neonctl 2.27.1 → 2.29.0

package/dist/psql/wire/tls.js

@@ -27,11 +27,11 @@
  *     is the default and `servername` is set. The connection layer wires
  *     `servername` to the configured host before calling us.
  */
-import * as tls from 'node:tls';
-import { createHash, createPrivateKey } from 'node:crypto';
-import { promises as fs, appendFileSync } from 'node:fs';
-import * as path from 'node:path';
-import { SSLRequest } from './protocol.js';
+import { createHash, createPrivateKey } from "node:crypto";
+import { appendFileSync, promises as fs } from "node:fs";
+import * as path from "node:path";
+import * as tls from "node:tls";
+import { SSLRequest } from "./protocol.js";
 /**
  * Hash of the peer cert for `tls-server-end-point`. libpq always uses SHA-256
  * of the DER-encoded certificate; we match that.
@@ -43,9 +43,9 @@ export function computeChannelBindingData(cert) {
     // marks it as `Buffer | undefined` on some versions, hence the guard.
     const raw = cert.raw;
     if (!raw || raw.length === 0) {
-        throw new Error('TLS channel binding: peer certificate has no DER bytes');
+        throw new Error("TLS channel binding: peer certificate has no DER bytes");
     }
-    return createHash('sha256').update(raw).digest();
+    return createHash("sha256").update(raw).digest();
 }
 /**
  * Send SSLRequest, read the 1-byte server response, and either upgrade the
@@ -73,32 +73,32 @@ export function computeChannelBindingData(cert) {
  *     fallback, so a server that does not speak TLS surfaces the handshake
  *     failure rather than a quiet downgrade.
  */
-export async function negotiateTls(socket, sslMode, tlsOpts = {}, fileOpts = {}, negotiation = 'postgres') {
-    if (sslMode === 'disable') {
-        return { kind: 'plain', socket };
+export async function negotiateTls(socket, sslMode, tlsOpts = {}, fileOpts = {}, negotiation = "postgres") {
+    if (sslMode === "disable") {
+        return { kind: "plain", socket };
     }
     // Direct SSL (libpq `sslnegotiation=direct`, PG 17+): skip the `SSLRequest`
     // probe and start the TLS handshake straight away. The parse layer has
     // already rejected weak sslmodes, so this path is only reached with an
     // encrypted mode — never falling back to plaintext.
-    if (negotiation === 'direct') {
+    if (negotiation === "direct") {
         const mergedOpts = await loadTlsFileOptions(tlsOpts, fileOpts, sslMode);
         return upgradeToTls(socket, mergedOpts, fileOpts.sslkeylogfile, fileOpts.sslkey, 
         /* requireAlpn */ true);
     }
     const reply = await sendSslRequest(socket);
-    if (reply === 'S') {
+    if (reply === "S") {
         const mergedOpts = await loadTlsFileOptions(tlsOpts, fileOpts, sslMode);
         return upgradeToTls(socket, mergedOpts, fileOpts.sslkeylogfile, fileOpts.sslkey);
     }
     // reply === 'N': server refused TLS.
-    if (sslMode === 'require' ||
-        sslMode === 'verify-ca' ||
-        sslMode === 'verify-full') {
+    if (sslMode === "require" ||
+        sslMode === "verify-ca" ||
+        sslMode === "verify-full") {
         throw new Error(`SSL connection required (sslmode=${sslMode}) but server refused (replied 'N')`);
     }
     // 'allow' / 'prefer': fall back to plain text.
-    return { kind: 'plain', socket };
+    return { kind: "plain", socket };
 }
 /**
  * Read each non-empty file path in `fileOpts` and merge the bytes onto a
@@ -126,12 +126,12 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // validate the chain. Mirror that so a stale / placeholder
     // `sslrootcert=` doesn't blow up sslmode=require connections.
     const needsRootCert = sslMode === undefined ||
-        sslMode === 'verify-ca' ||
-        sslMode === 'verify-full';
+        sslMode === "verify-ca" ||
+        sslMode === "verify-full";
     if (needsRootCert &&
         fileOpts.sslrootcert !== undefined &&
-        fileOpts.sslrootcert !== '') {
-        if (fileOpts.sslrootcert === 'system') {
+        fileOpts.sslrootcert !== "") {
+        if (fileOpts.sslrootcert === "system") {
             // `sslrootcert=system`: use the OS / OpenSSL trust store instead of a
             // file. libpq's OpenSSL build honours OpenSSL's $SSL_CERT_FILE (a single
             // bundle) and $SSL_CERT_DIR (a directory of hashed CA files); we read
@@ -140,11 +140,11 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
             // for verify-* modes) is left intact.
             const systemCas = [];
             const sslCertFile = process.env.SSL_CERT_FILE;
-            if (sslCertFile !== undefined && sslCertFile !== '') {
-                systemCas.push(await readPem('sslrootcert', sslCertFile, 'CERTIFICATE'));
+            if (sslCertFile !== undefined && sslCertFile !== "") {
+                systemCas.push(await readPem("sslrootcert", sslCertFile, "CERTIFICATE"));
             }
             const sslCertDir = process.env.SSL_CERT_DIR;
-            if (sslCertDir !== undefined && sslCertDir !== '') {
+            if (sslCertDir !== undefined && sslCertDir !== "") {
                 systemCas.push(...(await readCaDir(sslCertDir)));
             }
             if (systemCas.length === 1) {
@@ -155,7 +155,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
             }
         }
         else {
-            merged.ca = await readPem('sslrootcert', fileOpts.sslrootcert, 'CERTIFICATE');
+            merged.ca = await readPem("sslrootcert", fileOpts.sslrootcert, "CERTIFICATE");
         }
     }
     // libpq `sslcertmode` gates whether the client cert/key are sent.
@@ -163,30 +163,30 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     //   - `require`: a cert MUST be configured (we only honour an explicit
     //     `sslcert`, not libpq's default `~/.postgresql/postgresql.crt`).
     //   - `allow` / unset: current behaviour (send when present).
-    const certMode = fileOpts.sslcertmode ?? 'allow';
-    const clientCert = fileOpts.sslcert !== undefined && fileOpts.sslcert !== ''
+    const certMode = fileOpts.sslcertmode ?? "allow";
+    const clientCert = fileOpts.sslcert !== undefined && fileOpts.sslcert !== ""
         ? fileOpts.sslcert
         : undefined;
-    if (certMode === 'require' && clientCert === undefined) {
+    if (certMode === "require" && clientCert === undefined) {
         throw new Error(`sslcertmode value "require" requires a client certificate`);
     }
-    if (certMode !== 'disable') {
+    if (certMode !== "disable") {
         if (clientCert !== undefined) {
-            merged.cert = await readPem('sslcert', clientCert, 'CERTIFICATE');
+            merged.cert = await readPem("sslcert", clientCert, "CERTIFICATE");
         }
-        if (fileOpts.sslkey !== undefined && fileOpts.sslkey !== '') {
+        if (fileOpts.sslkey !== undefined && fileOpts.sslkey !== "") {
             await assertKeyPermissions(fileOpts.sslkey);
-            merged.key = await readPem('sslkey', fileOpts.sslkey, 'PRIVATE KEY');
+            merged.key = await readPem("sslkey", fileOpts.sslkey, "PRIVATE KEY");
         }
     }
     // CRLs come from a single file (`sslcrl`) and/or every file in a directory
     // (`sslcrldir`). Node's `crl` option accepts an array of PEM buffers, so we
     // collect each source and only set `crl` when at least one was read.
     const crls = [];
-    if (fileOpts.sslcrl !== undefined && fileOpts.sslcrl !== '') {
-        crls.push(await readPem('sslcrl', fileOpts.sslcrl));
+    if (fileOpts.sslcrl !== undefined && fileOpts.sslcrl !== "") {
+        crls.push(await readPem("sslcrl", fileOpts.sslcrl));
     }
-    if (fileOpts.sslcrldir !== undefined && fileOpts.sslcrldir !== '') {
+    if (fileOpts.sslcrldir !== undefined && fileOpts.sslcrldir !== "") {
         crls.push(...(await readCrlDir(fileOpts.sslcrldir)));
     }
     if (crls.length === 1) {
@@ -198,7 +198,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // sslpassword is plumbed through verbatim — OpenSSL applies it when it
     // sees an encrypted key. Empty string is "no passphrase" (libpq's
     // convention) so we skip it.
-    if (fileOpts.sslpassword !== undefined && fileOpts.sslpassword !== '') {
+    if (fileOpts.sslpassword !== undefined && fileOpts.sslpassword !== "") {
         merged.passphrase = fileOpts.sslpassword;
     }
     // sslkeylogfile is not a tls.connect option; the keylog listener is wired
@@ -206,7 +206,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // by opening it for append, so an unwritable path fails fast at connect
     // time with `could not open sslkeylogfile "<path>": <reason>` rather than
     // silently dropping keys mid-handshake.
-    if (fileOpts.sslkeylogfile !== undefined && fileOpts.sslkeylogfile !== '') {
+    if (fileOpts.sslkeylogfile !== undefined && fileOpts.sslkeylogfile !== "") {
         await assertKeyLogFileWritable(fileOpts.sslkeylogfile);
     }
     return merged;
@@ -219,7 +219,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
  */
 async function assertKeyLogFileWritable(filePath) {
     try {
-        const handle = await fs.open(filePath, 'a');
+        const handle = await fs.open(filePath, "a");
         await handle.close();
     }
     catch (err) {
@@ -232,19 +232,19 @@ function isPemArmored(bytes) {
     // A PEM file is ASCII text; scan a bounded prefix (skipping leading
     // whitespace libpq tolerates) for the armor marker. DER is binary and will
     // not contain this token at the front.
-    const head = bytes.subarray(0, 64).toString('latin1');
-    return head.includes('-----BEGIN');
+    const head = bytes.subarray(0, 64).toString("latin1");
+    return head.includes("-----BEGIN");
 }
 /**
  * Wrap raw DER bytes in the requested PEM armor: base64 the DER, split into
  * 64-char lines (the PEM convention), and bracket with the BEGIN/END markers.
  */
 function derToPem(der, armor) {
-    const b64 = der.toString('base64');
+    const b64 = der.toString("base64");
     const lines = b64.match(/.{1,64}/g) ?? [];
-    const body = lines.join('\n');
+    const body = lines.join("\n");
     const pem = `-----BEGIN ${armor}-----\n${body}\n-----END ${armor}-----\n`;
-    return Buffer.from(pem, 'ascii');
+    return Buffer.from(pem, "ascii");
 }
 /**
  * Convert a DER-encoded private key to canonical PKCS#8 PEM, the way libpq
@@ -258,11 +258,11 @@ function derToPem(der, armor) {
  */
 function derPrivateKeyToPem(der) {
     let lastErr;
-    for (const type of ['pkcs8', 'pkcs1', 'sec1']) {
+    for (const type of ["pkcs8", "pkcs1", "sec1"]) {
         try {
-            const key = createPrivateKey({ key: der, format: 'der', type });
-            const pem = key.export({ format: 'pem', type: 'pkcs8' });
-            return typeof pem === 'string' ? Buffer.from(pem, 'ascii') : pem;
+            const key = createPrivateKey({ key: der, format: "der", type });
+            const pem = key.export({ format: "pem", type: "pkcs8" });
+            return typeof pem === "string" ? Buffer.from(pem, "ascii") : pem;
         }
         catch (err) {
             lastErr = err;
@@ -291,7 +291,7 @@ async function readPem(label, filePath, derArmor) {
     if (derArmor !== undefined && !isPemArmored(bytes)) {
         // Private keys need format-aware decoding (PKCS#8 / PKCS#1 / SEC1);
         // certs are a single ASN.1 shape and wrap directly.
-        return derArmor === 'PRIVATE KEY'
+        return derArmor === "PRIVATE KEY"
             ? derPrivateKeyToPem(bytes)
             : derToPem(bytes, derArmor);
     }
@@ -310,7 +310,7 @@ async function readPem(label, filePath, derArmor) {
  * carry a private key here).
  */
 async function assertKeyPermissions(keyPath) {
-    if (process.platform === 'win32')
+    if (process.platform === "win32")
         return;
     let stat;
     try {
@@ -355,7 +355,7 @@ async function readCrlDir(dirPath) {
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
-        out.push(await readPem('sslcrldir', path.join(dirPath, entry.name)));
+        out.push(await readPem("sslcrldir", path.join(dirPath, entry.name)));
     }
     return out;
 }
@@ -381,7 +381,7 @@ export async function readCaDir(dirPath) {
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
-        out.push(await readPem('SSL_CERT_DIR', path.join(dirPath, entry.name), 'CERTIFICATE'));
+        out.push(await readPem("SSL_CERT_DIR", path.join(dirPath, entry.name), "CERTIFICATE"));
     }
     return out;
 }
@@ -403,7 +403,7 @@ export function sendSslRequest(socket) {
             if (chunk.length === 0)
                 return;
             const first = String.fromCharCode(chunk[0]);
-            if (first !== 'S' && first !== 'N') {
+            if (first !== "S" && first !== "N") {
                 cleanup();
                 reject(new Error(`Unexpected SSLRequest response byte 0x${chunk[0].toString(16)}`));
                 return;
@@ -416,11 +416,11 @@ export function sendSslRequest(socket) {
             resolve(first);
         };
         const cleanup = () => {
-            socket.removeListener('data', onData);
-            socket.removeListener('error', onError);
+            socket.removeListener("data", onData);
+            socket.removeListener("error", onError);
         };
-        socket.on('data', onData);
-        socket.on('error', onError);
+        socket.on("data", onData);
+        socket.on("error", onError);
         socket.write(SSLRequest());
     });
 }
@@ -455,16 +455,16 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
     // Encrypted client-key decrypt failure (wrong / missing `sslpassword`).
     // OpenSSL throws this synchronously out of `tls.connect`; reshape it to
     // libpq's `could not load private key file "<path>": ... bad decrypt`.
-    if (code === 'ERR_OSSL_BAD_DECRYPT' || /bad decrypt/i.test(msg)) {
-        const where = keyPath !== undefined && keyPath !== ''
+    if (code === "ERR_OSSL_BAD_DECRYPT" || /bad decrypt/i.test(msg)) {
+        const where = keyPath !== undefined && keyPath !== ""
             ? `private key file "${keyPath}"`
-            : 'private key file';
+            : "private key file";
         const mapped = new Error(`could not load ${where}: ${msg}`);
         mapped.cause = err;
         return mapped;
     }
-    if (code === 'ERR_TLS_CERT_ALTNAME_INVALID') {
-        const host = servername ?? '';
+    if (code === "ERR_TLS_CERT_ALTNAME_INVALID") {
+        const host = servername ?? "";
         const mapped = new Error(`server certificate for "${host}" does not match host name "${host}"`);
         mapped.cause = err;
         return mapped;
@@ -474,10 +474,10 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
     // `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`, etc. libpq collapses
     // them all to `certificate verify failed`.
     const isVerifyFailure = code !== undefined &&
-        code !== 'ERR_TLS_CERT_ALTNAME_INVALID' &&
+        code !== "ERR_TLS_CERT_ALTNAME_INVALID" &&
         /CERT|SIGNATURE|SELF_SIGNED|UNABLE_TO|CHAIN|EXPIRED|NOT_YET_VALID|INVALID_CA/.test(code);
     if (isVerifyFailure || /certificate verify failed/i.test(msg)) {
-        const mapped = new Error('certificate verify failed');
+        const mapped = new Error("certificate verify failed");
         mapped.cause = err;
         return mapped;
     }
@@ -485,7 +485,7 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
 }
 /** Pull the SNI `servername` from the TLS options for error messages. */
 function getServername(tlsOpts) {
-    return typeof tlsOpts.servername === 'string'
+    return typeof tlsOpts.servername === "string"
         ? tlsOpts.servername
         : undefined;
 }
@@ -498,7 +498,7 @@ requireAlpn = false) {
     return new Promise((resolve, reject) => {
         let tlsSocket;
         const cleanup = () => {
-            tlsSocket?.removeListener('error', onError);
+            tlsSocket?.removeListener("error", onError);
         };
         const onError = (err) => {
             cleanup();
@@ -523,10 +523,11 @@ requireAlpn = false) {
                 // Enforce the mandatory `postgresql` ALPN for direct SSL. Without
                 // it a TLS terminator / HTTPS proxy with a valid host cert would be
                 // accepted and the startup packet sent in the blind (review #9).
-                if (requireAlpn && established.alpnProtocol !== 'postgresql') {
+                if (requireAlpn &&
+                    established.alpnProtocol !== "postgresql") {
                     cleanup();
                     established.destroy();
-                    reject(new Error('direct SSL connection requires ALPN, but the server did ' +
+                    reject(new Error("direct SSL connection requires ALPN, but the server did " +
                         'not negotiate the "postgresql" protocol'));
                     return;
                 }
@@ -538,7 +539,7 @@ requireAlpn = false) {
                     // `getPeerCertificate(true)` for compatibility.
                     const x509 = established.getPeerX509Certificate?.();
                     if (x509?.raw && x509.raw.length > 0) {
-                        channelBindingData = createHash('sha256')
+                        channelBindingData = createHash("sha256")
                             .update(x509.raw)
                             .digest();
                     }
@@ -549,7 +550,8 @@ requireAlpn = false) {
                         // accept that channel binding is unavailable.
                         const peerCert = established.getPeerCertificate(true);
                         if (peerCert?.raw && peerCert.raw.length > 0) {
-                            channelBindingData = computeChannelBindingData(peerCert);
+                            channelBindingData =
+                                computeChannelBindingData(peerCert);
                         }
                     }
                 }
@@ -558,18 +560,22 @@ requireAlpn = false) {
                     // path will fall back to SCRAM-SHA-256 (non-PLUS).
                     channelBindingData = null;
                 }
-                resolve({ kind: 'tls', socket: established, channelBindingData });
+                resolve({
+                    kind: "tls",
+                    socket: established,
+                    channelBindingData,
+                });
             });
         }
         catch (err) {
             reject(mapTlsHandshakeError(err instanceof Error ? err : new Error(String(err)), getServername(tlsOpts), keyPath));
             return;
         }
-        tlsSocket.on('error', onError);
+        tlsSocket.on("error", onError);
         // libpq `sslkeylogfile`: append each emitted key-log line so the
         // handshake can be decrypted offline. The path was pre-checked for
         // writability in loadTlsFileOptions.
-        if (sslkeylogfile !== undefined && sslkeylogfile !== '') {
+        if (sslkeylogfile !== undefined && sslkeylogfile !== "") {
             attachKeyLogListener(tlsSocket, sslkeylogfile);
         }
     });
@@ -585,12 +591,12 @@ requireAlpn = false) {
  * fake socket without a real TLS handshake. Exported for tests.
  */
 export function attachKeyLogListener(socket, filePath) {
-    socket.on('keylog', (line) => {
+    socket.on("keylog", (line) => {
         try {
             appendFileSync(filePath, line);
         }
         catch (err) {
-            socket.emit('error', err instanceof Error ? err : new Error(String(err)));
+            socket.emit("error", err instanceof Error ? err : new Error(String(err)));
         }
     });
 }

package/dist/storage_api.js

@@ -1,14 +1,13 @@
 // Typed client helpers for the branch object-storage (bucket/object) API.
 //
 // These endpoints are part of the Neon object-storage surface (the "Buckets"
-// tag in the public API). They are not yet exposed as typed methods on the
-// published `@neondatabase/api-client` package, so the request/response types
-// and the thin call helpers live here. They are implemented on top of the
-// api-client's public `request()` method, which means they reuse the exact
-// same authentication, base URL, headers and retry behaviour as every other
-// neonctl command. When the generated client gains these methods, the call
-// sites in `src/commands/bucket.ts` can switch over with no behavioural
-// change.
+// tag in the public API). They are not yet exposed as typed methods on
+// `@neon/sdk`, so the request/response types and the thin call helpers live
+// here. They are implemented on top of the API client's low-level `request()`
+// method, which reuses the exact same authentication, base URL, headers and
+// retry behaviour as every other neonctl command. When the SDK gains these
+// methods, the call sites in `src/commands/bucket.ts` can switch over with no
+// behavioural change.
 const bucketsPath = (projectId, branchId) => `/projects/${encodeURIComponent(projectId)}/branches/${encodeURIComponent(branchId)}/buckets`;
 const bucketPath = (projectId, branchId, bucketName) => `${bucketsPath(projectId, branchId)}/${encodeURIComponent(bucketName)}`;
 /**
@@ -24,9 +23,9 @@ export const createProjectBranchBucket = (apiClient, { projectId, branchId, name
     }
     return apiClient.request({
         path: bucketsPath(projectId, branchId),
-        method: 'POST',
+        method: "POST",
         body,
-        format: 'json',
+        format: "json",
         secure: true,
     });
 };
@@ -37,8 +36,8 @@ export const createProjectBranchBucket = (apiClient, { projectId, branchId, name
  */
 export const listProjectBranchBuckets = (apiClient, { projectId, branchId }) => apiClient.request({
     path: bucketsPath(projectId, branchId),
-    method: 'GET',
-    format: 'json',
+    method: "GET",
+    format: "json",
     secure: true,
 });
 /**
@@ -48,7 +47,7 @@ export const listProjectBranchBuckets = (apiClient, { projectId, branchId }) =>
  */
 export const deleteProjectBranchBucket = (apiClient, { projectId, branchId, bucketName, }) => apiClient.request({
     path: bucketPath(projectId, branchId, bucketName),
-    method: 'DELETE',
+    method: "DELETE",
     secure: true,
 });
 /**
@@ -58,9 +57,9 @@ export const deleteProjectBranchBucket = (apiClient, { projectId, branchId, buck
  */
 export const listProjectBranchBucketObjects = (apiClient, { projectId, branchId, bucketName, ...query }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects`,
-    method: 'GET',
+    method: "GET",
     query,
-    format: 'json',
+    format: "json",
     secure: true,
 });
 /**
@@ -80,8 +79,8 @@ export const listProjectBranchBucketObjects = (apiClient, { projectId, branchId,
  */
 export const getProjectBranchBucketObject = (apiClient, { projectId, branchId, bucketName, objectKey, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}/download`,
-    method: 'GET',
-    format: 'stream',
+    method: "GET",
+    format: "stream",
     secure: true,
 });
 /**
@@ -94,7 +93,7 @@ export const getProjectBranchBucketObject = (apiClient, { projectId, branchId, b
  */
 export const deleteProjectBranchBucketObject = (apiClient, { projectId, branchId, bucketName, objectKey, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}`,
-    method: 'DELETE',
+    method: "DELETE",
     secure: true,
 });
 /**
@@ -107,9 +106,9 @@ export const deleteProjectBranchBucketObject = (apiClient, { projectId, branchId
  */
 export const deleteProjectBranchBucketObjectsByPrefix = (apiClient, { projectId, branchId, bucketName, prefix, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects-by-prefix`,
-    method: 'DELETE',
+    method: "DELETE",
     query: { prefix },
-    format: 'json',
+    format: "json",
     secure: true,
 });
 /**
@@ -131,7 +130,7 @@ export const deleteProjectBranchBucketObjectsByPrefix = (apiClient, { projectId,
  * @request POST /projects/{project_id}/branches/{branch_id}/buckets/{bucket_name}/objects/{object_key}/presign
  */
 export const presignUpload = (apiClient, { projectId, branchId, bucketName, objectKey, contentType, expiresInSeconds, }) => {
-    const body = { operation: 'upload' };
+    const body = { operation: "upload" };
     if (contentType !== undefined) {
         body.content_type = contentType;
     }
@@ -140,9 +139,9 @@ export const presignUpload = (apiClient, { projectId, branchId, bucketName, obje
     }
     return apiClient.request({
         path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}/presign`,
-        method: 'POST',
+        method: "POST",
         body,
-        format: 'json',
+        format: "json",
         secure: true,
     });
 };