderUploadRunner {
     async discard(receipt) {
         await this.options.discardUpload?.(receipt);
     }
-    /** One post of the file to storage. Never throws: every ending is an outcome. */
-    post(ticket, file, signal, onSent) {
+    /** One upload of the file to storage, in the ticket's form. Never throws: every ending is an outcome. */
+    send(ticket, file, signal, onSent) {
         if (signal?.aborted)
             return Promise.resolve({ kind: "cancelled" });
-        const form = new FormData();
-        for (const [name, value] of Object.entries(ticket.formFields))
-            form.append(name, value);
-        // Storage ignores every field that comes after the file.
-        form.append("file", file);
+        let request;
+        if (ticket.method === "PUT") {
+            request = { method: "PUT", url: ticket.uploadUrl, body: file, headers: ticket.headers };
+        }
+        else {
+            const form = new FormData();
+            for (const [name, value] of Object.entries(ticket.formFields))
+                form.append(name, value);
+            // Storage ignores every field that comes after the file.
+            form.append("file", file);
+            request = { method: "POST", url: ticket.uploadUrl, body: form, headers: {} };
+        }
         return typeof XMLHttpRequest === "function"
-            ? postWithXhr(ticket.uploadUrl, form, file.size, this.stallTimeoutMs, signal, onSent)
-            : postWithFetch(ticket.uploadUrl, form, file.size, signal, onSent);
+            ? sendWithXhr(request, file.size, this.stallTimeoutMs, signal, onSent)
+            : sendWithFetch(request, file.size, signal, onSent);
     }
 }
 /** XMLHttpRequest rather than fetch where it exists: fetch cannot report how much of a request body has been sent. */
-const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => new Promise((resolve) => {
+const sendWithXhr = ({ method, url, body, headers }, fileBytes, stallTimeoutMs, signal, onSent) => new Promise((resolve) => {
     const request = new XMLHttpRequest();
     let stalled = false;
     let stallTimer;
@@ -158,7 +165,7 @@ const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => ne
     };
     request.upload.onprogress = (event) => {
         watchForStall();
-        // `loaded` counts the form's own framing too, a little over the file.
+        // A form's `loaded` counts its own framing too, a little over the file.
         onSent(Math.min(event.loaded, fileBytes));
     };
     request.onload = () => {
@@ -173,18 +180,20 @@ const postWithXhr = (url, form, fileBytes, stallTimeoutMs, signal, onSent) => ne
     signal?.addEventListener("abort", cancel, { once: true });
     watchForStall();
     try {
-        request.open("POST", url);
-        request.send(form);
+        request.open(method, url);
+        for (const [name, value] of Object.entries(headers))
+            request.setRequestHeader(name, value);
+        request.send(body);
     }
     catch {
         // A URL the browser will not open, or a request it will not send, answers nothing.
         settle({ kind: "unreachable" });
     }
 });
-const postWithFetch = async (url, form, fileBytes, signal, onSent) => {
+const sendWithFetch = async ({ method, url, body, headers }, fileBytes, signal, onSent) => {
     let response;
     try {
-        response = await fetch(url, { method: "POST", body: form, signal });
+        response = await fetch(url, { method, body, headers, signal });
     }
     catch {
         return signal?.aborted ? { kind: "cancelled" } : { kind: "unreachable" };

package/dist/client.d.ts

@@ -46,4 +46,4 @@ export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";
 export type { LambderUploadRunnerOptions, LambderUploadProgress, LambderUploadPhase, LambderUploadFailureReason } from "./client/LambderUploadRunner.js";
 export { checkUploadRule } from "./shared/contracts/LambderUploadBucket.js";
-export type { LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadRuleVerdict } from "./shared/contracts/LambderUploadBucket.js";
+export type { LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadMethod, LambderUploadRuleVerdict } from "./shared/contracts/LambderUploadBucket.js";

package/dist/index.d.ts

@@ -88,7 +88,7 @@ export type { LambderS3UploadBucketOptions } from "./stores/LambderS3UploadBucke
 export { LambderMemoryUploadBucket } from "./stores/LambderMemoryUploadBucket.js";
 export type { LambderMemoryUploadBucketOptions, LambderMemoryUploadObject } from "./stores/LambderMemoryUploadBucket.js";
 export { checkUploadRule } from "./shared/contracts/LambderUploadBucket.js";
-export type { LambderUploadBucket, LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadVerdict, LambderUploadRuleVerdict, LambderUploadObjectOptions, LambderUploadContentDisposition, } from "./shared/contracts/LambderUploadBucket.js";
+export type { LambderUploadBucket, LambderUploadRule, LambderUploadFileFacts, LambderUploadTicket, LambderUploadMethod, LambderUploadVerdict, LambderUploadRuleVerdict, LambderUploadObjectOptions, LambderUploadContentDisposition, } from "./shared/contracts/LambderUploadBucket.js";
 export { LambderUploadFileFactsSchema, LambderUploadTicketSchema } from "./shared/wire/LambderUploadSchemas.js";
 export { refuseUnacceptedUpload } from "./shared/wire/LambderUploadRefusal.js";
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";

package/dist/shared/contracts/LambderUploadBucket.d.ts

@@ -13,14 +13,29 @@ export type LambderUploadFileFacts = {
     /** SHA-256 of the file's bytes as base64, the form storage checks an upload against: 43 characters and one pad. */
     sha256Base64: string;
 };
-/** Everything the browser needs to post one file to storage, and until when. */
+/**
+ * Everything the browser needs to send one file to storage, and until when,
+ * in one of the two forms a store signs. `POST` is a form (S3's presigned
+ * POST), `PUT` the file as the body of a signed URL (a presigned PUT, which
+ * Cloudflare R2 and other stores without POST policies take).
+ */
 export type LambderUploadTicket = {
+    method: "POST";
     uploadUrl: string;
     /** Sent as form fields ahead of the file, which storage wants last. */
     formFields: Record<string, string>;
     /** Epoch milliseconds after which storage refuses the ticket. */
     expiresAt: number;
+} | {
+    method: "PUT";
+    uploadUrl: string;
+    /** Sent exactly as given, each one signed into the URL; the browser adds the length itself. */
+    headers: Record<string, string>;
+    /** Epoch milliseconds after which storage refuses the ticket. */
+    expiresAt: number;
 };
+/** How a bucket's tickets send a file: the `method` of the tickets it signs. */
+export type LambderUploadMethod = LambderUploadTicket["method"];
 /** What a bucket holds under a key, compared with what the browser said it would upload. */
 export type LambderUploadVerdict = {
     verified: true;
@@ -38,7 +53,7 @@ export type LambderUploadContentDisposition = {
 };
 /**
  * What storage keeps beside an object's bytes. A ticket pins every one of
- * these in its signed policy, so the browser posts them unchanged.
+ * these in its signature, so the browser sends them unchanged.
  */
 export type LambderUploadObjectOptions = {
     /**
@@ -91,7 +106,7 @@ export interface LambderUploadBucket {
      * Signs a ticket for exactly the file the browser described, or refuses
      * (a LambderApiRefusal, code `lambder/upload-empty`,
      * `lambder/upload-type-rejected` or `lambder/upload-too-large`) when the
-     * rule does not accept it. Storage then enforces every fact: the post
+     * rule does not accept it. Storage then enforces every fact: the upload
      * fails unless the body has that byte size, that content type and that
      * SHA-256, so what verifies later is what was described here. `object`
      * is what the stored object carries besides, pinned the same way, and

package/dist/shared/contracts/LambderUploadBucket.js

@@ -4,7 +4,7 @@
  *
  * An API payload tops out near a few megabytes once a file is base64, and a
  * Lambda's request body at six, so anything larger (a scanned lease, a
- * signed PDF, a video) is posted by the browser to the bucket itself, with a
+ * signed PDF, a video) is sent by the browser to the bucket itself, with a
  * ticket the server signed beforehand. The ticket pins everything about the
  * upload: the key, the exact byte size, the content type and the SHA-256 of
  * the bytes, all enforced by the storage, so the browser can only ever store
@@ -12,7 +12,7 @@
  *
  * The conversation is the same three steps whatever the app stores: the
  * browser describes the file (LambderUploadFileFacts), the app's endpoint
- * answers with a ticket (LambderUploadTicket), and after the post the app's
+ * answers with a ticket (LambderUploadTicket), and after the upload the app's
  * confirm endpoint asks the bucket what arrived before its record counts as
  * uploaded. The server half is a LambderUploadBucket, the browser half is
  * LambderUploadRunner.

package/dist/shared/wire/LambderUploadObjectFields.d.ts

@@ -1,6 +1,6 @@
 import type { LambderUploadObjectOptions } from "../contracts/LambderUploadBucket.js";
 /**
- * What a ticket's form carries for the stored object, in the fields S3's
+ * What a POST ticket's form carries for the stored object, in the fields S3's
  * presigned POST reads them from: the tag set as the XML `tagging` field,
  * each metadata entry as `x-amz-meta-<name>` (lowercased, as S3 keeps it),
  * `Cache-Control` and `Content-Disposition`. Both buckets build their
@@ -8,3 +8,12 @@ import type { LambderUploadObjectOptions } from "../contracts/LambderUploadBucke
  * every field is pinned by the ticket like the key and the checksum.
  */
 export declare const uploadObjectFormFields: (object: LambderUploadObjectOptions | undefined) => Record<string, string>;
+/**
+ * What a PUT ticket's headers carry for the stored object, as a presigned
+ * PUT sends them: the tag set as the URL-encoded `x-amz-tagging`, each
+ * metadata entry as `x-amz-meta-<name>` (lowercased), `cache-control` and
+ * `content-disposition`. Names are lowercase, as a signature lists them. Both
+ * buckets build their PUT tickets' headers with this, and every one is signed
+ * into the URL like the checksum.
+ */
+export declare const uploadObjectHeaders: (object: LambderUploadObjectOptions | undefined) => Record<string, string>;

package/dist/shared/wire/LambderUploadObjectFields.js

@@ -1,7 +1,7 @@
 import { contentDispositionHeader } from "../util/LambderContentDisposition.js";
 import { escapeXmlText } from "../util/escapeXmlText.js";
 /**
- * What a ticket's form carries for the stored object, in the fields S3's
+ * What a POST ticket's form carries for the stored object, in the fields S3's
  * presigned POST reads them from: the tag set as the XML `tagging` field,
  * each metadata entry as `x-amz-meta-<name>` (lowercased, as S3 keeps it),
  * `Cache-Control` and `Content-Disposition`. Both buckets build their
@@ -22,3 +22,24 @@ export const uploadObjectFormFields = (object) => {
         fields["Content-Disposition"] = contentDispositionHeader(object.contentDisposition);
     return fields;
 };
+/**
+ * What a PUT ticket's headers carry for the stored object, as a presigned
+ * PUT sends them: the tag set as the URL-encoded `x-amz-tagging`, each
+ * metadata entry as `x-amz-meta-<name>` (lowercased), `cache-control` and
+ * `content-disposition`. Names are lowercase, as a signature lists them. Both
+ * buckets build their PUT tickets' headers with this, and every one is signed
+ * into the URL like the checksum.
+ */
+export const uploadObjectHeaders = (object) => {
+    const headers = {};
+    const tags = Object.entries(object?.tags ?? {});
+    if (tags.length)
+        headers["x-amz-tagging"] = new URLSearchParams(tags).toString();
+    for (const [name, value] of Object.entries(object?.metadata ?? {}))
+        headers[`x-amz-meta-${name.toLowerCase()}`] = value;
+    if (object?.cacheControl !== undefined)
+        headers["cache-control"] = object.cacheControl;
+    if (object?.contentDisposition)
+        headers["content-disposition"] = contentDispositionHeader(object.contentDisposition);
+    return headers;
+};

package/dist/shared/wire/LambderUploadSchemas.d.ts

@@ -5,8 +5,14 @@ export declare const LambderUploadFileFactsSchema: z.ZodObject<{
     byteSize: z.ZodNumber;
     sha256Base64: z.ZodString;
 }, z.core.$strip>;
-export declare const LambderUploadTicketSchema: z.ZodObject<{
+export declare const LambderUploadTicketSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"POST">;
     uploadUrl: z.ZodURL;
     formFields: z.ZodRecord<z.ZodString, z.ZodString>;
     expiresAt: z.ZodNumber;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    method: z.ZodLiteral<"PUT">;
+    uploadUrl: z.ZodURL;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>], "method">;

package/dist/shared/wire/LambderUploadSchemas.js

@@ -21,10 +21,21 @@ export const LambderUploadFileFactsSchema = z.object({
     /** SHA-256 of the file's bytes as base64: 32 bytes are always 43 characters and one pad. */
     sha256Base64: z.string().regex(/^[A-Za-z0-9+/]{43}=$/),
 });
-export const LambderUploadTicketSchema = z.object({
-    uploadUrl: z.url(),
-    /** Sent as form fields ahead of the file, which storage wants last. */
-    formFields: z.record(z.string(), z.string()),
-    /** Epoch milliseconds after which storage refuses the ticket. */
-    expiresAt: z.number().int(),
-});
+export const LambderUploadTicketSchema = z.discriminatedUnion("method", [
+    z.object({
+        method: z.literal("POST"),
+        uploadUrl: z.url(),
+        /** Sent as form fields ahead of the file, which storage wants last. */
+        formFields: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+    z.object({
+        method: z.literal("PUT"),
+        uploadUrl: z.url(),
+        /** Sent exactly as given, each one signed into the URL. */
+        headers: z.record(z.string(), z.string()),
+        /** Epoch milliseconds after which storage refuses the ticket. */
+        expiresAt: z.number().int(),
+    }),
+]);

package/dist/stores/LambderMemoryUploadBucket.d.ts

@@ -1,4 +1,4 @@
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderMemoryUploadBucketOptions = {
     /**
      * The URL tickets and download links point under, which a mock's MSW
@@ -14,6 +14,8 @@ export type LambderMemoryUploadBucketOptions = {
     downloadLifetimeSeconds?: number;
     /** The clock tickets and links expire by, injectable so a test can move past an expiry without waiting. Default: Date.now. */
     now?: () => number;
+    /** How the browser sends a file, as LambderS3UploadBucket's option: a `POST` form or a `PUT`. Default: `POST`. */
+    uploadMethod?: LambderUploadMethod;
 };
 /** What the memory bucket holds under a key, for a test to assert on: the object's facts and what it carries. */
 export type LambderMemoryUploadObject = {
@@ -34,7 +36,11 @@ export type LambderMemoryUploadObject = {
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -47,11 +53,12 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     readonly baseUrl: string;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly now;
     private readonly objects;
     private readonly tickets;
     private readonly links;
-    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now }?: LambderMemoryUploadBucketOptions);
+    constructor({ baseUrl, ticketLifetimeSeconds, downloadLifetimeSeconds, now, uploadMethod }?: LambderMemoryUploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -88,12 +95,19 @@ export declare class LambderMemoryUploadBucket implements LambderUploadBucket {
     /** Forgets every object, ticket and link. */
     reset(): void;
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     handleStorageRequest(request: Request): Promise<Response | null>;
     private acceptUpload;
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    private acceptPut;
     private serveDownload;
 }

package/dist/stores/LambderMemoryUploadBucket.js

@@ -1,10 +1,10 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
 import { escapeXmlText } from "../shared/util/escapeXmlText.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { sha256Base64Of } from "../shared/util/LambderTextDigest.js";
-/** The form field that names the ticket a post was signed with: the memory bucket's stand-in for S3's signed policy. */
+/** The form field, or for a PUT the query parameter, that names the ticket an upload was signed with: the memory bucket's stand-in for S3's signature. */
 const TICKET_FIELD = "x-lambder-upload-ticket";
 /** The query parameter that names the link a download was issued with: the stand-in for S3's presigned query string. */
 const LINK_PARAMETER = "x-lambder-download-link";
@@ -21,7 +21,11 @@ const LINK_PARAMETER = "x-lambder-download-link";
  * expired" for a late one, EntityTooSmall, EntityTooLarge, BadDigest), so any
  * client, a LambderUploadRunner or another, takes the same path against it as
  * against S3: an expired ticket is asked for again, a wrong file is refused.
- * A download link reads the object until it expires.
+ * With `uploadMethod: "PUT"` it holds a PUT to the rules a store holds a
+ * presigned PUT to: every header the ticket carries with its value, no other
+ * `x-amz-` header, a body of the signed length (SignatureDoesNotMatch
+ * otherwise), a URL not yet expired ("Request has expired"), and bytes with
+ * the SHA-256 (BadDigest). A download link reads the object until it expires.
  *
  * Storage requests reach it through handleStorageRequest(), which answers a
  * fetch Request with a Response: lambderMockUploadMswHandler plugs that into
@@ -34,11 +38,12 @@ export class LambderMemoryUploadBucket {
     baseUrl;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     now;
     objects = new Map();
     tickets = new Map();
     links = new Map();
-    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now } = {}) {
+    constructor({ baseUrl, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, now = Date.now, uploadMethod = "POST" } = {}) {
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
         assertSignatureLifetime(downloadLifetimeSeconds, "downloadLifetimeSeconds");
         const url = new URL(baseUrl ?? `https://upload-bucket-${crypto.randomUUID()}.invalid/`);
@@ -47,6 +52,7 @@ export class LambderMemoryUploadBucket {
         this.baseUrl = url.href.endsWith("/") ? url.href : `${url.href}/`;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
         this.now = now;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object = {} }) {
@@ -56,6 +62,19 @@ export class LambderMemoryUploadBucket {
         refuseUnacceptedUpload(uploadRule, fileFacts);
         const ticketId = crypto.randomUUID();
         const expiresAt = this.now() + lifetimeSeconds * 1000;
+        const issued = { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, object };
+        if (this.uploadMethod === "PUT") {
+            // The headers a presigned PUT signs, so a client sends the same ones to either.
+            const headers = {
+                "content-type": fileFacts.mimeType,
+                "x-amz-checksum-sha256": fileFacts.sha256Base64,
+                ...uploadObjectHeaders(object),
+            };
+            this.tickets.set(ticketId, { ...issued, pinned: headers });
+            const uploadUrl = new URL(`${this.baseUrl}${encodeObjectKey(objectKey)}`);
+            uploadUrl.searchParams.set(TICKET_FIELD, ticketId);
+            return { method: "PUT", uploadUrl: uploadUrl.href, headers, expiresAt };
+        }
         // The fields S3's ticket carries, so a client posts the same form to either.
         const formFields = {
             key: objectKey,
@@ -65,8 +84,8 @@ export class LambderMemoryUploadBucket {
             ...uploadObjectFormFields(object),
             [TICKET_FIELD]: ticketId,
         };
-        this.tickets.set(ticketId, { objectKey, mimeType: fileFacts.mimeType, byteSize: fileFacts.byteSize, sha256Base64: fileFacts.sha256Base64, expiresAt, formFields, object });
-        return { uploadUrl: this.baseUrl, formFields, expiresAt };
+        this.tickets.set(ticketId, { ...issued, pinned: formFields });
+        return { method: "POST", uploadUrl: this.baseUrl, formFields, expiresAt };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const object = this.objects.get(objectKey);
@@ -125,10 +144,10 @@ export class LambderMemoryUploadBucket {
         this.links.clear();
     }
     /**
-     * Answers a request to storage the way S3 answers it: a post under a
-     * ticket stores its file, a GET or HEAD through a download link reads an
-     * object. A request outside baseUrl answers null, for the caller to hand
-     * on.
+     * Answers a request to storage the way S3 answers it: a post or a PUT
+     * under a ticket stores its file, a GET or HEAD through a download link
+     * reads an object. A request outside baseUrl answers null, for the caller
+     * to hand on.
      */
     async handleStorageRequest(request) {
         const url = new URL(request.url);
@@ -143,6 +162,8 @@ export class LambderMemoryUploadBucket {
         }
         if (request.method === "POST" && objectKey === "")
             return this.acceptUpload(request);
+        if (request.method === "PUT")
+            return this.acceptPut(request, objectKey, url.searchParams.get(TICKET_FIELD));
         if (request.method === "GET" || request.method === "HEAD")
             return this.serveDownload(objectKey, url.searchParams.get(LINK_PARAMETER), request.method === "HEAD");
         return storageError(405, "MethodNotAllowed", "The specified method is not allowed against this resource.");
@@ -176,10 +197,10 @@ export class LambderMemoryUploadBucket {
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         if (this.now() >= ticket.expiresAt)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy expired.");
-        const extra = [...fields.keys()].filter((name) => !(name in ticket.formFields));
+        const extra = [...fields.keys()].filter((name) => !(name in ticket.pinned));
         if (extra.length)
             return storageError(403, "AccessDenied", `Invalid according to Policy: Extra input fields: ${extra.join(", ")}`);
-        const pinned = Object.entries(ticket.formFields).every(([name, value]) => fields.get(name) === value);
+        const pinned = Object.entries(ticket.pinned).every(([name, value]) => fields.get(name) === value);
         if (!pinned)
             return storageError(403, "AccessDenied", "Invalid according to Policy: Policy Condition failed");
         const body = new Uint8Array(await file.arrayBuffer());
@@ -193,6 +214,33 @@ export class LambderMemoryUploadBucket {
         this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
         return new Response(null, { status: 204 });
     }
+    /**
+     * A PUT under a ticket's signed URL. A header the signature covers with
+     * another value, or a body of another length, does not match the
+     * signature; an `x-amz-` header it does not cover is refused as a store
+     * refuses one; the checksum is held against the bytes.
+     */
+    async acceptPut(request, objectKey, ticketId) {
+        const ticket = ticketId === null ? undefined : this.tickets.get(ticketId);
+        const mismatch = () => storageError(403, "SignatureDoesNotMatch", "The request signature we calculated does not match the signature you provided. Check your key and signing method.");
+        if (!ticket || ticket.objectKey !== objectKey)
+            return mismatch();
+        if (this.now() >= ticket.expiresAt)
+            return storageError(403, "AccessDenied", "Request has expired");
+        const unsigned = [...request.headers.keys()].filter((name) => name.startsWith("x-amz-") && !(name in ticket.pinned));
+        if (unsigned.length)
+            return storageError(403, "AccessDenied", `There were headers present in the request which were not signed: ${unsigned.join(", ")}`);
+        if (!Object.entries(ticket.pinned).every(([name, value]) => request.headers.get(name) === value))
+            return mismatch();
+        const body = new Uint8Array(await request.arrayBuffer());
+        if (body.byteLength !== ticket.byteSize)
+            return mismatch();
+        const sha256Base64 = await sha256Base64Of(body);
+        if (sha256Base64 !== ticket.sha256Base64)
+            return storageError(400, "BadDigest", "The SHA256 you specified did not match the calculated checksum.");
+        this.objects.set(ticket.objectKey, { body, mimeType: ticket.mimeType, sha256Base64, object: ticket.object });
+        return new Response(null, { status: 200 });
+    }
     serveDownload(objectKey, linkId, headOnly) {
         const link = linkId === null ? undefined : this.links.get(linkId);
         if (!link || link.objectKey !== objectKey)

package/dist/stores/LambderS3UploadBucket.d.ts

@@ -1,5 +1,5 @@
 import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
-import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
+import { type LambderUploadBucket, type LambderUploadContentDisposition, type LambderUploadFileFacts, type LambderUploadMethod, type LambderUploadObjectOptions, type LambderUploadRule, type LambderUploadTicket, type LambderUploadVerdict } from "../shared/contracts/LambderUploadBucket.js";
 export type LambderS3UploadBucketOptions = {
     bucket: string;
     /** A ready client, e.g. one shared with the rest of the app. */
@@ -10,6 +10,14 @@ export type LambderS3UploadBucketOptions = {
     ticketLifetimeSeconds?: number;
     /** How long a download link reads the object, unless a link says otherwise. Default: 300 seconds. */
     downloadLifetimeSeconds?: number;
+    /**
+     * How the browser sends a file: `POST`, a presigned POST, which S3 takes;
+     * or `PUT`, a presigned PUT, for a store that has no POST policies
+     * (Cloudflare R2). Both pin the same facts. Default: `POST`. The bucket
+     * cannot tell S3 from another store behind an endpoint, so a store that
+     * refuses POST is named here.
+     */
+    uploadMethod?: LambderUploadMethod;
 };
 /**
  * An S3 bucket browsers upload to directly (see LambderUploadBucket).
@@ -17,7 +25,10 @@ export type LambderS3UploadBucketOptions = {
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -32,12 +43,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
     private readonly bucket;
     private readonly ticketLifetimeSeconds;
     private readonly downloadLifetimeSeconds;
+    private readonly uploadMethod;
     private readonly clientConfig;
     private client;
     private clientSdk;
     private presignedPostSdk;
     private requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds }: LambderS3UploadBucketOptions);
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds, downloadLifetimeSeconds, uploadMethod }: LambderS3UploadBucketOptions);
     issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds, object }: {
         objectKey: string;
         fileFacts: LambderUploadFileFacts;
@@ -45,6 +57,13 @@ export declare class LambderS3UploadBucket implements LambderUploadBucket {
         lifetimeSeconds?: number;
         object?: LambderUploadObjectOptions;
     }): Promise<LambderUploadTicket>;
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    private issuePutTicket;
     verifyUploadedObject({ objectKey, fileFacts }: {
         objectKey: string;
         fileFacts: Pick<LambderUploadFileFacts, "byteSize" | "sha256Base64">;

package/dist/stores/LambderS3UploadBucket.js

@@ -1,6 +1,6 @@
 import { assertObjectOptions, assertPinnedObjectKey, assertSignatureLifetime, } from "../shared/contracts/LambderUploadBucket.js";
 import { contentDispositionHeader } from "../shared/util/LambderContentDisposition.js";
-import { uploadObjectFormFields } from "../shared/wire/LambderUploadObjectFields.js";
+import { uploadObjectFormFields, uploadObjectHeaders } from "../shared/wire/LambderUploadObjectFields.js";
 import { refuseUnacceptedUpload } from "../shared/wire/LambderUploadRefusal.js";
 import { withInstallHint } from "./LambderSdkInstallHint.js";
 /** The S3 error names that mean nothing is stored under the key: HeadObject answers NotFound, the other calls NoSuchKey. */
@@ -11,7 +11,10 @@ const MISSING_OBJECT_ERROR_NAMES = ["NotFound", "NoSuchKey"];
  * A ticket is an S3 presigned POST whose policy pins the key, the content
  * type, the exact byte size and the SHA-256 checksum, so S3 itself refuses
  * any other file. That needs S3's POST policies with checksum fields: S3, or
- * a store that implements them; Cloudflare R2 does not take presigned POSTs.
+ * a store that implements them. A store without them (Cloudflare R2) takes
+ * `uploadMethod: "PUT"`: a presigned PUT whose signature covers the same
+ * facts as headers (the length, the type and the checksum), so the store
+ * refuses any other file just the same.
  *
  * Signing a ticket or a download link is arithmetic over the function's
  * credentials and reaches nothing; verifying, reading, writing, copying and
@@ -26,12 +29,13 @@ export class LambderS3UploadBucket {
     bucket;
     ticketLifetimeSeconds;
     downloadLifetimeSeconds;
+    uploadMethod;
     clientConfig;
     client;
     clientSdk;
     presignedPostSdk;
     requestPresignerSdk;
-    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300 }) {
+    constructor({ bucket, client, clientConfig, ticketLifetimeSeconds = 600, downloadLifetimeSeconds = 300, uploadMethod = "POST" }) {
         if (!bucket.trim())
             throw new Error("bucket is required");
         assertSignatureLifetime(ticketLifetimeSeconds, "ticketLifetimeSeconds");
@@ -41,12 +45,15 @@ export class LambderS3UploadBucket {
         this.clientConfig = clientConfig;
         this.ticketLifetimeSeconds = ticketLifetimeSeconds;
         this.downloadLifetimeSeconds = downloadLifetimeSeconds;
+        this.uploadMethod = uploadMethod;
     }
     async issueUploadTicket({ objectKey, fileFacts, uploadRule, lifetimeSeconds = this.ticketLifetimeSeconds, object }) {
         assertPinnedObjectKey(objectKey);
         assertSignatureLifetime(lifetimeSeconds, "lifetimeSeconds");
         assertObjectOptions(object);
         refuseUnacceptedUpload(uploadRule, fileFacts);
+        if (this.uploadMethod === "PUT")
+            return this.issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object);
         const [{ client }, { createPresignedPost }] = await Promise.all([this.s3(), this.loadPresignedPostSdk()]);
         const post = await createPresignedPost(client, {
             Bucket: this.bucket,
@@ -61,7 +68,47 @@ export class LambderS3UploadBucket {
             },
             Conditions: [["content-length-range", fileFacts.byteSize, fileFacts.byteSize]],
         });
-        return { uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+        return { method: "POST", uploadUrl: post.url, formFields: post.fields, expiresAt: Date.now() + lifetimeSeconds * 1000 };
+    }
+    /**
+     * A presigned PUT. Every header the ticket hands the browser is signed
+     * into the URL, and so is the length, which the browser sets from the
+     * body itself; the `x-amz-` ones are kept as headers rather than moved
+     * into the query, so the store checks the body against the checksum.
+     */
+    async issuePutTicket(objectKey, fileFacts, lifetimeSeconds, object) {
+        const headers = {
+            "content-type": fileFacts.mimeType,
+            "x-amz-checksum-sha256": fileFacts.sha256Base64,
+            ...uploadObjectHeaders(object),
+        };
+        const [{ sdk, client }, { getSignedUrl }] = await Promise.all([this.s3(), this.loadRequestPresignerSdk()]);
+        const tags = Object.entries(object?.tags ?? {});
+        const metadata = Object.entries(object?.metadata ?? {});
+        const uploadUrl = await getSignedUrl(client, new sdk.PutObjectCommand({
+            Bucket: this.bucket,
+            Key: objectKey,
+            ContentType: fileFacts.mimeType,
+            ContentLength: fileFacts.byteSize,
+            ChecksumSHA256: fileFacts.sha256Base64,
+            ...(tags.length ? { Tagging: new URLSearchParams(tags).toString() } : {}),
+            ...(metadata.length ? { Metadata: Object.fromEntries(metadata.map(([name, value]) => [name.toLowerCase(), value])) } : {}),
+            ...(object?.cacheControl !== undefined ? { CacheControl: object.cacheControl } : {}),
+            ...(object?.contentDisposition ? { ContentDisposition: contentDispositionHeader(object.contentDisposition) } : {}),
+        }), {
+            expiresIn: lifetimeSeconds,
+            signableHeaders: new Set([...Object.keys(headers), "content-length"]),
+            unhoistableHeaders: new Set(Object.keys(headers).filter((name) => name.startsWith("x-amz-"))),
+        });
+        // What the URL is signed for must be what the ticket sends, or the
+        // store refuses every upload with it: said here, where it is written,
+        // rather than as a refused upload in a browser.
+        const signed = (new URL(uploadUrl).searchParams.get("X-Amz-SignedHeaders") ?? "").split(";").filter((name) => name !== "host" && name !== "content-length");
+        const sent = Object.keys(headers);
+        if (signed.length !== sent.length || !sent.every((name) => signed.includes(name))) {
+            throw new Error(`LambderS3UploadBucket: a PUT ticket's URL is signed for [${signed.join(", ")}] but the ticket sends [${sent.join(", ")}]`);
+        }
+        return { method: "PUT", uploadUrl, headers, expiresAt: Date.now() + lifetimeSeconds * 1000 };
     }
     async verifyUploadedObject({ objectKey, fileFacts }) {
         const { sdk, client } = await this.s3();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "9.0.2",
+  "version": "9.0.3",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [