s3mini 0.9.3 → 0.9.5

package/src/S3.ts

@@ -17,6 +17,9 @@ import {
   S3ServiceError,
   generateParts,
   toUint8Array,
+  isBun,
+  extractBaseEndpoint,
+  byCodePoint,
 } from './utils.js';
 import type * as IT from './types.js';
 
@@ -70,6 +73,7 @@ class S3mini {
   readonly logger?: IT.Logger;
   readonly _fetch: typeof fetch;
   readonly minPartSize: number;
+  private readonly _bun?: IT.NativeS3Client;
   private signingKeyDate?: string;
   private signingKey?: ArrayBuffer;
 
@@ -95,6 +99,19 @@ class S3mini {
     this.logger = logger;
     this._fetch = (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => fetch(input, init);
     this.minPartSize = minPartSize;
+
+    if (isBun) {
+      const { S3Client } = (
+        globalThis as unknown as { Bun: { S3Client: new (o: Record<string, unknown>) => IT.NativeS3Client } }
+      ).Bun;
+      this._bun = new S3Client({
+        accessKeyId,
+        secretAccessKey,
+        endpoint: extractBaseEndpoint(this.endpoint, this.bucketName),
+        region: this.region,
+        bucket: this.bucketName,
+      });
+    }
   }
 
   private _sanitize(obj: unknown): unknown {
@@ -169,6 +186,18 @@ class S3mini {
     return this.#accessKeyId.trim().length > 0 && this.#secretAccessKey.trim().length > 0;
   }
 
+  /** Run a read op via Bun-native S3, returning null on NoSuchKey. */
+  private async _bunRead<T>(key: string, op: (f: IT.NativeS3File) => Promise<T>): Promise<T | null> {
+    try {
+      return await op(this._bun!.file(key));
+    } catch (e) {
+      if ((e as { code?: string })?.code === 'NoSuchKey') {
+        return null;
+      }
+      throw e;
+    }
+  }
+
   private _ensureValidUrl(raw: string): string {
     const candidate = /^(https?:)?\/\//i.test(raw) ? raw : `https://${raw}`;
     try {
@@ -317,20 +346,13 @@ class S3mini {
 
     const ignoredHeaders = new Set(['authorization', 'content-length', 'content-type', 'user-agent']);
 
-    let canonicalHeaders = '';
-    let signedHeaders = '';
+    const sortedHeaders = Object.entries(headers)
+      .map(([key, value]): [string, string] => [key.toLowerCase(), String(value).trim()])
+      .filter(([lowerKey]) => !ignoredHeaders.has(lowerKey))
+      .sort(([a], [b]) => byCodePoint(a, b));
 
-    for (const [key, value] of Object.entries(headers).sort(([a], [b]) => a.localeCompare(b))) {
-      const lowerKey = key.toLowerCase();
-      if (!ignoredHeaders.has(lowerKey)) {
-        if (canonicalHeaders) {
-          canonicalHeaders += '\n';
-          signedHeaders += ';';
-        }
-        canonicalHeaders += `${lowerKey}:${String(value).trim()}`;
-        signedHeaders += lowerKey;
-      }
-    }
+    const canonicalHeaders = sortedHeaders.map(([k, v]) => `${k}:${v}`).join('\n');
+    const signedHeaders = sortedHeaders.map(([k]) => k).join(';');
     const canonicalRequest = `${method}\n${url.pathname}\n${this._buildCanonicalQueryString(query)}\n${canonicalHeaders}\n\n${signedHeaders}\n${C.UNSIGNED_PAYLOAD}`;
     const stringToSign = `${C.AWS_ALGORITHM}\n${fullDatetime}\n${credentialScope}\n${hexFromBuffer(await sha256(canonicalRequest))}`;
     if (shortDatetime !== this.signingKeyDate || !this.signingKey) {
@@ -426,37 +448,29 @@ class S3mini {
   private _extractBucketName(): string {
     const url = this.endpoint;
 
-    // First check if bucket is in the pathname (path-style URLs)
-    const pathSegments = url.pathname.split('/').filter(Boolean);
-    if (pathSegments.length > 0) {
-      if (typeof pathSegments[0] === 'string') {
-        return pathSegments[0];
-      }
+    // Path-style: bucket is the first non-empty path segment
+    const firstSegment = url.pathname.split('/').find(Boolean);
+    if (firstSegment) {
+      return firstSegment;
     }
 
-    // Otherwise extract from subdomain (virtual-hosted-style URLs)
-    const hostParts = url.hostname.split('.');
+    // Virtual-hosted style: bucket is the first subdomain label
+    const hostname = url.hostname;
 
-    // Common patterns:
-    // bucket-name.s3.amazonaws.com
-    // bucket-name.s3.region.amazonaws.com
-    // bucket-name.region.digitaloceanspaces.com
-    // bucket-name.region.cdn.digitaloceanspaces.com
+    // IP addresses (v4: digits+dots, v6: contains colons) can't carry a bucket subdomain
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname) || hostname.includes(':')) {
+      return '';
+    }
 
-    if (hostParts.length >= 3) {
-      // Check if it's a known S3-compatible service
-      const domain = hostParts.slice(-2).join('.');
-      const knownDomains = ['amazonaws.com', 'digitaloceanspaces.com', 'cloudflare.com'];
+    const labels = hostname.split('.');
 
-      if (knownDomains.some(d => domain.includes(d))) {
-        if (typeof hostParts[0] === 'string') {
-          return hostParts[0];
-        }
-      }
+    // Need ≥3 labels for virtual-hosted (bucket.service.tld)
+    // Single-label (localhost) or two-label (example.com) have no room for a bucket subdomain
+    if (labels.length < 3) {
+      return '';
     }
 
-    // Fallback: use the first subdomain
-    return hostParts[0] || '';
+    return labels[0]!;
   }
 
   /**
@@ -494,6 +508,13 @@ class S3mini {
     this._checkPrefix(prefix);
     this._checkOpts(opts);
 
+    if (this._bun && delimiter === '/') {
+      const extraKeys = Object.keys(opts).filter(k => k !== 'delimiter');
+      if (extraKeys.length === 0) {
+        return this._bunListAll(prefix, maxKeys, opts.delimiter as string | undefined);
+      }
+    }
+
     const keyPath = delimiter === '/' ? delimiter : uriEscape(delimiter);
     const unlimited = !(maxKeys && maxKeys > 0);
     let remaining = unlimited ? Infinity : maxKeys;
@@ -698,6 +719,90 @@ class S3mini {
       response.nextMarker) as string | undefined;
   }
 
+  private async _bunListAll(
+    prefix: string,
+    maxKeys: number | undefined,
+    delimiter: string | undefined,
+  ): Promise<IT.ListObject[] | null> {
+    const unlimited = !(maxKeys && maxKeys > 0);
+    let remaining = unlimited ? Infinity : maxKeys;
+    let startAfter: string | undefined;
+    const all: IT.ListObject[] = [];
+
+    try {
+      do {
+        const batchSize = Math.min(remaining === Infinity ? 1000 : remaining, 1000);
+        const res = await this._bunFetchPage(prefix, delimiter, batchSize, startAfter);
+        const mapped = this._bunMapListResult(res);
+        all.push(...mapped);
+
+        if (!unlimited) {
+          remaining -= mapped.length;
+        }
+
+        startAfter = this._bunNextCursor(res);
+      } while (startAfter && remaining > 0);
+    } catch (e) {
+      if ((e as { code?: string })?.code === 'NoSuchBucket') {
+        return null;
+      }
+      throw e;
+    }
+
+    return all;
+  }
+
+  private _bunFetchPage(
+    prefix: string,
+    delimiter: string | undefined,
+    maxKeys: number,
+    startAfter?: string,
+  ): Promise<IT.NativeS3ListResult> {
+    return this._bun!.list({
+      prefix: prefix || undefined,
+      delimiter: delimiter || '/',
+      maxKeys,
+      ...(startAfter ? { startAfter } : {}),
+    });
+  }
+
+  private _bunNextCursor(res: IT.NativeS3ListResult): string | undefined {
+    if (!res.isTruncated) {
+      return undefined;
+    }
+    return res.contents?.length ? res.contents.at(-1)!.key : undefined;
+  }
+
+  private _bunMapListResult(res: IT.NativeS3ListResult): IT.ListObject[] {
+    const objects: IT.ListObject[] = [];
+
+    if (res.contents) {
+      for (const item of res.contents) {
+        objects.push({
+          Key: item.key,
+          Size: item.size,
+          LastModified: item.lastModified instanceof Date ? item.lastModified : new Date(item.lastModified),
+          ETag: item.etag ?? '',
+          StorageClass: item.storageClass ?? '',
+        });
+      }
+    }
+
+    if (res.commonPrefixes) {
+      for (const item of res.commonPrefixes) {
+        objects.push({
+          Key: item.prefix,
+          Size: 0,
+          LastModified: new Date(0),
+          ETag: '',
+          StorageClass: '',
+        } as IT.ListObject);
+      }
+    }
+
+    return objects;
+  }
+
   /**
    * Lists multipart uploads in the bucket.
    * This method sends a request to list multipart uploads in the specified bucket.
@@ -756,7 +861,9 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<string | null> {
-    // if ssecHeaders is set, add it to headers
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      return this._bunRead(key, f => f.text());
+    }
     const res = await this._signedRequest('GET', key, {
       query: opts, // use opts.query if it exists, otherwise use an empty object
       tolerated: [200, 404, 412, 304],
@@ -808,6 +915,9 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<ArrayBuffer | null> {
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      return this._bunRead(key, f => f.arrayBuffer());
+    }
     const res = await this._signedRequest('GET', key, {
       query: opts,
       tolerated: [200, 404, 412, 304],
@@ -833,6 +943,9 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<T | null> {
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      return this._bunRead(key, f => f.json()) as Promise<T | null>;
+    }
     const res = await this._signedRequest('GET', key, {
       query: opts,
       tolerated: [200, 404, 412, 304],
@@ -858,6 +971,18 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<{ etag: string | null; data: ArrayBuffer | null }> {
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      try {
+        const f = this._bun.file(key);
+        const [stat, data] = await Promise.all([f.stat(), f.arrayBuffer()]);
+        return { etag: sanitizeETag(stat.etag), data };
+      } catch (e) {
+        if ((e as { code?: string })?.code === 'NoSuchKey') {
+          return { etag: null, data: null };
+        }
+        throw e;
+      }
+    }
     try {
       const res = await this._signedRequest('GET', key, {
         query: opts,
@@ -900,6 +1025,29 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<Response> {
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      const f = this._bun.file(key);
+      if (wholeFile) {
+        const buf = await f.arrayBuffer();
+        const stat = await f.stat();
+        return new Response(buf, {
+          status: 200,
+          headers: { 'content-length': String(stat.size), etag: stat.etag, 'content-type': stat.type },
+        });
+      }
+      const sliced = rangeTo === undefined ? f.slice(rangeFrom) : f.slice(rangeFrom, rangeTo);
+      const buf = await sliced.arrayBuffer();
+      const stat = await f.stat();
+      const endByte = rangeTo === undefined ? stat.size - 1 : rangeTo - 1;
+      return new Response(buf, {
+        status: 206,
+        headers: {
+          'content-range': `bytes ${rangeFrom}-${endByte}/${stat.size}`,
+          'content-length': String(buf.byteLength),
+        },
+      });
+    }
+
     let rangeHdr: Record<string, string | number> = {};
 
     if (!wholeFile) {
@@ -922,6 +1070,9 @@ class S3mini {
    */
   public async getContentLength(key: string, ssecHeaders?: IT.SSECHeaders): Promise<number> {
     try {
+      if (this._bun && !ssecHeaders) {
+        return (await this._bun.file(key).stat()).size;
+      }
       const res = await this._signedRequest('HEAD', key, {
         headers: ssecHeaders ? { ...ssecHeaders } : undefined,
       });
@@ -943,6 +1094,9 @@ class S3mini {
    * @returns A promise that resolves to true if the object exists, false if not found, or null if ETag mismatch.
    */
   public async objectExists(key: string, opts: Record<string, unknown> = {}): Promise<IT.ExistResponseCode> {
+    if (this._bun && !Object.keys(opts).length) {
+      return this._bun.file(key).exists();
+    }
     const res = await this._signedRequest('HEAD', key, {
       query: opts,
       tolerated: [200, 404, 412, 304],
@@ -975,6 +1129,15 @@ class S3mini {
     opts: Record<string, unknown> = {},
     ssecHeaders?: IT.SSECHeaders,
   ): Promise<string | null> {
+    if (this._bun && !ssecHeaders && !Object.keys(opts).length) {
+      return this._bunRead(key, async f => {
+        const { etag } = await f.stat();
+        if (!etag) {
+          throw new Error(`${C.ERROR_PREFIX}ETag not found in response headers`);
+        }
+        return sanitizeETag(etag);
+      });
+    }
     const res = await this._signedRequest('HEAD', key, {
       query: opts,
       tolerated: [200, 304, 404, 412],
@@ -1022,6 +1185,12 @@ class S3mini {
     additionalHeaders?: IT.AWSHeaders,
     contentLength?: number,
   ): Promise<Response> {
+    if (this._bun && !ssecHeaders && !additionalHeaders) {
+      const f = this._bun.file(key);
+      await f.write(data as string | ArrayBuffer | Uint8Array | Blob | ReadableStream, { type: fileType });
+      const { etag } = await f.stat();
+      return new Response(null, { status: 200, headers: etag ? { etag } : {} });
+    }
     const size = contentLength ?? getByteSize(data);
     return this._signedRequest('PUT', key, {
       body: data as BodyInit,
@@ -1062,6 +1231,15 @@ class S3mini {
     additionalHeaders?: IT.AWSHeaders,
     contentLength?: number,
   ): Promise<Response | { ok: boolean; status: number; headers: Map<string, string> }> {
+    // Bun handles multipart automatically for large files
+    if (this._bun && !ssecHeaders && !additionalHeaders) {
+      this._checkKey(key);
+      const f = this._bun.file(key);
+      await f.write(data as string | ArrayBuffer | Uint8Array | Blob | ReadableStream, { type: fileType });
+      const { etag } = await f.stat();
+      return this._createSuccessResponse(etag || '');
+    }
+
     const size = contentLength ?? getByteSize(data);
 
     // Single PUT for small files
@@ -1697,77 +1875,84 @@ class S3mini {
    * @returns A promise that resolves to true if the object was deleted successfully, false otherwise.
    */
   public async deleteObject(key: string): Promise<boolean> {
+    if (this._bun) {
+      await this._bun.file(key).delete();
+      return true;
+    }
     const res = await this._signedRequest('DELETE', key, { tolerated: [200, 204] });
     return res.status === 200 || res.status === 204;
   }
 
   private async _deleteObjectsProcess(keys: string[]): Promise<boolean[]> {
+    const out = await this._sendDeleteRequest(keys);
+
+    const resultMap = new Map<string, boolean>(keys.map(k => [k, false]));
+    this._markDeletedKeys(out, resultMap);
+    this._logDeleteErrors(out, resultMap);
+
+    return keys.map(key => resultMap.get(key) || false);
+  }
+
+  private async _sendDeleteRequest(keys: string[]): Promise<Record<string, unknown>> {
     const objectsXml = keys.map(key => `<Object><Key>${escapeXml(key)}</Key></Object>`).join('');
     const xmlBody = '<Delete>' + objectsXml + '</Delete>';
-    const query = { delete: '' };
     const sha256base64 = base64FromBuffer(await sha256(xmlBody));
-    const headers = {
-      [C.HEADER_CONTENT_TYPE]: C.XML_CONTENT_TYPE,
-      [C.HEADER_CONTENT_LENGTH]: getByteSize(xmlBody),
-      [C.HEADER_AMZ_CHECKSUM_SHA256]: sha256base64,
-    };
 
     const res = await this._signedRequest('POST', '', {
-      query,
+      query: { delete: '' },
       body: xmlBody,
-      headers,
+      headers: {
+        [C.HEADER_CONTENT_TYPE]: C.XML_CONTENT_TYPE,
+        [C.HEADER_CONTENT_LENGTH]: getByteSize(xmlBody),
+        [C.HEADER_AMZ_CHECKSUM_SHA256]: sha256base64,
+      },
       withQuery: true,
     });
+
     const parsed = parseXml(await res.text()) as Record<string, unknown>;
     if (!parsed || typeof parsed !== 'object') {
       throw new Error(`${C.ERROR_PREFIX}Failed to delete objects: ${JSON.stringify(parsed)}`);
     }
-    const out = (parsed.DeleteResult || parsed.deleteResult || parsed) as Record<string, unknown>;
-    const resultMap = new Map<string, boolean>();
-    for (const key of keys) {
-      resultMap.set(key, false);
-    }
+    return (parsed.DeleteResult || parsed.deleteResult || parsed) as Record<string, unknown>;
+  }
+
+  private _markDeletedKeys(out: Record<string, unknown>, resultMap: Map<string, boolean>): void {
     const deleted = out.deleted || out.Deleted;
-    if (deleted) {
-      const deletedArray = Array.isArray(deleted) ? deleted : [deleted];
-      for (const item of deletedArray) {
-        if (item && typeof item === 'object') {
-          const obj = item as Record<string, unknown>;
-          // Check both key and Key
-          const key = obj.key || obj.Key;
-          if (key && typeof key === 'string') {
-            resultMap.set(key, true);
-          }
+    if (!deleted) {
+      return;
+    }
+
+    const items = Array.isArray(deleted) ? deleted : [deleted];
+    for (const item of items) {
+      if (item && typeof item === 'object') {
+        const key = (item as Record<string, unknown>).key || (item as Record<string, unknown>).Key;
+        if (key && typeof key === 'string') {
+          resultMap.set(key, true);
         }
       }
     }
+  }
 
-    // Handle errors (check both cases)
+  private _logDeleteErrors(out: Record<string, unknown>, resultMap: Map<string, boolean>): void {
     const errors = out.error || out.Error;
-    if (errors) {
-      const errorsArray = Array.isArray(errors) ? errors : [errors];
-      for (const item of errorsArray) {
-        if (item && typeof item === 'object') {
-          const obj = item as Record<string, unknown>;
-          // Check both cases for all properties
-          const key = obj.key || obj.Key;
-          const code = obj.code || obj.Code;
-          const message = obj.message || obj.Message;
-
-          if (key && typeof key === 'string') {
-            resultMap.set(key, false);
-            // Optionally log the error for debugging
-            this._log('warn', `Failed to delete object: ${key}`, {
-              code: code || 'Unknown',
-              message: message || 'Unknown error',
-            });
-          }
+    if (!errors) {
+      return;
+    }
+
+    const items = Array.isArray(errors) ? errors : [errors];
+    for (const item of items) {
+      if (item && typeof item === 'object') {
+        const obj = item as Record<string, unknown>;
+        const key = obj.key || obj.Key;
+        if (key && typeof key === 'string') {
+          resultMap.set(key, false);
+          this._log('warn', `Failed to delete object: ${key}`, {
+            code: obj.code || obj.Code || 'Unknown',
+            message: obj.message || obj.Message || 'Unknown error',
+          });
         }
       }
     }
-
-    // Return boolean array in the same order as input keys
-    return keys.map(key => resultMap.get(key) || false);
   }
 
   /**
@@ -1862,8 +2047,9 @@ class S3mini {
       return '';
     }
     return Object.keys(queryParams)
-      .map(key => `${encodeURIComponent(key)}=${encodeURIComponent(queryParams[key] as string)}`)
-      .sort((a, b) => a.localeCompare(b))
+      .map((key): [string, string] => [encodeURIComponent(key), encodeURIComponent(String(queryParams[key]))])
+      .sort(([a], [b]) => byCodePoint(a, b))
+      .map(([k, v]) => `${k}=${v}`)
       .join('&');
   }
   /**
@@ -1902,6 +2088,9 @@ class S3mini {
     if (!Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 604800) {
       throw new TypeError(`${C.ERROR_PREFIX}expiresIn must be between 1 and 604800 seconds`);
     }
+    if (this._bun && !Object.keys(queryParams).length && !Object.keys(headers).length) {
+      return this._bun.presign(key, { method, expiresIn: Math.floor(expiresIn) });
+    }
     return this._presign(method, uriResourceEscape(key), Math.floor(expiresIn), queryParams, headers);
   }
 
@@ -1933,7 +2122,7 @@ class S3mini {
         headerEntries.push([lowerKey, String(value).trim()]);
       }
     }
-    headerEntries.sort(([a], [b]) => a.localeCompare(b));
+    headerEntries.sort(([a], [b]) => byCodePoint(a, b));
 
     const canonicalHeaders = headerEntries.map(([k, v]) => `${k}:${v}`).join('\n');
     const signedHeaders = headerEntries.map(([k]) => k).join(';');

package/src/types.ts

@@ -163,3 +163,57 @@ type MaybeBuffer = typeof globalThis extends { Buffer?: infer B }
   : BinaryData;
 
 export type DataInput = string | MaybeBuffer | ReadableStream | File | Blob;
+
+// Bun-native S3 interfaces (zero-cost in non-Bun runtimes)
+export interface NativeS3Stat {
+  size: number;
+  etag: string;
+  lastModified: Date;
+  type: string;
+}
+
+export interface NativeS3File {
+  text(): Promise<string>;
+  json(): Promise<unknown>;
+  arrayBuffer(): Promise<ArrayBuffer>;
+  bytes(): Promise<Uint8Array>;
+  stream(): ReadableStream;
+  slice(start?: number, end?: number): NativeS3File;
+  write(data: string | ArrayBuffer | Uint8Array | Blob | ReadableStream, opts?: { type?: string }): Promise<number>;
+  writer(opts?: { type?: string }): { write(data: unknown): void; flush(): Promise<void>; end(): Promise<void> };
+  delete(): Promise<void>;
+  unlink(): Promise<void>;
+  exists(): Promise<boolean>;
+  stat(): Promise<NativeS3Stat>;
+  presign(opts?: { method?: string; expiresIn?: number; acl?: string; type?: string }): string;
+}
+
+export interface NativeS3ListObject {
+  key: string;
+  lastModified: Date;
+  size: number;
+  etag: string;
+  storageClass?: string;
+}
+
+export interface NativeS3ListResult {
+  contents?: NativeS3ListObject[];
+  commonPrefixes?: { prefix: string }[];
+  isTruncated: boolean;
+  nextContinuationToken?: string;
+}
+
+export interface NativeS3Client {
+  file(key: string): NativeS3File;
+  write(
+    key: string,
+    data: string | ArrayBuffer | Uint8Array | Blob | ReadableStream,
+    opts?: Record<string, unknown>,
+  ): Promise<number>;
+  delete(key: string): Promise<void>;
+  exists(key: string): Promise<boolean>;
+  size(key: string): Promise<number>;
+  stat(key: string): Promise<NativeS3Stat>;
+  presign(key: string, opts?: { method?: string; expiresIn?: number; acl?: string; type?: string }): string;
+  list(opts?: Record<string, unknown> | null, credentials?: Record<string, unknown>): Promise<NativeS3ListResult>;
+}

package/src/utils.ts

@@ -3,6 +3,34 @@
 import type { DataInput, XmlValue, XmlMap, ListBucketResponse, ErrorWithCode, PartData } from './types.js';
 import { ERROR_PREFIX } from './consts.js';
 
+export const isBun = typeof navigator !== 'undefined' && navigator.userAgent === 'Bun';
+
+/** Strips the bucket name from a full endpoint URL, returning the base origin for Bun.S3Client. */
+export const extractBaseEndpoint = (endpoint: URL, bucket: string): string => {
+  // Path-style (/bucket/…): just use the origin
+  if (endpoint.pathname.split('/').some(Boolean)) {
+    return endpoint.origin;
+  }
+  // Virtual-hosted (bucket.host…): strip the bucket subdomain
+  const prefix = bucket + '.';
+  if (endpoint.hostname.startsWith(prefix)) {
+    const base = endpoint.hostname.slice(prefix.length);
+    return `${endpoint.protocol}//${base}${endpoint.port ? ':' + endpoint.port : ''}`;
+  }
+  return endpoint.origin;
+};
+
+/**
+ * Compare two strings by code point, as required for AWS SigV4 canonical
+ * ordering of query parameters and headers. `localeCompare` MUST NOT be used
+ * here: it is locale-aware and case-insensitive by default, so it mis-orders
+ * mixed-case names (e.g. `partNumber` before `X-Amz-*`) and breaks signatures.
+ * @param a First string
+ * @param b Second string
+ * @returns -1, 0, or 1
+ */
+export const byCodePoint = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+
 const ENCODR = new TextEncoder();
 const chunkSize = 0x8000; // 32KB chunks
 const HEX_CHARS = new Uint8Array([48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102]);