s3mini 0.3.0 → 0.5.0

package/dist/s3mini.js

@@ -11,11 +11,12 @@ const SENSITIVE_KEYS_REDACTED = ['accessKeyId', 'secretAccessKey', 'sessionToken
 const DEFAULT_REQUEST_SIZE_IN_BYTES = 8 * 1024 * 1024;
 // Headers
 const HEADER_AMZ_CONTENT_SHA256 = 'x-amz-content-sha256';
+const HEADER_AMZ_CHECKSUM_SHA256 = 'x-amz-checksum-sha256';
 const HEADER_AMZ_DATE = 'x-amz-date';
 const HEADER_HOST = 'host';
-const HEADER_AUTHORIZATION = 'Authorization';
-const HEADER_CONTENT_TYPE = 'Content-Type';
-const HEADER_CONTENT_LENGTH = 'Content-Length';
+const HEADER_AUTHORIZATION = 'authorization';
+const HEADER_CONTENT_TYPE = 'content-type';
+const HEADER_CONTENT_LENGTH = 'content-length';
 const HEADER_ETAG = 'etag';
 // Error messages
 const ERROR_PREFIX = '[s3mini] ';
@@ -26,35 +27,70 @@ const ERROR_ENDPOINT_FORMAT = `${ERROR_PREFIX}endpoint must be a valid URL. Expe
 const ERROR_KEY_REQUIRED = `${ERROR_PREFIX}key must be a non-empty string`;
 const ERROR_UPLOAD_ID_REQUIRED = `${ERROR_PREFIX}uploadId must be a non-empty string`;
 const ERROR_DATA_BUFFER_REQUIRED = `${ERROR_PREFIX}data must be a Buffer or string`;
-// const ERROR_PATH_REQUIRED = `${ERROR_PREFIX}path must be a string`;
 const ERROR_PREFIX_TYPE = `${ERROR_PREFIX}prefix must be a string`;
 const ERROR_DELIMITER_REQUIRED = `${ERROR_PREFIX}delimiter must be a string`;
 
-// Initialize crypto functions - this is needed for environments where `crypto` is not available globally
-// e.g., in Cloudflare Workers or other non-Node.js environments with nodejs_flags enabled.
-const _createHmac = crypto.createHmac || (await import('node:crypto')).createHmac;
-const _createHash = crypto.createHash || (await import('node:crypto')).createHash;
+const ENCODR = new TextEncoder();
+const chunkSize = 0x8000; // 32KB chunks
+const HEXS = '0123456789abcdef';
+const getByteSize = (data) => {
+    if (typeof data === 'string') {
+        return ENCODR.encode(data).byteLength;
+    }
+    if (data instanceof ArrayBuffer || data instanceof Uint8Array) {
+        return data.byteLength;
+    }
+    if (data instanceof Blob) {
+        return data.size;
+    }
+    throw new Error('Unsupported data type');
+};
+/**
+ * Turn a raw ArrayBuffer into its hexadecimal representation.
+ * @param {ArrayBuffer} buffer The raw bytes.
+ * @returns {string} Hexadecimal string
+ */
+const hexFromBuffer = (buffer) => {
+    const bytes = new Uint8Array(buffer);
+    let hex = '';
+    for (const byte of bytes) {
+        hex += HEXS[byte >> 4] + HEXS[byte & 0x0f];
+    }
+    return hex;
+};
 /**
- * Hash content using SHA-256
- * @param {string|Buffer} content  – data to hash
- * @returns {string} Hex encoded hash
+ * Turn a raw ArrayBuffer into its base64 representation.
+ * @param {ArrayBuffer} buffer The raw bytes.
+ * @returns {string} Base64 string
  */
-const hash = (content) => {
-    return _createHash('sha256').update(content).digest('hex');
+const base64FromBuffer = (buffer) => {
+    const bytes = new Uint8Array(buffer);
+    let result = '';
+    for (let i = 0; i < bytes.length; i += chunkSize) {
+        const chunk = bytes.subarray(i, i + chunkSize);
+        result += btoa(String.fromCharCode.apply(null, chunk));
+    }
+    return result;
 };
-const md5base64 = (data) => {
-    return _createHash('md5').update(data).digest('base64');
+/**
+ * Compute SHA-256 hash of arbitrary string data.
+ * @param {string} content The content to be hashed.
+ * @returns {ArrayBuffer} The raw hash
+ */
+const sha256 = async (content) => {
+    const data = ENCODR.encode(content);
+    return await globalThis.crypto.subtle.digest('SHA-256', data);
 };
 /**
- * Compute HMAC-SHA-256 of arbitrary data and return a hex string.
- * @param {string|Buffer} key      – secret key
- * @param {string|Buffer} content  – data to authenticate
- * @param {BufferEncoding} [encoding='hex'] – hex | base64 | …
- * @returns {string | Buffer} hex encoded HMAC
+ * Compute HMAC-SHA-256 of arbitrary data.
+ * @param {string|ArrayBuffer} key The key used to sign the content.
+ * @param {string} content The content to be signed.
+ * @returns {ArrayBuffer} The raw signature
  */
-const hmac = (key, content, encoding) => {
-    const mac = _createHmac('sha256', key).update(content);
-    return encoding ? mac.digest(encoding) : mac.digest();
+const hmac = async (key, content) => {
+    const secret = await globalThis.crypto.subtle.importKey('raw', typeof key === 'string' ? ENCODR.encode(key) : key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const data = ENCODR.encode(content);
+    return await globalThis.crypto.subtle.sign('HMAC', secret, data);
 };
 /**
  * Sanitize ETag value by removing quotes and XML entities
@@ -69,7 +105,7 @@ const sanitizeETag = (etag) => {
         '&QUOT;': '',
         '&#x00022': '',
     };
-    return etag.replace(/^("|&quot;|&#34;)|("|&quot;|&#34;)$/g, m => replaceChars[m]);
+    return etag.replace(/(^("|&quot;|&#34;))|(("|&quot;|&#34;)$)/g, m => replaceChars[m]);
 };
 const entityMap = {
     '&quot;': '"',
@@ -228,8 +264,8 @@ const runInBatches = async (tasks, batchSize = 30, minIntervalMs = 0) => {
  * const s3 = new CoreS3({
  *   accessKeyId: 'your-access-key',
  *   secretAccessKey: 'your-secret-key',
- *   endpoint: 'https://your-s3-endpoint.com',
- *   region: 'us-east-1' // by default is auto
+ *   endpoint: 'https://your-s3-endpoint.com/bucket-name',
+ *   region: 'auto' // by default is auto
  * });
  *
  * // Upload a file
@@ -241,7 +277,7 @@ const runInBatches = async (tasks, batchSize = 30, minIntervalMs = 0) => {
  * // Delete a file
  * await s3.deleteObject('example.txt');
  */
-class s3mini {
+class S3mini {
     /**
      * Creates an instance of the S3 class.
      *
@@ -260,6 +296,7 @@ class s3mini {
     secretAccessKey;
     endpoint;
     region;
+    bucketName;
     requestSizeInBytes;
     requestAbortTimeout;
     logger;
@@ -269,8 +306,9 @@ class s3mini {
         this._validateConstructorParams(accessKeyId, secretAccessKey, endpoint);
         this.accessKeyId = accessKeyId;
         this.secretAccessKey = secretAccessKey;
-        this.endpoint = this._ensureValidUrl(endpoint);
+        this.endpoint = new URL(this._ensureValidUrl(endpoint));
         this.region = region;
+        this.bucketName = this._extractBucketName();
         this.requestSizeInBytes = requestSizeInBytes;
         this.requestAbortTimeout = requestAbortTimeout;
         this.logger = logger;
@@ -307,7 +345,7 @@ class s3mini {
                 // Include some general context, but sanitize sensitive parts
                 context: this._sanitize({
                     region: this.region,
-                    endpoint: this.endpoint,
+                    endpoint: this.endpoint.toString(),
                     // Only include the first few characters of the access key, if it exists
                     accessKeyId: this.accessKeyId ? `${this.accessKeyId.substring(0, 4)}...` : undefined,
                 }),
@@ -395,12 +433,15 @@ class s3mini {
         }
         return { filteredOpts, conditionalHeaders };
     }
-    _validateUploadPartParams(key, uploadId, data, partNumber, opts) {
-        this._checkKey(key);
-        if (!(data instanceof Buffer || typeof data === 'string')) {
+    _validateData(data) {
+        if (!((globalThis.Buffer && data instanceof globalThis.Buffer) || typeof data === 'string')) {
             this._log('error', ERROR_DATA_BUFFER_REQUIRED);
             throw new TypeError(ERROR_DATA_BUFFER_REQUIRED);
         }
+        return data;
+    }
+    _validateUploadPartParams(key, uploadId, data, partNumber, opts) {
+        this._checkKey(key);
         if (typeof uploadId !== 'string' || uploadId.trim().length === 0) {
             this._log('error', ERROR_UPLOAD_ID_REQUIRED);
             throw new TypeError(ERROR_UPLOAD_ID_REQUIRED);
@@ -410,8 +451,9 @@ class s3mini {
             throw new TypeError(`${ERROR_PREFIX}partNumber must be a positive integer`);
         }
         this._checkOpts(opts);
+        return this._validateData(data);
     }
-    _sign(method, keyPath, query = {}, headers = {}) {
+    async _sign(method, keyPath, query = {}, headers = {}) {
         // Create URL without appending keyPath first
         const url = new URL(this.endpoint);
         // Properly format the pathname to avoid double slashes
@@ -419,75 +461,53 @@ class s3mini {
             url.pathname =
                 url.pathname === '/' ? `/${keyPath.replace(/^\/+/, '')}` : `${url.pathname}/${keyPath.replace(/^\/+/, '')}`;
         }
-        const fullDatetime = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '');
-        const shortDatetime = fullDatetime.slice(0, 8);
-        const credentialScope = this._buildCredentialScope(shortDatetime);
-        headers[HEADER_AMZ_CONTENT_SHA256] = UNSIGNED_PAYLOAD; // body ? U.hash(body) : C.UNSIGNED_PAYLOAD;
+        const d = new Date();
+        const year = d.getUTCFullYear();
+        const month = String(d.getUTCMonth() + 1).padStart(2, '0');
+        const day = String(d.getUTCDate()).padStart(2, '0');
+        const shortDatetime = `${year}${month}${day}`;
+        const fullDatetime = `${shortDatetime}T${String(d.getUTCHours()).padStart(2, '0')}${String(d.getUTCMinutes()).padStart(2, '0')}${String(d.getUTCSeconds()).padStart(2, '0')}Z`;
+        const credentialScope = `${shortDatetime}/${this.region}/${S3_SERVICE}/${AWS_REQUEST_TYPE}`;
+        headers[HEADER_AMZ_CONTENT_SHA256] = UNSIGNED_PAYLOAD;
         headers[HEADER_AMZ_DATE] = fullDatetime;
         headers[HEADER_HOST] = url.host;
-        const canonicalHeaders = this._buildCanonicalHeaders(headers);
-        const signedHeaders = Object.keys(headers)
-            .map(key => key.toLowerCase())
-            .sort()
-            .join(';');
-        const canonicalRequest = this._buildCanonicalRequest(method, url, query, canonicalHeaders, signedHeaders);
-        const stringToSign = this._buildStringToSign(fullDatetime, credentialScope, canonicalRequest);
-        const signature = this._calculateSignature(shortDatetime, stringToSign);
-        const authorizationHeader = this._buildAuthorizationHeader(credentialScope, signedHeaders, signature);
-        headers[HEADER_AUTHORIZATION] = authorizationHeader;
-        return { url: url.toString(), headers };
-    }
-    _buildCanonicalHeaders(headers) {
-        return Object.entries(headers)
-            .map(([key, value]) => `${key.toLowerCase()}:${String(value).trim()}`)
-            .sort()
-            .join('\n');
-    }
-    _buildCanonicalRequest(method, url, query, canonicalHeaders, signedHeaders) {
-        return [
-            method,
-            url.pathname,
-            this._buildCanonicalQueryString(query),
-            `${canonicalHeaders}\n`,
-            signedHeaders,
-            UNSIGNED_PAYLOAD,
-        ].join('\n');
-    }
-    _buildCredentialScope(shortDatetime) {
-        return [shortDatetime, this.region, S3_SERVICE, AWS_REQUEST_TYPE].join('/');
-    }
-    _buildStringToSign(fullDatetime, credentialScope, canonicalRequest) {
-        return [AWS_ALGORITHM, fullDatetime, credentialScope, hash(canonicalRequest)].join('\n');
-    }
-    _calculateSignature(shortDatetime, stringToSign) {
+        const ignoredHeaders = new Set(['authorization', 'content-length', 'content-type', 'user-agent']);
+        let canonicalHeaders = '';
+        let signedHeaders = '';
+        for (const [key, value] of Object.entries(headers).sort(([a], [b]) => a.localeCompare(b))) {
+            const lowerKey = key.toLowerCase();
+            if (!ignoredHeaders.has(lowerKey)) {
+                if (canonicalHeaders) {
+                    canonicalHeaders += '\n';
+                    signedHeaders += ';';
+                }
+                canonicalHeaders += `${lowerKey}:${String(value).trim()}`;
+                signedHeaders += lowerKey;
+            }
+        }
+        const canonicalRequest = `${method}\n${url.pathname}\n${this._buildCanonicalQueryString(query)}\n${canonicalHeaders}\n\n${signedHeaders}\n${UNSIGNED_PAYLOAD}`;
+        const stringToSign = `${AWS_ALGORITHM}\n${fullDatetime}\n${credentialScope}\n${hexFromBuffer(await sha256(canonicalRequest))}`;
         if (shortDatetime !== this.signingKeyDate) {
             this.signingKeyDate = shortDatetime;
-            this.signingKey = this._getSignatureKey(shortDatetime);
+            this.signingKey = await this._getSignatureKey(shortDatetime);
         }
-        return hmac(this.signingKey, stringToSign, 'hex');
-    }
-    _buildAuthorizationHeader(credentialScope, signedHeaders, signature) {
-        return [
-            `${AWS_ALGORITHM} Credential=${this.accessKeyId}/${credentialScope}`,
-            `SignedHeaders=${signedHeaders}`,
-            `Signature=${signature}`,
-        ].join(', ');
+        const signature = hexFromBuffer(await hmac(this.signingKey, stringToSign));
+        headers[HEADER_AUTHORIZATION] =
+            `${AWS_ALGORITHM} Credential=${this.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+        return { url: url.toString(), headers };
     }
     async _signedRequest(method, // 'GET' | 'HEAD' | 'PUT' | 'POST' | 'DELETE'
     key, // ‘’ allowed for bucket‑level ops
     { query = {}, // ?query=string
-    body = '', // string | Buffer | undefined
+    body = '', // BodyInit | undefined
     headers = {}, // extra/override headers
     tolerated = [], // [200, 404] etc.
     withQuery = false, // append query string to signed URL
      } = {}) {
         // Basic validation
-        if (!['GET', 'HEAD', 'PUT', 'POST', 'DELETE'].includes(method)) {
-            throw new Error(`${ERROR_PREFIX}Unsupported HTTP method ${method}`);
-        }
-        if (key) {
-            this._checkKey(key); // allow '' for bucket‑level
-        }
+        // if (!['GET', 'HEAD', 'PUT', 'POST', 'DELETE'].includes(method)) {
+        //   throw new Error(`${C.ERROR_PREFIX}Unsupported HTTP method ${method as string}`);
+        // }
         const { filteredOpts, conditionalHeaders } = ['GET', 'HEAD'].includes(method)
             ? this._filterIfHeaders(query)
             : { filteredOpts: query, conditionalHeaders: {} };
@@ -498,7 +518,7 @@ class s3mini {
             ...conditionalHeaders,
         };
         const encodedKey = key ? uriResourceEscape(key) : '';
-        const { url, headers: signedHeaders } = this._sign(method, encodedKey, filteredOpts, baseHeaders);
+        const { url, headers: signedHeaders } = await this._sign(method, encodedKey, filteredOpts, baseHeaders);
         if (Object.keys(query).length > 0) {
             withQuery = true; // append query string to signed URL
         }
@@ -507,53 +527,6 @@ class s3mini {
         const signedHeadersString = Object.fromEntries(Object.entries(signedHeaders).map(([k, v]) => [k, String(v)]));
         return this._sendRequest(finalUrl, method, signedHeadersString, body, tolerated);
     }
-    /**
-     * Gets the current configuration properties of the S3 instance.
-     * @returns {IT.S3Config} The current S3 configuration object containing all settings.
-     * @example
-     * const config = s3.getProps();
-     * console.log(config.endpoint); // 'https://s3.amazonaws.com/my-bucket'
-     */
-    getProps() {
-        return {
-            accessKeyId: this.accessKeyId,
-            secretAccessKey: this.secretAccessKey,
-            endpoint: this.endpoint,
-            region: this.region,
-            requestSizeInBytes: this.requestSizeInBytes,
-            requestAbortTimeout: this.requestAbortTimeout,
-            logger: this.logger,
-        };
-    }
-    /**
-     * Updates the configuration properties of the S3 instance.
-     * @param {IT.S3Config} props - The new configuration object.
-     * @param {string} props.accessKeyId - The access key ID for authentication.
-     * @param {string} props.secretAccessKey - The secret access key for authentication.
-     * @param {string} props.endpoint - The endpoint URL of the S3-compatible service.
-     * @param {string} [props.region='auto'] - The region of the S3 service.
-     * @param {number} [props.requestSizeInBytes=8388608] - The request size of a single request in bytes.
-     * @param {number} [props.requestAbortTimeout] - The timeout in milliseconds after which a request should be aborted.
-     * @param {IT.Logger} [props.logger] - A logger object with methods like info, warn, error.
-     * @throws {TypeError} Will throw an error if required parameters are missing or of incorrect type.
-     * @example
-     * s3.setProps({
-     *   accessKeyId: 'new-access-key',
-     *   secretAccessKey: 'new-secret-key',
-     *   endpoint: 'https://new-endpoint.com/my-bucket',
-     *   region: 'us-west-2' // by default is auto
-     * });
-     */
-    setProps(props) {
-        this._validateConstructorParams(props.accessKeyId, props.secretAccessKey, props.endpoint);
-        this.accessKeyId = props.accessKeyId;
-        this.secretAccessKey = props.secretAccessKey;
-        this.region = props.region || 'auto';
-        this.endpoint = props.endpoint;
-        this.requestSizeInBytes = props.requestSizeInBytes || DEFAULT_REQUEST_SIZE_IN_BYTES;
-        this.requestAbortTimeout = props.requestAbortTimeout;
-        this.logger = props.logger;
-    }
     /**
      * Sanitizes an ETag value by removing surrounding quotes and whitespace.
      * Still returns RFC compliant ETag. https://www.rfc-editor.org/rfc/rfc9110#section-8.8.3
@@ -578,7 +551,7 @@ class s3mini {
     `;
         const headers = {
             [HEADER_CONTENT_TYPE]: XML_CONTENT_TYPE,
-            [HEADER_CONTENT_LENGTH]: Buffer.byteLength(xmlBody).toString(),
+            [HEADER_CONTENT_LENGTH]: getByteSize(xmlBody),
         };
         const res = await this._signedRequest('PUT', '', {
             body: xmlBody,
@@ -587,6 +560,35 @@ class s3mini {
         });
         return res.status === 200;
     }
+    _extractBucketName() {
+        const url = this.endpoint;
+        // First check if bucket is in the pathname (path-style URLs)
+        const pathSegments = url.pathname.split('/').filter(p => p);
+        if (pathSegments.length > 0) {
+            if (typeof pathSegments[0] === 'string') {
+                return pathSegments[0];
+            }
+        }
+        // Otherwise extract from subdomain (virtual-hosted-style URLs)
+        const hostParts = url.hostname.split('.');
+        // Common patterns:
+        // bucket-name.s3.amazonaws.com
+        // bucket-name.s3.region.amazonaws.com
+        // bucket-name.region.digitaloceanspaces.com
+        // bucket-name.region.cdn.digitaloceanspaces.com
+        if (hostParts.length >= 3) {
+            // Check if it's a known S3-compatible service
+            const domain = hostParts.slice(-2).join('.');
+            const knownDomains = ['amazonaws.com', 'digitaloceanspaces.com', 'cloudflare.com'];
+            if (knownDomains.some(d => domain.includes(d))) {
+                if (typeof hostParts[0] === 'string') {
+                    return hostParts[0];
+                }
+            }
+        }
+        // Fallback: use the first subdomain
+        return hostParts[0] || '';
+    }
     /**
      * Checks if a bucket exists.
      * This method sends a request to check if the specified bucket exists in the S3-compatible service.
@@ -603,7 +605,7 @@ class s3mini {
      * @param {string} [prefix=''] - The prefix to filter objects by.
      * @param {number} [maxKeys] - The maximum number of keys to return. If not provided, all keys will be returned.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
-     * @returns {Promise<object[] | null>} A promise that resolves to an array of objects or null if the bucket is empty.
+     * @returns {Promise<IT.ListObject[] | null>} A promise that resolves to an array of objects or null if the bucket is empty.
      * @example
      * // List all objects
      * const objects = await s3.listObjects();
@@ -611,9 +613,7 @@ class s3mini {
      * // List objects with prefix
      * const photos = await s3.listObjects('/', 'photos/', 100);
      */
-    async listObjects(delimiter = '/', prefix = '', maxKeys, 
-    // method: IT.HttpMethod = 'GET', // 'GET' or 'HEAD'
-    opts = {}) {
+    async listObjects(delimiter = '/', prefix = '', maxKeys, opts = {}) {
         this._checkDelimiter(delimiter);
         this._checkPrefix(prefix);
         this._checkOpts(opts);
@@ -623,51 +623,80 @@ class s3mini {
         let token;
         const all = [];
         do {
-            const batchSize = Math.min(remaining, 1000); // S3 ceiling
-            const query = {
-                'list-type': LIST_TYPE, // =2 for V2
-                'max-keys': String(batchSize),
-                ...(prefix ? { prefix } : {}),
-                ...(token ? { 'continuation-token': token } : {}),
-                ...opts,
-            };
-            const res = await this._signedRequest('GET', keyPath, {
-                query,
-                withQuery: true,
-                tolerated: [200, 404],
-            });
-            if (res.status === 404) {
-                return null;
-            }
-            if (res.status !== 200) {
-                const errorBody = await res.text();
-                const errorCode = res.headers.get('x-amz-error-code') || 'Unknown';
-                const errorMessage = res.headers.get('x-amz-error-message') || res.statusText;
-                this._log('error', `${ERROR_PREFIX}Request failed with status ${res.status}: ${errorCode} - ${errorMessage}, err body: ${errorBody}`);
-                throw new Error(`${ERROR_PREFIX}Request failed with status ${res.status}: ${errorCode} - ${errorMessage}, err body: ${errorBody}`);
+            const batchResult = await this._fetchObjectBatch(keyPath, prefix, remaining, token, opts);
+            if (batchResult === null) {
+                return null; // 404 - bucket not found
             }
-            const raw = parseXml(await res.text());
-            if (typeof raw !== 'object' || !raw || 'error' in raw) {
-                this._log('error', `${ERROR_PREFIX}Unexpected listObjects response shape: ${JSON.stringify(raw)}`);
-                throw new Error(`${ERROR_PREFIX}Unexpected listObjects response shape`);
+            all.push(...batchResult.objects);
+            if (!unlimited) {
+                remaining -= batchResult.objects.length;
             }
-            const out = (raw.ListBucketResult || raw.listBucketResult || raw);
-            /* accumulate Contents */
-            const contents = out.Contents || out.contents; // S3 v2 vs v1
-            if (contents) {
-                const batch = Array.isArray(contents) ? contents : [contents];
-                all.push(...batch);
-                if (!unlimited) {
-                    remaining -= batch.length;
-                }
-            }
-            const truncated = out.IsTruncated === 'true' || out.isTruncated === 'true' || false;
-            token = truncated
-                ? (out.NextContinuationToken || out.nextContinuationToken || out.NextMarker || out.nextMarker)
-                : undefined;
+            token = batchResult.continuationToken;
         } while (token && remaining > 0);
         return all;
     }
+    async _fetchObjectBatch(keyPath, prefix, remaining, token, opts) {
+        const query = this._buildListObjectsQuery(prefix, remaining, token, opts);
+        const res = await this._signedRequest('GET', keyPath, {
+            query,
+            withQuery: true,
+            tolerated: [200, 404],
+        });
+        if (res.status === 404) {
+            return null;
+        }
+        if (res.status !== 200) {
+            await this._handleListObjectsError(res);
+        }
+        const xmlText = await res.text();
+        return this._parseListObjectsResponse(xmlText);
+    }
+    _buildListObjectsQuery(prefix, remaining, token, opts) {
+        const batchSize = Math.min(remaining, 1000); // S3 ceiling
+        return {
+            'list-type': LIST_TYPE, // =2 for V2
+            'max-keys': String(batchSize),
+            ...(prefix ? { prefix } : {}),
+            ...(token ? { 'continuation-token': token } : {}),
+            ...opts,
+        };
+    }
+    async _handleListObjectsError(res) {
+        const errorBody = await res.text();
+        const parsedErrorBody = this._parseErrorXml(res.headers, errorBody);
+        const errorCode = res.headers.get('x-amz-error-code') ?? parsedErrorBody.svcCode ?? 'Unknown';
+        const errorMessage = res.headers.get('x-amz-error-message') ?? parsedErrorBody.errorMessage ?? res.statusText;
+        this._log('error', `${ERROR_PREFIX}Request failed with status ${res.status}: ${errorCode} - ${errorMessage}, err body: ${errorBody}`);
+        throw new Error(`${ERROR_PREFIX}Request failed with status ${res.status}: ${errorCode} - ${errorMessage}, err body: ${errorBody}`);
+    }
+    _parseListObjectsResponse(xmlText) {
+        const raw = parseXml(xmlText);
+        if (typeof raw !== 'object' || !raw || 'error' in raw) {
+            this._log('error', `${ERROR_PREFIX}Unexpected listObjects response shape: ${JSON.stringify(raw)}`);
+            throw new Error(`${ERROR_PREFIX}Unexpected listObjects response shape`);
+        }
+        const out = (raw.ListBucketResult || raw.listBucketResult || raw);
+        const objects = this._extractObjectsFromResponse(out);
+        const continuationToken = this._extractContinuationToken(out);
+        return { objects, continuationToken };
+    }
+    _extractObjectsFromResponse(response) {
+        const contents = response.Contents || response.contents; // S3 v2 vs v1
+        if (!contents) {
+            return [];
+        }
+        return Array.isArray(contents) ? contents : [contents];
+    }
+    _extractContinuationToken(response) {
+        const truncated = response.IsTruncated === 'true' || response.isTruncated === 'true' || false;
+        if (!truncated) {
+            return undefined;
+        }
+        return (response.NextContinuationToken ||
+            response.nextContinuationToken ||
+            response.NextMarker ||
+            response.nextMarker);
+    }
     /**
      * Lists multipart uploads in the bucket.
      * This method sends a request to list multipart uploads in the specified bucket.
@@ -709,11 +738,17 @@ class s3mini {
      * Get an object from the S3-compatible service.
      * This method sends a request to retrieve the specified object from the S3-compatible service.
      * @param {string} key - The key of the object to retrieve.
-     * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {Record<string, unknown>} [opts] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to the object data (string) or null if not found.
      */
-    async getObject(key, opts = {}) {
-        const res = await this._signedRequest('GET', key, { query: opts, tolerated: [200, 404, 412, 304] });
+    async getObject(key, opts = {}, ssecHeaders) {
+        // if ssecHeaders is set, add it to headers
+        const res = await this._signedRequest('GET', key, {
+            query: opts, // use opts.query if it exists, otherwise use an empty object
+            tolerated: [200, 404, 412, 304],
+            headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+        });
         if ([404, 412, 304].includes(res.status)) {
             return null;
         }
@@ -724,10 +759,15 @@ class s3mini {
      * This method sends a request to retrieve the specified object and returns the full response.
      * @param {string} key - The key of the object to retrieve.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to the Response object or null if not found.
      */
-    async getObjectResponse(key, opts = {}) {
-        const res = await this._signedRequest('GET', key, { query: opts, tolerated: [200, 404, 412, 304] });
+    async getObjectResponse(key, opts = {}, ssecHeaders) {
+        const res = await this._signedRequest('GET', key, {
+            query: opts,
+            tolerated: [200, 404, 412, 304],
+            headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+        });
         if ([404, 412, 304].includes(res.status)) {
             return null;
         }
@@ -738,10 +778,15 @@ class s3mini {
      * This method sends a request to retrieve the specified object and returns it as an ArrayBuffer.
      * @param {string} key - The key of the object to retrieve.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to the object data as an ArrayBuffer or null if not found.
      */
-    async getObjectArrayBuffer(key, opts = {}) {
-        const res = await this._signedRequest('GET', key, { query: opts, tolerated: [200, 404, 412, 304] });
+    async getObjectArrayBuffer(key, opts = {}, ssecHeaders) {
+        const res = await this._signedRequest('GET', key, {
+            query: opts,
+            tolerated: [200, 404, 412, 304],
+            headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+        });
         if ([404, 412, 304].includes(res.status)) {
             return null;
         }
@@ -752,10 +797,15 @@ class s3mini {
      * This method sends a request to retrieve the specified object and returns it as JSON.
      * @param {string} key - The key of the object to retrieve.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to the object data as JSON or null if not found.
      */
-    async getObjectJSON(key, opts = {}) {
-        const res = await this._signedRequest('GET', key, { query: opts, tolerated: [200, 404, 412, 304] });
+    async getObjectJSON(key, opts = {}, ssecHeaders) {
+        const res = await this._signedRequest('GET', key, {
+            query: opts,
+            tolerated: [200, 404, 412, 304],
+            headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+        });
         if ([404, 412, 304].includes(res.status)) {
             return null;
         }
@@ -766,11 +816,16 @@ class s3mini {
      * This method sends a request to retrieve the specified object and its ETag.
      * @param {string} key - The key of the object to retrieve.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to an object containing the ETag and the object data as an ArrayBuffer or null if not found.
      */
-    async getObjectWithETag(key, opts = {}) {
+    async getObjectWithETag(key, opts = {}, ssecHeaders) {
         try {
-            const res = await this._signedRequest('GET', key, { query: opts, tolerated: [200, 404, 412, 304] });
+            const res = await this._signedRequest('GET', key, {
+                query: opts,
+                tolerated: [200, 404, 412, 304],
+                headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+            });
             if ([404, 412, 304].includes(res.status)) {
                 return { etag: null, data: null };
             }
@@ -793,13 +848,14 @@ class s3mini {
      * @param {number} [rangeFrom=0] - The starting byte for the range (if not whole file).
      * @param {number} [rangeTo=this.requestSizeInBytes] - The ending byte for the range (if not whole file).
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns A promise that resolves to the Response object.
      */
-    async getObjectRaw(key, wholeFile = true, rangeFrom = 0, rangeTo = this.requestSizeInBytes, opts = {}) {
+    async getObjectRaw(key, wholeFile = true, rangeFrom = 0, rangeTo = this.requestSizeInBytes, opts = {}, ssecHeaders) {
         const rangeHdr = wholeFile ? {} : { range: `bytes=${rangeFrom}-${rangeTo - 1}` };
         return this._signedRequest('GET', key, {
             query: { ...opts },
-            headers: rangeHdr,
+            headers: { ...rangeHdr, ...ssecHeaders },
             withQuery: true, // keep ?query=string behaviour
         });
     }
@@ -810,9 +866,11 @@ class s3mini {
      * @returns A promise that resolves to the content length of the object in bytes, or 0 if not found.
      * @throws {Error} If the content length header is not found in the response.
      */
-    async getContentLength(key) {
+    async getContentLength(key, ssecHeaders) {
         try {
-            const res = await this._signedRequest('HEAD', key);
+            const res = await this._signedRequest('HEAD', key, {
+                headers: ssecHeaders ? { ...ssecHeaders } : undefined,
+            });
             const len = res.headers.get(HEADER_CONTENT_LENGTH);
             return len ? +len : 0;
         }
@@ -845,6 +903,7 @@ class s3mini {
      * Retrieves the ETag of an object without downloading its content.
      * @param {string} key - The key of the object to retrieve the ETag for.
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns {Promise<string | null>} A promise that resolves to the ETag value or null if the object is not found.
      * @throws {Error} If the ETag header is not found in the response.
      * @example
@@ -853,14 +912,18 @@ class s3mini {
      *   console.log(`File ETag: ${etag}`);
      * }
      */
-    async getEtag(key, opts = {}) {
+    async getEtag(key, opts = {}, ssecHeaders) {
         const res = await this._signedRequest('HEAD', key, {
             query: opts,
-            tolerated: [200, 404],
+            tolerated: [200, 304, 404, 412],
+            headers: ssecHeaders ? { ...ssecHeaders } : undefined,
         });
         if (res.status === 404) {
             return null;
         }
+        if (res.status === 412 || res.status === 304) {
+            return null; // ETag mismatch
+        }
         const etag = res.headers.get(HEADER_ETAG);
         if (!etag) {
             throw new Error(`${ERROR_PREFIX}ETag not found in response headers`);
@@ -872,6 +935,8 @@ class s3mini {
      * @param {string} key - The key/path where the object will be stored.
      * @param {string | Buffer} data - The data to upload (string or Buffer).
      * @param {string} [fileType='application/octet-stream'] - The MIME type of the file.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
+     * @param {IT.AWSHeaders} [additionalHeaders] - Additional x-amz-* headers specific to this request, if any.
      * @returns {Promise<Response>} A promise that resolves to the Response object from the upload request.
      * @throws {TypeError} If data is not a string or Buffer.
      * @example
@@ -882,15 +947,14 @@ class s3mini {
      * const buffer = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
      * await s3.putObject('image.png', buffer, 'image/png');
      */
-    async putObject(key, data, fileType = DEFAULT_STREAM_CONTENT_TYPE) {
-        if (!(data instanceof Buffer || typeof data === 'string')) {
-            throw new TypeError(ERROR_DATA_BUFFER_REQUIRED);
-        }
+    async putObject(key, data, fileType = DEFAULT_STREAM_CONTENT_TYPE, ssecHeaders, additionalHeaders) {
         return this._signedRequest('PUT', key, {
-            body: data,
+            body: this._validateData(data),
             headers: {
-                [HEADER_CONTENT_LENGTH]: typeof data === 'string' ? Buffer.byteLength(data) : data.length,
+                [HEADER_CONTENT_LENGTH]: getByteSize(data),
                 [HEADER_CONTENT_TYPE]: fileType,
+                ...additionalHeaders,
+                ...ssecHeaders,
             },
             tolerated: [200],
         });
@@ -899,6 +963,7 @@ class s3mini {
      * Initiates a multipart upload and returns the upload ID.
      * @param {string} key - The key/path where the object will be stored.
      * @param {string} [fileType='application/octet-stream'] - The MIME type of the file.
+     * @param {IT.SSECHeaders?} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns {Promise<string>} A promise that resolves to the upload ID for the multipart upload.
      * @throws {TypeError} If key is invalid or fileType is not a string.
      * @throws {Error} If the multipart upload fails to initialize.
@@ -906,28 +971,19 @@ class s3mini {
      * const uploadId = await s3.getMultipartUploadId('large-file.zip', 'application/zip');
      * console.log(`Started multipart upload: ${uploadId}`);
      */
-    async getMultipartUploadId(key, fileType = DEFAULT_STREAM_CONTENT_TYPE) {
+    async getMultipartUploadId(key, fileType = DEFAULT_STREAM_CONTENT_TYPE, ssecHeaders) {
         this._checkKey(key);
         if (typeof fileType !== 'string') {
             throw new TypeError(`${ERROR_PREFIX}fileType must be a string`);
         }
         const query = { uploads: '' };
-        const headers = { [HEADER_CONTENT_TYPE]: fileType };
+        const headers = { [HEADER_CONTENT_TYPE]: fileType, ...ssecHeaders };
         const res = await this._signedRequest('POST', key, {
             query,
             headers,
             withQuery: true,
         });
         const parsed = parseXml(await res.text());
-        // if (
-        //   parsed &&
-        //   typeof parsed === 'object' &&
-        //   'initiateMultipartUploadResult' in parsed &&
-        //   parsed.initiateMultipartUploadResult &&
-        //   'uploadId' in (parsed.initiateMultipartUploadResult as { uploadId: string })
-        // ) {
-        //   return (parsed.initiateMultipartUploadResult as { uploadId: string }).uploadId;
-        // }
         if (parsed && typeof parsed === 'object') {
             // Check for both cases of InitiateMultipartUploadResult
             const uploadResult = parsed.initiateMultipartUploadResult ||
@@ -949,6 +1005,7 @@ class s3mini {
      * @param {Buffer | string} data - The data for this part.
      * @param {number} partNumber - The part number (must be between 1 and 10,000).
      * @param {Record<string, unknown>} [opts={}] - Additional options for the request.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns {Promise<IT.UploadPart>} A promise that resolves to an object containing the partNumber and etag.
      * @throws {TypeError} If any parameter is invalid.
      * @example
@@ -960,13 +1017,16 @@ class s3mini {
      * );
      * console.log(`Part ${part.partNumber} uploaded with ETag: ${part.etag}`);
      */
-    async uploadPart(key, uploadId, data, partNumber, opts = {}) {
-        this._validateUploadPartParams(key, uploadId, data, partNumber, opts);
+    async uploadPart(key, uploadId, data, partNumber, opts = {}, ssecHeaders) {
+        const body = this._validateUploadPartParams(key, uploadId, data, partNumber, opts);
         const query = { uploadId, partNumber, ...opts };
         const res = await this._signedRequest('PUT', key, {
             query,
-            body: data,
-            headers: { [HEADER_CONTENT_LENGTH]: typeof data === 'string' ? Buffer.byteLength(data) : data.length },
+            body,
+            headers: {
+                [HEADER_CONTENT_LENGTH]: getByteSize(data),
+                ...ssecHeaders,
+            },
         });
         return { partNumber, etag: sanitizeETag(res.headers.get('etag') || '') };
     }
@@ -993,7 +1053,7 @@ class s3mini {
         const xmlBody = this._buildCompleteMultipartUploadXml(parts);
         const headers = {
             [HEADER_CONTENT_TYPE]: XML_CONTENT_TYPE,
-            [HEADER_CONTENT_LENGTH]: Buffer.byteLength(xmlBody).toString(),
+            [HEADER_CONTENT_LENGTH]: getByteSize(xmlBody),
         };
         const res = await this._signedRequest('POST', key, {
             query,
@@ -1012,7 +1072,7 @@ class s3mini {
                 if (etag && typeof etag === 'string') {
                     return {
                         ...resultObj,
-                        etag: this.sanitizeETag(etag),
+                        etag: sanitizeETag(etag),
                     };
                 }
                 return result;
@@ -1024,6 +1084,7 @@ class s3mini {
      * Aborts a multipart upload and removes all uploaded parts.
      * @param {string} key - The key of the object being uploaded.
      * @param {string} uploadId - The upload ID to abort.
+     * @param {IT.SSECHeaders} [ssecHeaders] - Server-Side Encryption headers, if any.
      * @returns {Promise<object>} A promise that resolves to an object containing the abort status and details.
      * @throws {TypeError} If key or uploadId is invalid.
      * @throws {Error} If the abort operation fails.
@@ -1035,13 +1096,13 @@ class s3mini {
      *   console.error('Failed to abort upload:', error);
      * }
      */
-    async abortMultipartUpload(key, uploadId) {
+    async abortMultipartUpload(key, uploadId, ssecHeaders) {
         this._checkKey(key);
         if (!uploadId) {
             throw new TypeError(ERROR_UPLOAD_ID_REQUIRED);
         }
         const query = { uploadId };
-        const headers = { [HEADER_CONTENT_TYPE]: XML_CONTENT_TYPE };
+        const headers = { [HEADER_CONTENT_TYPE]: XML_CONTENT_TYPE, ...(ssecHeaders ? { ...ssecHeaders } : {}) };
         const res = await this._signedRequest('DELETE', key, {
             query,
             headers,
@@ -1059,18 +1120,193 @@ class s3mini {
         return { status: 'Aborted', key, uploadId, response: parsed };
     }
     _buildCompleteMultipartUploadXml(parts) {
-        return `
-      <CompleteMultipartUpload>
-        ${parts
-            .map(part => `
-          <Part>
-            <PartNumber>${part.partNumber}</PartNumber>
-            <ETag>${part.etag}</ETag>
-          </Part>
-        `)
-            .join('')}
-      </CompleteMultipartUpload>
-    `;
+        let xml = '<CompleteMultipartUpload>';
+        for (const part of parts) {
+            xml += `<Part><PartNumber>${part.partNumber}</PartNumber><ETag>${part.etag}</ETag></Part>`;
+        }
+        xml += '</CompleteMultipartUpload>';
+        return xml;
+    }
+    /**
+     * Executes the copy operation for local copying (same bucket/endpoint).
+     * @private
+     */
+    async _executeCopyOperation(destinationKey, copySource, options) {
+        const { metadataDirective = 'COPY', metadata = {}, contentType, storageClass, taggingDirective, websiteRedirectLocation, sourceSSECHeaders = {}, destinationSSECHeaders = {}, additionalHeaders = {}, } = options;
+        const headers = {
+            'x-amz-copy-source': copySource,
+            'x-amz-metadata-directive': metadataDirective,
+            ...additionalHeaders,
+            ...(contentType && { [HEADER_CONTENT_TYPE]: contentType }),
+            ...(storageClass && { 'x-amz-storage-class': storageClass }),
+            ...(taggingDirective && { 'x-amz-tagging-directive': taggingDirective }),
+            ...(websiteRedirectLocation && { 'x-amz-website-redirect-location': websiteRedirectLocation }),
+            ...this._buildSSECHeaders(sourceSSECHeaders, destinationSSECHeaders),
+            ...(metadataDirective === 'REPLACE' ? this._buildMetadataHeaders(metadata) : {}),
+        };
+        try {
+            const res = await this._signedRequest('PUT', destinationKey, {
+                headers,
+                tolerated: [200],
+            });
+            return this._parseCopyObjectResponse(await res.text());
+        }
+        catch (err) {
+            this._log('error', `Error in copy operation to ${destinationKey}`, {
+                error: String(err),
+            });
+            throw err;
+        }
+    }
+    /**
+     * Copies an object within the same bucket.
+     *
+     * @param {string} sourceKey - The key of the source object to copy
+     * @param {string} destinationKey - The key where the object will be copied to
+     * @param {IT.CopyObjectOptions} [options={}] - Copy operation options
+     * @param {string} [options.metadataDirective='COPY'] - How to handle metadata ('COPY' | 'REPLACE')
+     * @param {Record<string,string>} [options.metadata={}] - New metadata (only used if metadataDirective='REPLACE')
+     * @param {string} [options.contentType] - New content type for the destination object
+     * @param {string} [options.storageClass] - Storage class for the destination object
+     * @param {string} [options.taggingDirective] - How to handle object tags ('COPY' | 'REPLACE')
+     * @param {string} [options.websiteRedirectLocation] - Website redirect location for the destination
+     * @param {IT.SSECHeaders} [options.sourceSSECHeaders={}] - Encryption headers for reading source (if encrypted)
+     * @param {IT.SSECHeaders} [options.destinationSSECHeaders={}] - Encryption headers for destination
+     * @param {IT.AWSHeaders} [options.additionalHeaders={}] - Extra x-amz-* headers
+     *
+     * @returns {Promise<IT.CopyObjectResult>} Copy result with etag and lastModified date
+     * @throws {TypeError} If sourceKey or destinationKey is invalid
+     * @throws {Error} If copy operation fails or S3 returns an error
+     *
+     * @example
+     * // Simple copy
+     * const result = await s3.copyObject('report-2024.pdf', 'archive/report-2024.pdf');
+     * console.log(`Copied with ETag: ${result.etag}`);
+     *
+     * @example
+     * // Copy with new metadata and content type
+     * const result = await s3.copyObject('data.csv', 'processed/data.csv', {
+     *   metadataDirective: 'REPLACE',
+     *   metadata: {
+     *     'processed-date': new Date().toISOString(),
+     *     'original-name': 'data.csv'
+     *   },
+     *   contentType: 'text/csv; charset=utf-8'
+     * });
+     *
+     * @example
+     * // Copy encrypted object (Cloudflare R2 SSE-C)
+     * const ssecKey = 'n1TKiTaVHlYLMX9n0zHXyooMr026vOiTEFfT+719Hho=';
+     * await s3.copyObject('sensitive.json', 'backup/sensitive.json', {
+     *   sourceSSECHeaders: {
+     *     'x-amz-copy-source-server-side-encryption-customer-algorithm': 'AES256',
+     *     'x-amz-copy-source-server-side-encryption-customer-key': ssecKey,
+     *     'x-amz-copy-source-server-side-encryption-customer-key-md5': 'gepZmzgR7Be/1+K1Aw+6ow=='
+     *   },
+     *   destinationSSECHeaders: {
+     *     'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+     *     'x-amz-server-side-encryption-customer-key': ssecKey,
+     *     'x-amz-server-side-encryption-customer-key-md5': 'gepZmzgR7Be/1+K1Aw+6ow=='
+     *   }
+     * });
+     */
+    copyObject(sourceKey, destinationKey, options = {}) {
+        // Validate parameters
+        this._checkKey(sourceKey);
+        this._checkKey(destinationKey);
+        const copySource = `/${this.bucketName}/${uriEscape(sourceKey)}`;
+        return this._executeCopyOperation(destinationKey, copySource, options);
+    }
+    _buildSSECHeaders(sourceHeaders, destHeaders) {
+        const headers = {};
+        Object.entries({ ...sourceHeaders, ...destHeaders }).forEach(([k, v]) => {
+            if (v !== undefined) {
+                headers[k] = v;
+            }
+        });
+        return headers;
+    }
+    /**
+     * Moves an object within the same bucket (copy + delete atomic-like operation).
+     *
+     * WARNING: Not truly atomic - if delete fails after successful copy, the object
+     * will exist in both locations. Consider your use case carefully.
+     *
+     * @param {string} sourceKey - The key of the source object to move
+     * @param {string} destinationKey - The key where the object will be moved to
+     * @param {IT.CopyObjectOptions} [options={}] - Options passed to the copy operation
+     *
+     * @returns {Promise<IT.CopyObjectResult>} Result from the copy operation
+     * @throws {TypeError} If sourceKey or destinationKey is invalid
+     * @throws {Error} If copy succeeds but delete fails (includes copy result in error)
+     *
+     * @example
+     * // Simple move
+     * await s3.moveObject('temp/upload.tmp', 'files/document.pdf');
+     *
+     * @example
+     * // Move with metadata update
+     * await s3.moveObject('unprocessed/image.jpg', 'processed/image.jpg', {
+     *   metadataDirective: 'REPLACE',
+     *   metadata: {
+     *     'status': 'processed',
+     *     'processed-at': Date.now().toString()
+     *   },
+     *   contentType: 'image/jpeg'
+     * });
+     *
+     * @example
+     * // Safe move with error handling
+     * try {
+     *   const result = await s3.moveObject('inbox/file.dat', 'archive/file.dat');
+     *   console.log(`Moved successfully: ${result.etag}`);
+     * } catch (error) {
+     *   // Check if copy succeeded but delete failed
+     *   if (error.message.includes('delete source object after successful copy')) {
+     *     console.warn('File copied but not deleted from source - manual cleanup needed');
+     *   }
+     * }
+     */
+    async moveObject(sourceKey, destinationKey, options = {}) {
+        try {
+            // First copy the object
+            const copyResult = await this.copyObject(sourceKey, destinationKey, options);
+            // Then delete the source
+            const deleteSuccess = await this.deleteObject(sourceKey);
+            if (!deleteSuccess) {
+                throw new Error(`${ERROR_PREFIX}Failed to delete source object after successful copy`);
+            }
+            return copyResult;
+        }
+        catch (err) {
+            this._log('error', `Error moving object from ${sourceKey} to ${destinationKey}`, {
+                error: String(err),
+            });
+            throw err;
+        }
+    }
+    _buildMetadataHeaders(metadata) {
+        const headers = {};
+        Object.entries(metadata).forEach(([k, v]) => {
+            headers[k.startsWith('x-amz-meta-') ? k : `x-amz-meta-${k}`] = v;
+        });
+        return headers;
+    }
+    _parseCopyObjectResponse(xmlText) {
+        const parsed = parseXml(xmlText);
+        if (!parsed || typeof parsed !== 'object') {
+            throw new Error(`${ERROR_PREFIX}Unexpected copyObject response format`);
+        }
+        const result = (parsed.CopyObjectResult || parsed.copyObjectResult || parsed);
+        const etag = result.ETag || result.eTag || result.etag;
+        const lastModified = result.LastModified || result.lastModified;
+        if (!etag || typeof etag !== 'string') {
+            throw new Error(`${ERROR_PREFIX}ETag not found in copyObject response`);
+        }
+        return {
+            etag: sanitizeETag(etag),
+            lastModified: lastModified ? new Date(lastModified) : undefined,
+        };
     }
     /**
      * Deletes an object from the bucket.
@@ -1083,13 +1319,14 @@ class s3mini {
         return res.status === 200 || res.status === 204;
     }
     async _deleteObjectsProcess(keys) {
-        const xmlBody = `<Delete>${keys.map(key => `<Object><Key>${escapeXml(key)}</Key></Object>`).join('')}</Delete>`;
+        const objectsXml = keys.map(key => `<Object><Key>${escapeXml(key)}</Key></Object>`).join('');
+        const xmlBody = '<Delete>' + objectsXml + '</Delete>';
         const query = { delete: '' };
-        const md5Base64 = md5base64(xmlBody);
+        const sha256base64 = base64FromBuffer(await sha256(xmlBody));
         const headers = {
             [HEADER_CONTENT_TYPE]: XML_CONTENT_TYPE,
-            [HEADER_CONTENT_LENGTH]: Buffer.byteLength(xmlBody).toString(),
-            'Content-MD5': md5Base64,
+            [HEADER_CONTENT_LENGTH]: getByteSize(xmlBody),
+            [HEADER_AMZ_CHECKSUM_SHA256]: sha256base64,
         };
         const res = await this._signedRequest('POST', '', {
             query,
@@ -1177,9 +1414,10 @@ class s3mini {
                 signal: this.requestAbortTimeout !== undefined ? AbortSignal.timeout(this.requestAbortTimeout) : undefined,
             });
             this._log('info', `Response status: ${res.status}, tolerated: ${toleratedStatusCodes.join(',')}`);
-            if (!res.ok && !toleratedStatusCodes.includes(res.status)) {
-                await this._handleErrorResponse(res);
+            if (res.ok || toleratedStatusCodes.includes(res.status)) {
+                return res;
             }
+            await this._handleErrorResponse(res);
             return res;
         }
         catch (err) {
@@ -1190,10 +1428,29 @@ class s3mini {
             throw err;
         }
     }
+    _parseErrorXml(headers, body) {
+        if (headers.get('content-type') !== 'application/xml') {
+            return {};
+        }
+        const parsedBody = parseXml(body);
+        if (!parsedBody ||
+            typeof parsedBody !== 'object' ||
+            !('Error' in parsedBody) ||
+            !parsedBody.Error ||
+            typeof parsedBody.Error !== 'object') {
+            return {};
+        }
+        const error = parsedBody.Error;
+        return {
+            svcCode: 'Code' in error && typeof error.Code === 'string' ? error.Code : undefined,
+            errorMessage: 'Message' in error && typeof error.Message === 'string' ? error.Message : undefined,
+        };
+    }
     async _handleErrorResponse(res) {
         const errorBody = await res.text();
-        const svcCode = res.headers.get('x-amz-error-code') ?? 'Unknown';
-        const errorMessage = res.headers.get('x-amz-error-message') || res.statusText;
+        const parsedErrorBody = this._parseErrorXml(res.headers, errorBody);
+        const svcCode = res.headers.get('x-amz-error-code') ?? parsedErrorBody.svcCode ?? 'Unknown';
+        const errorMessage = res.headers.get('x-amz-error-message') ?? parsedErrorBody.errorMessage ?? res.statusText;
         this._log('error', `${ERROR_PREFIX}Request failed with status ${res.status}: ${svcCode} - ${errorMessage},err body: ${errorBody}`);
         throw new S3ServiceError(`S3 returned ${res.status} – ${svcCode}`, res.status, svcCode, errorBody);
     }
@@ -1203,16 +1460,16 @@ class s3mini {
         }
         return Object.keys(queryParams)
             .map(key => `${encodeURIComponent(key)}=${encodeURIComponent(queryParams[key])}`)
-            .sort()
+            .sort((a, b) => a.localeCompare(b))
             .join('&');
     }
-    _getSignatureKey(dateStamp) {
-        const kDate = hmac(`AWS4${this.secretAccessKey}`, dateStamp);
-        const kRegion = hmac(kDate, this.region);
-        const kService = hmac(kRegion, S3_SERVICE);
-        return hmac(kService, AWS_REQUEST_TYPE);
+    async _getSignatureKey(dateStamp) {
+        const kDate = await hmac(`AWS4${this.secretAccessKey}`, dateStamp);
+        const kRegion = await hmac(kDate, this.region);
+        const kService = await hmac(kRegion, S3_SERVICE);
+        return await hmac(kService, AWS_REQUEST_TYPE);
     }
 }
 
-export { s3mini as default, runInBatches, s3mini, sanitizeETag };
+export { S3mini, S3mini as default, runInBatches, sanitizeETag };
 //# sourceMappingURL=s3mini.js.map