selfstore 1.0.0

package/dist/chunk-CUWB5EWF.js

@@ -0,0 +1,732 @@
+import { seal, isEnvelope, unseal, newDeviceKey } from './chunk-QBCU7OOP.js';
+import { AuthExpiredError, SelfstoreError, isAuthExpired } from './chunk-VBFMMR7Q.js';
+
+// src/persistence/targets/drive.ts
+var FILE_ID_KEY = "driveFileId";
+var DRIVE_UPLOAD = "https://www.googleapis.com/upload/drive/v3/files";
+var DRIVE_FILES = "https://www.googleapis.com/drive/v3/files";
+var DATA_DEADLINE_MS = 3e4;
+var META_DEADLINE_MS = 15e3;
+async function driveFetch(auth, run) {
+  const r = await run(await auth.token());
+  if (r.status !== 401) return r;
+  return run(await auth.token({ forceRefresh: true }));
+}
+async function findExistingFile(token, fileNames) {
+  for (const name of fileNames) {
+    const safe = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+    const q = encodeURIComponent(`name='${safe}' and trashed=false and 'me' in owners`);
+    const r = await fetch(`${DRIVE_FILES}?q=${q}&fields=files(id)&pageSize=1`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(META_DEADLINE_MS)
+    });
+    if (!r.ok) continue;
+    const data = await r.json();
+    const id = data.files?.[0]?.id;
+    if (id) return id;
+  }
+  return null;
+}
+function isPermanentDriveWrite(status, body) {
+  if (status === 404) return true;
+  if (status === 403) return !/ratelimit|dailylimit/i.test(body);
+  return false;
+}
+async function createFile(token, fileName) {
+  const boundary = "SLFS_BOUNDARY";
+  const meta = JSON.stringify({ name: fileName, mimeType: "application/octet-stream" });
+  const body = [
+    `--${boundary}\r
+Content-Type: application/json; charset=UTF-8\r
+\r
+`,
+    meta,
+    `\r
+--${boundary}\r
+Content-Type: application/octet-stream\r
+\r
+\r
+--${boundary}--`
+  ].join("");
+  const r = await fetch(`${DRIVE_UPLOAD}?uploadType=multipart`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": `multipart/related; boundary=${boundary}`
+    },
+    body,
+    signal: AbortSignal.timeout(META_DEADLINE_MS)
+  });
+  if (!r.ok) throw new SelfstoreError("TARGET_WRITE_FAILED", `Drive create failed: ${r.status}`);
+  const data = await r.json();
+  return data.id;
+}
+function makeTarget(opts, fixedId) {
+  const { auth, kv } = opts;
+  let captured = fixedId;
+  const fileIdOf = async () => captured ??= await kv.get(FILE_ID_KEY);
+  return {
+    kind: "drive",
+    label: "Google Drive",
+    async save(blob) {
+      const fileId = await fileIdOf();
+      if (!fileId) throw new SelfstoreError("NOT_CONNECTED", "Drive not connected.");
+      const r = await driveFetch(
+        auth,
+        (token) => fetch(`${DRIVE_UPLOAD}/${fileId}?uploadType=media&fields=version`, {
+          method: "PATCH",
+          headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/octet-stream" },
+          body: blob,
+          signal: AbortSignal.timeout(DATA_DEADLINE_MS)
+        })
+      );
+      if (!r.ok) {
+        if (r.status === 401) throw new AuthExpiredError("Drive rejected the token (401).");
+        const body = await r.text().catch(() => "");
+        if (isPermanentDriveWrite(r.status, body)) {
+          throw new SelfstoreError(
+            "TARGET_GONE",
+            `Drive backup unwritable (${r.status}): the file is gone or access was withdrawn.`
+          );
+        }
+        throw new SelfstoreError("TARGET_WRITE_FAILED", `Drive upload failed: ${r.status}`);
+      }
+      try {
+        const data = await r.json();
+        return data.version != null ? String(data.version) : null;
+      } catch {
+        return null;
+      }
+    },
+    async load() {
+      const fileId = await fileIdOf();
+      if (!fileId) return null;
+      const r = await driveFetch(
+        auth,
+        (token) => fetch(`${DRIVE_FILES}/${fileId}?alt=media`, {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(DATA_DEADLINE_MS)
+        })
+      );
+      if (r.status === 404) return null;
+      if (r.status === 401) throw new AuthExpiredError("Drive rejected the token (401).");
+      if (!r.ok) {
+        throw new SelfstoreError("TARGET_UNAVAILABLE", `Drive download failed: ${r.status}`);
+      }
+      return r.blob();
+    },
+    async stat() {
+      try {
+        const fileId = await fileIdOf();
+        if (!fileId) return null;
+        const r = await driveFetch(
+          auth,
+          (token) => fetch(`${DRIVE_FILES}/${fileId}?fields=version`, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(META_DEADLINE_MS)
+          })
+        );
+        if (!r.ok) return null;
+        const data = await r.json();
+        return data.version != null ? String(data.version) : null;
+      } catch {
+        return null;
+      }
+    },
+    async isReady() {
+      try {
+        await auth.token();
+        return true;
+      } catch (e) {
+        if (isAuthExpired(e)) throw e;
+        return false;
+      }
+    },
+    async reconnect() {
+      return auth.reconnect();
+    },
+    async disconnect() {
+      await auth.forget();
+      const current = await kv.get(FILE_ID_KEY);
+      const own = await fileIdOf();
+      if (!current || !own || current === own) await kv.del(FILE_ID_KEY);
+    }
+  };
+}
+async function connect(opts) {
+  if (!await opts.auth.reconnect()) return null;
+  const token = await opts.auth.token();
+  let fileId = await opts.kv.get(FILE_ID_KEY);
+  if (!fileId) {
+    fileId = await findExistingFile(token, [opts.fileName]) ?? await createFile(token, opts.fileName);
+    await opts.kv.set(FILE_ID_KEY, fileId);
+  }
+  return makeTarget(opts);
+}
+async function fromSession(opts) {
+  return await opts.kv.get(FILE_ID_KEY) ? makeTarget(opts) : null;
+}
+function preview(opts, fileId) {
+  return makeTarget(opts, fileId);
+}
+async function adopt(opts, fileId) {
+  await opts.kv.set(FILE_ID_KEY, fileId);
+  return makeTarget(opts);
+}
+async function findOrCreateOwnFile(opts) {
+  let token;
+  try {
+    token = await opts.auth.token();
+  } catch {
+    if (!await opts.auth.reconnect()) return null;
+    token = await opts.auth.token();
+  }
+  const existing = await findExistingFile(token, [opts.fileName]);
+  if (existing) return { fileId: existing, created: false };
+  return { fileId: await createFile(token, opts.fileName), created: true };
+}
+async function listBackups(opts) {
+  const clauses = ["trashed=false", "'me' in owners"];
+  if (opts.nameContains) {
+    const safe = opts.nameContains.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+    clauses.push(`name contains '${safe}'`);
+  }
+  const q = encodeURIComponent(clauses.join(" and "));
+  const fields = encodeURIComponent("files(id,name,modifiedTime,size)");
+  const r = await driveFetch(
+    opts.auth,
+    (token) => fetch(`${DRIVE_FILES}?q=${q}&fields=${fields}&pageSize=100&orderBy=modifiedTime%20desc`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(META_DEADLINE_MS)
+    })
+  );
+  if (r.status === 401) throw new AuthExpiredError("Drive rejected the token (401).");
+  if (!r.ok) throw new SelfstoreError("TARGET_UNAVAILABLE", `Drive list failed: ${r.status}`);
+  const data = await r.json();
+  return (data.files ?? []).map((f) => ({
+    id: f.id,
+    name: f.name,
+    modifiedTime: f.modifiedTime ?? null,
+    size: f.size != null ? Number(f.size) : null
+  }));
+}
+async function createBackup(opts) {
+  const token = await opts.auth.token();
+  const existing = await findExistingFile(token, [opts.fileName]);
+  if (existing) {
+    throw new SelfstoreError(
+      "TARGET_WRITE_FAILED",
+      `A file named "${opts.fileName}" already exists on Drive.`
+    );
+  }
+  return { fileId: await createFile(token, opts.fileName) };
+}
+async function deleteBackup(opts) {
+  const r = await driveFetch(
+    opts.auth,
+    (token) => fetch(`${DRIVE_FILES}/${opts.fileId}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(META_DEADLINE_MS)
+    })
+  );
+  if (r.status === 401) throw new AuthExpiredError("Drive rejected the token (401).");
+  if (r.status === 404) return;
+  if (!r.ok) throw new SelfstoreError("TARGET_WRITE_FAILED", `Drive delete failed: ${r.status}`);
+}
+async function renameBackup(opts) {
+  const token = await opts.auth.token();
+  const existing = await findExistingFile(token, [opts.fileName]);
+  if (existing && existing !== opts.fileId) {
+    throw new SelfstoreError(
+      "TARGET_WRITE_FAILED",
+      `A file named "${opts.fileName}" already exists on Drive.`
+    );
+  }
+  if (existing === opts.fileId) return;
+  const r = await driveFetch(
+    opts.auth,
+    (token2) => fetch(`${DRIVE_FILES}/${opts.fileId}?fields=id`, {
+      method: "PATCH",
+      headers: { Authorization: `Bearer ${token2}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ name: opts.fileName }),
+      signal: AbortSignal.timeout(META_DEADLINE_MS)
+    })
+  );
+  if (r.status === 401) throw new AuthExpiredError("Drive rejected the token (401).");
+  if (!r.ok) throw new SelfstoreError("TARGET_WRITE_FAILED", `Drive rename failed: ${r.status}`);
+}
+
+// src/persistence/targets/file.ts
+var HANDLE_KEY = "fileHandle";
+function isSupported() {
+  return typeof window !== "undefined" && "showSaveFilePicker" in window;
+}
+function isPermissionLoss(e) {
+  return e instanceof DOMException && (e.name === "NotAllowedError" || e.name === "SecurityError");
+}
+function fromHandle(handle, kv) {
+  return {
+    kind: "file",
+    label: handle.name,
+    async save(blob) {
+      try {
+        const writable = await handle.createWritable();
+        await writable.write(blob);
+        await writable.close();
+      } catch (e) {
+        if (isPermissionLoss(e)) {
+          throw new AuthExpiredError("File permission was revoked.");
+        }
+        throw new SelfstoreError("TARGET_WRITE_FAILED", `File write failed: ${String(e)}`);
+      }
+      try {
+        return String((await handle.getFile()).lastModified);
+      } catch {
+        return null;
+      }
+    },
+    async load() {
+      return handle.getFile();
+    },
+    async stat() {
+      try {
+        return String((await handle.getFile()).lastModified);
+      } catch {
+        return null;
+      }
+    },
+    async isReady() {
+      return await handle.queryPermission({ mode: "readwrite" }) === "granted";
+    },
+    async reconnect() {
+      return await handle.requestPermission({ mode: "readwrite" }) === "granted";
+    },
+    async disconnect() {
+      await kv.del(HANDLE_KEY);
+    }
+  };
+}
+async function connect2(opts) {
+  const picker = window.showSaveFilePicker;
+  if (!picker) return null;
+  try {
+    const handle = await picker({
+      suggestedName: opts.fileName,
+      types: [{ description: "Backup", accept: { "application/zip": [".zip"] } }]
+    });
+    await opts.kv.set(HANDLE_KEY, handle);
+    return fromHandle(handle, opts.kv);
+  } catch (e) {
+    if (e instanceof DOMException && e.name === "AbortError") return null;
+    throw e;
+  }
+}
+async function openExisting(opts) {
+  const picker = window.showOpenFilePicker;
+  if (!picker) return null;
+  try {
+    const [handle] = await picker({
+      multiple: false,
+      types: [{ description: "Backup", accept: { "application/zip": [".zip"] } }]
+    });
+    if (!handle) return null;
+    if (await handle.requestPermission({ mode: "readwrite" }) !== "granted") return null;
+    await opts.kv.set(HANDLE_KEY, handle);
+    return fromHandle(handle, opts.kv);
+  } catch (e) {
+    if (e instanceof DOMException && e.name === "AbortError") return null;
+    throw e;
+  }
+}
+async function fromSession2(opts) {
+  const handle = await opts.kv.get(HANDLE_KEY);
+  return handle ? fromHandle(handle, opts.kv) : null;
+}
+
+// src/persistence/targets/webdav.ts
+var CONFIG_KEY = "webdavConfig";
+var KEY_KEY = "webdavKey";
+var DATA_DEADLINE_MS2 = 3e4;
+var META_DEADLINE_MS2 = 15e3;
+async function configKey(kv) {
+  const existing = await kv.get(KEY_KEY);
+  if (existing) return existing;
+  const fresh = await newDeviceKey();
+  await kv.set(KEY_KEY, fresh);
+  return fresh;
+}
+async function saveConfig(kv, c) {
+  const bytes = new TextEncoder().encode(JSON.stringify(c));
+  await kv.set(CONFIG_KEY, await seal(await configKey(kv), bytes));
+}
+async function loadConfig(kv) {
+  const stored = await kv.get(CONFIG_KEY);
+  if (!isEnvelope(stored)) return null;
+  const bytes = await unseal(await configKey(kv), stored);
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+function labelOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "WebDAV";
+  }
+}
+function assertSecureUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new TypeError(`webdavTarget: invalid URL "${url}".`);
+  }
+  const loopback = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && loopback)) {
+    throw new TypeError(
+      `webdavTarget: refusing "${u.protocol}" - Basic-auth credentials need https (http is allowed only for localhost).`
+    );
+  }
+}
+function versionOf(res) {
+  return res.headers.get("ETag") ?? res.headers.get("Last-Modified") ?? null;
+}
+function fromConfig(c, kv) {
+  const headers = { Authorization: "Basic " + btoa(`${c.username}:${c.password}`) };
+  async function probe() {
+    try {
+      return await fetch(c.url, {
+        method: "HEAD",
+        headers,
+        signal: AbortSignal.timeout(META_DEADLINE_MS2)
+      });
+    } catch {
+      return null;
+    }
+  }
+  async function stat() {
+    const res = await probe();
+    return res && res.ok ? versionOf(res) : null;
+  }
+  async function ready() {
+    const res = await probe();
+    if (!res) return false;
+    if (res.status === 401 || res.status === 403) {
+      throw new AuthExpiredError(`WebDAV rejected the credentials (${res.status}).`);
+    }
+    return res.ok || res.status === 404;
+  }
+  async function reconnectProbe() {
+    const res = await probe();
+    return !!res && (res.ok || res.status === 404);
+  }
+  return {
+    kind: "webdav",
+    label: labelOf(c.url),
+    async save(blob) {
+      const res = await fetch(c.url, {
+        method: "PUT",
+        headers,
+        body: blob,
+        signal: AbortSignal.timeout(DATA_DEADLINE_MS2)
+      });
+      if (res.status === 401 || res.status === 403) {
+        throw new AuthExpiredError(`WebDAV rejected the credentials (${res.status}).`);
+      }
+      if (!res.ok) throw new SelfstoreError("TARGET_WRITE_FAILED", `WebDAV PUT failed: ${res.status}`);
+      return versionOf(res) ?? await stat();
+    },
+    async load() {
+      const res = await fetch(c.url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(DATA_DEADLINE_MS2)
+      });
+      if (res.status === 404) return null;
+      if (res.status === 401 || res.status === 403) {
+        throw new AuthExpiredError(`WebDAV rejected the credentials (${res.status}).`);
+      }
+      if (!res.ok) throw new SelfstoreError("TARGET_UNAVAILABLE", `WebDAV GET failed: ${res.status}`);
+      return res.blob();
+    },
+    stat,
+    isReady: ready,
+    reconnect: reconnectProbe,
+    // stored credentials: re-check reachability, no gesture
+    async disconnect() {
+      await kv.del(CONFIG_KEY);
+      await kv.del(KEY_KEY);
+    }
+  };
+}
+function peer(opts) {
+  if (opts.username !== void 0) assertSecureUrl(opts.url);
+  const headers = opts.username !== void 0 ? { Authorization: "Basic " + btoa(`${opts.username}:${opts.password ?? ""}`) } : void 0;
+  return {
+    label: opts.label ?? labelOf(opts.url),
+    async load() {
+      const res = await fetch(opts.url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(DATA_DEADLINE_MS2)
+      });
+      if (res.status === 404) return null;
+      if (res.status === 401 || res.status === 403) {
+        throw new AuthExpiredError(`WebDAV peer rejected the credentials (${res.status}).`);
+      }
+      if (!res.ok) {
+        throw new SelfstoreError("TARGET_UNAVAILABLE", `WebDAV peer GET failed: ${res.status}`);
+      }
+      return res.blob();
+    },
+    async stat() {
+      try {
+        const res = await fetch(opts.url, {
+          method: "HEAD",
+          headers,
+          signal: AbortSignal.timeout(META_DEADLINE_MS2)
+        });
+        return res.ok ? versionOf(res) : null;
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+async function connect3(opts) {
+  assertSecureUrl(opts.config.url);
+  const target = fromConfig(opts.config, opts.kv);
+  let ok = false;
+  try {
+    ok = await target.isReady();
+  } catch {
+    ok = false;
+  }
+  if (!ok) return null;
+  await saveConfig(opts.kv, opts.config);
+  return target;
+}
+async function fromSession3(opts) {
+  const config = await loadConfig(opts.kv);
+  return config ? fromConfig(config, opts.kv) : null;
+}
+
+// src/persistence/targets/sigv4.ts
+var encoder = new TextEncoder();
+function hex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+async function sha256Hex(bytes) {
+  return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+var EMPTY_PAYLOAD_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+async function hmac(key, data) {
+  const k = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", k, data));
+}
+function encodeSegment(s) {
+  return encodeURIComponent(s).replace(
+    /[!*'()]/g,
+    (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase()
+  );
+}
+function encodeS3Path(path) {
+  return path.split("/").map((seg) => encodeSegment(seg)).join("/");
+}
+function basicAmzDate() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+async function signS3(input) {
+  const service = input.service ?? "s3";
+  const amzDate = input.amzDate ?? basicAmzDate();
+  const dateStamp = amzDate.slice(0, 8);
+  const { host } = new URL(input.origin);
+  const canonicalUri = encodeS3Path(input.path);
+  const headers = {
+    host,
+    "x-amz-content-sha256": input.payloadHashHex,
+    "x-amz-date": amzDate
+  };
+  for (const [name, value] of Object.entries({})) {
+    headers[name.toLowerCase()] = value;
+  }
+  const signedNames = Object.keys(headers).sort();
+  const canonicalHeaders = signedNames.map((n) => `${n}:${headers[n].trim()}
+`).join("");
+  const signedHeaders = signedNames.join(";");
+  const canonicalRequest = [
+    input.method,
+    canonicalUri,
+    "",
+    // no query string on any of our single-object requests
+    canonicalHeaders,
+    signedHeaders,
+    input.payloadHashHex
+  ].join("\n");
+  const scope = `${dateStamp}/${input.region}/${service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    await sha256Hex(encoder.encode(canonicalRequest))
+  ].join("\n");
+  const kDate = await hmac(encoder.encode("AWS4" + input.secretAccessKey), encoder.encode(dateStamp));
+  const kRegion = await hmac(kDate, encoder.encode(input.region));
+  const kService = await hmac(kRegion, encoder.encode(service));
+  const kSigning = await hmac(kService, encoder.encode("aws4_request"));
+  const signature = hex(await hmac(kSigning, encoder.encode(stringToSign)));
+  const authorization = `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  const sendHeaders = { authorization };
+  for (const n of signedNames) if (n !== "host") sendHeaders[n] = headers[n];
+  return { url: input.origin.replace(/\/$/, "") + canonicalUri, headers: sendHeaders };
+}
+
+// src/persistence/targets/s3.ts
+var CONFIG_KEY2 = "s3Config";
+var KEY_KEY2 = "s3Key";
+var DATA_DEADLINE_MS3 = 3e4;
+var META_DEADLINE_MS3 = 15e3;
+async function configKey2(kv) {
+  const existing = await kv.get(KEY_KEY2);
+  if (existing) return existing;
+  const fresh = await newDeviceKey();
+  await kv.set(KEY_KEY2, fresh);
+  return fresh;
+}
+async function saveConfig2(kv, c) {
+  const bytes = new TextEncoder().encode(JSON.stringify(c));
+  await kv.set(CONFIG_KEY2, await seal(await configKey2(kv), bytes));
+}
+async function loadConfig2(kv) {
+  const stored = await kv.get(CONFIG_KEY2);
+  if (!isEnvelope(stored)) return null;
+  const bytes = await unseal(await configKey2(kv), stored);
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+function assertSecureEndpoint(endpoint) {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    throw new TypeError(`s3Target: invalid endpoint "${endpoint}".`);
+  }
+  const loopback = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && loopback)) {
+    throw new TypeError(
+      `s3Target: refusing "${u.protocol}" - S3 requests need https (http is allowed only for localhost).`
+    );
+  }
+  return u;
+}
+function labelOf2(c) {
+  try {
+    return `${c.bucket} (${new URL(c.endpoint).host})`;
+  } catch {
+    return c.bucket || "S3";
+  }
+}
+function versionOf2(res) {
+  return res.headers.get("ETag") ?? res.headers.get("Last-Modified") ?? null;
+}
+function fromConfig2(c, kv) {
+  const endpointUrl = assertSecureEndpoint(c.endpoint);
+  const pathStyle = c.forcePathStyle ?? true;
+  const origin = pathStyle ? `${endpointUrl.protocol}//${endpointUrl.host}` : `${endpointUrl.protocol}//${c.bucket}.${endpointUrl.host}`;
+  const objectPath = pathStyle ? `/${c.bucket}/${c.key}` : `/${c.key}`;
+  async function request(method, payloadHashHex, body, extraHeaders, deadlineMs = DATA_DEADLINE_MS3) {
+    const signed = await signS3({
+      method,
+      origin,
+      path: objectPath,
+      region: c.region,
+      accessKeyId: c.accessKeyId,
+      secretAccessKey: c.secretAccessKey,
+      payloadHashHex});
+    return fetch(signed.url, {
+      method,
+      headers: signed.headers,
+      body,
+      signal: AbortSignal.timeout(deadlineMs)
+    });
+  }
+  async function probe() {
+    try {
+      return await request("HEAD", EMPTY_PAYLOAD_SHA256, void 0, void 0, META_DEADLINE_MS3);
+    } catch {
+      return null;
+    }
+  }
+  async function stat() {
+    const res = await probe();
+    return res && res.ok ? versionOf2(res) : null;
+  }
+  async function ready() {
+    const res = await probe();
+    if (!res) return false;
+    if (res.status === 403) {
+      throw new AuthExpiredError("S3 rejected the credentials (403).");
+    }
+    return res.ok || res.status === 404;
+  }
+  async function reconnectProbe() {
+    const res = await probe();
+    return !!res && (res.ok || res.status === 404);
+  }
+  return {
+    kind: "s3",
+    label: labelOf2(c),
+    async save(blob) {
+      const bytes = new Uint8Array(await blob.arrayBuffer());
+      const res = await request("PUT", await sha256Hex(bytes), bytes);
+      if (res.status === 403) {
+        throw new AuthExpiredError("S3 rejected the credentials (403).");
+      }
+      if (!res.ok) throw new SelfstoreError("TARGET_WRITE_FAILED", `S3 PUT failed: ${res.status}`);
+      return versionOf2(res) ?? await stat();
+    },
+    async load() {
+      const res = await request("GET", EMPTY_PAYLOAD_SHA256);
+      if (res.status === 404) return null;
+      if (res.status === 403) {
+        throw new AuthExpiredError("S3 rejected the credentials (403).");
+      }
+      if (!res.ok) throw new SelfstoreError("TARGET_UNAVAILABLE", `S3 GET failed: ${res.status}`);
+      return res.blob();
+    },
+    stat,
+    isReady: ready,
+    reconnect: reconnectProbe,
+    async disconnect() {
+      await kv.del(CONFIG_KEY2);
+      await kv.del(KEY_KEY2);
+    }
+  };
+}
+async function connect4(opts) {
+  assertSecureEndpoint(opts.config.endpoint);
+  const target = fromConfig2(opts.config, opts.kv);
+  let ok = false;
+  try {
+    ok = await target.isReady();
+  } catch {
+    ok = false;
+  }
+  if (!ok) return null;
+  await saveConfig2(opts.kv, opts.config);
+  return target;
+}
+async function fromSession4(opts) {
+  const config = await loadConfig2(opts.kv);
+  return config ? fromConfig2(config, opts.kv) : null;
+}
+
+export { FILE_ID_KEY, adopt, connect, connect2, connect3, connect4, createBackup, deleteBackup, findOrCreateOwnFile, fromSession, fromSession2, fromSession3, fromSession4, isSupported, listBackups, openExisting, peer, preview, renameBackup };
+//# sourceMappingURL=chunk-CUWB5EWF.js.map
+//# sourceMappingURL=chunk-CUWB5EWF.js.map