tina4-nodejs 3.13.149 → 3.13.151

package/packages/orm/src/crudRender.ts

@@ -73,13 +73,13 @@ function renderModalForm(mode: string, columns: string[], pk: string, edit: bool
       value: "",
       placeholder: h(`Enter ${label.toLowerCase()}`),
       type: "text",
-      required_attr: "",
+      required: false,
       input: true,
     };
   });
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: ` id="form-${mode}"`,
+    form_id: `form-${mode}`,
     action: "",
     form_method: "POST",
     method_override: null,
@@ -150,7 +150,7 @@ function fieldInputShape(field: FormFieldDef, base: Record<string, unknown>): Re
     case "text":
       return { ...base, textarea: true };
     case "boolean":
-      return { ...base, checkbox: true, checked_attr: value ? " checked" : "" };
+      return { ...base, checkbox: true, checked: !!value };
     case "select":
       return { ...base, select: true, options_html: buildOptions(field.options, value) };
     case "date":
@@ -174,7 +174,7 @@ function buildCustomField(field: FormFieldDef): Record<string, unknown> {
     label: h(String(label)),
     value: h(field.value ?? ""),
     placeholder: "",
-    required_attr: field.required ? " required" : "",
+    required: !!field.required,
   };
   return fieldInputShape(field, base);
 }
@@ -190,7 +190,7 @@ export function generateForm(
   const verb = String(options.method ?? "POST").toUpperCase();
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: "",
+    form_id: "",
     action: h(options.action ?? "/"),
     form_method: h(verb),
     method_override: ["PUT", "PATCH", "DELETE"].includes(verb) ? verb : null,

package/packages/orm/src/crudTable.ts

@@ -165,7 +165,7 @@ export function tableData(opts: TableDataOpts): Record<string, unknown> {
     readonly: !opts.editable,
     inline_script: opts.inlineScript,
     table_name: h(opts.tableName),
-    table_id_attr: opts.tableId ? ` id="${h(opts.tableId)}"` : "",
+    table_id: opts.tableId ? String(opts.tableId) : "",
   };
 }
 

package/packages/orm/src/database.ts

@@ -27,7 +27,7 @@ import { quoteIdentifierAnsi, assertColumnNames } from "./adapters/sqlDialect.js
  */
 export function stripTrailingSemicolons(sql: string): string {
   if (!sql) return sql;
-  let stripped = sql.replace(/\s+$/, "");
+  let stripped = sql.trimEnd();
   while (stripped.endsWith(";")) {
     stripped = stripped.slice(0, -1).replace(/\s+$/, "");
   }
@@ -1800,6 +1800,16 @@ export async function createAdapterFromUrl(url: string, username?: string, passw
 async function buildAdapterFromUrl(url: string, username?: string, password?: string): Promise<DatabaseAdapter> {
   const parsed = parseDatabaseUrl(url, username, password);
 
+  // The four TCP engines (postgres/mysql/mssql/firebird) take the identical
+  // connection shape from the parsed URL; build it once instead of per case.
+  const serverConfig = {
+    host: parsed.host ?? undefined,
+    port: parsed.port ?? undefined,
+    user: parsed.username ?? undefined,
+    password: parsed.password ?? undefined,
+    database: parsed.database || undefined,
+  };
+
   switch (parsed.engine) {
     case "sqlite": {
       const { SQLiteAdapter } = await import("./adapters/sqlite.js");
@@ -1807,49 +1817,25 @@ async function buildAdapterFromUrl(url: string, username?: string, password?: st
     }
     case "postgres": {
       const { PostgresAdapter } = await import("./adapters/postgres.js");
-      const adapter = new PostgresAdapter({
-        host: parsed.host ?? undefined,
-        port: parsed.port ?? undefined,
-        user: parsed.username ?? undefined,
-        password: parsed.password ?? undefined,
-        database: parsed.database || undefined,
-      });
+      const adapter = new PostgresAdapter(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mysql": {
       const { MysqlAdapter } = await import("./adapters/mysql.js");
-      const adapter = new MysqlAdapter({
-        host: parsed.host ?? undefined,
-        port: parsed.port ?? undefined,
-        user: parsed.username ?? undefined,
-        password: parsed.password ?? undefined,
-        database: parsed.database || undefined,
-      });
+      const adapter = new MysqlAdapter(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mssql": {
       const { MssqlAdapter } = await import("./adapters/mssql.js");
-      const adapter = new MssqlAdapter({
-        host: parsed.host ?? undefined,
-        port: parsed.port ?? undefined,
-        user: parsed.username ?? undefined,
-        password: parsed.password ?? undefined,
-        database: parsed.database || undefined,
-      });
+      const adapter = new MssqlAdapter(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "firebird": {
       const { FirebirdAdapter } = await import("./adapters/firebird.js");
-      const adapter = new FirebirdAdapter({
-        host: parsed.host ?? undefined,
-        port: parsed.port ?? undefined,
-        user: parsed.username ?? undefined,
-        password: parsed.password ?? undefined,
-        database: parsed.database || undefined,
-      });
+      const adapter = new FirebirdAdapter(serverConfig);
       await adapter.connect();
       return adapter;
     }

package/packages/orm/src/databaseResult.ts

@@ -8,6 +8,16 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 import type { DatabaseAdapter, ColumnInfo } from "./types.js";
 
+// Strip the "(args)" from a column type ("VARCHAR(255)" -> "VARCHAR",
+// "INT(11) UNSIGNED" -> "INT UNSIGNED"). ReDoS-safe: indexOf/slice, not the old
+// /\([^)]*\)/ which backtracks O(n^2) across many '(' (js/polynomial-redos).
+function stripTypeArgs(colType: string): string {
+  const open = colType.indexOf("(");
+  if (open < 0) return colType;
+  const close = colType.indexOf(")", open);
+  return close < 0 ? colType : colType.slice(0, open) + colType.slice(close + 1);
+}
+
 /** Column metadata returned by columnInfo(). */
 export interface ColumnInfoResult {
   name: string;
@@ -261,7 +271,7 @@ export class DatabaseResult implements Iterable<Record<string, unknown>> {
       const [size, decimals] = this._parseTypeSize(colType);
       return {
         name: col.name,
-        type: colType.replace(/\(.*\)/, ""),
+        type: stripTypeArgs(colType),
         size,
         decimals,
         nullable: col.nullable ?? true,

package/packages/orm/src/realtime/index.ts

@@ -14,6 +14,7 @@ export {
   storageKey,
   type StorageBackend,
 } from "./storage.js";
+export { S3Client, S3Error, S3ConfigError, uriEncode } from "./s3Client.js";
 export { default as Workspace } from "./models/workspace.js";
 export { default as Channel } from "./models/channel.js";
 export { default as ChannelMember } from "./models/channelMember.js";

package/packages/orm/src/realtime/realtime.ts

@@ -7,6 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import { createHmac } from "node:crypto";
+import { trimSlashes } from "../../../core/src/slashTrim.js";
 import {
   Router,
   HTTP_OK,
@@ -87,7 +88,7 @@ let _authorize: RealtimeOptions["authorize"] | undefined;
  */
 export async function realtime(options: RealtimeOptions = {}): Promise<Record<string, string>> {
   const features = options.features ?? ["calls"];
-  const raw = (options.prefix ?? "").replace(/^\/+|\/+$/g, "");
+  const raw = trimSlashes(options.prefix ?? "");
   const p = raw ? `/${raw}` : "";
   _authorize = options.authorize;
 

package/packages/orm/src/realtime/s3Client.ts

@@ -0,0 +1,276 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+import { createHash, createHmac } from "node:crypto";
+
+/**
+ * Zero-dependency S3 client (AWS Signature Version 4) on the Node standard
+ * library — node:crypto for signing, global fetch for transport. Covers exactly
+ * what the realtime S3Storage backend needs (PUT, GET, DELETE, HEAD, a presigned
+ * GET URL, and create-bucket for provisioning) so the `s3` backend no longer
+ * needs @aws-sdk/client-s3 or @aws-sdk/s3-request-presigner.
+ *
+ * Path-style addressing (<endpoint>/<bucket>/<key>), which S3-compatible servers
+ * (MinIO, Garage) require and AWS accepts; with no endpoint it targets
+ * https://s3.<region>.amazonaws.com. SigV4 is HMAC-SHA256 canonical signing —
+ * the same primitive Tina4's JWT already uses (node:crypto); nothing here is
+ * reinvented crypto. Mirrors the Python master, proven against AWS's published
+ * SigV4 test vector.
+ */
+
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const SERVICE = "s3";
+const UNRESERVED = /[A-Za-z0-9\-_.~]/;
+
+// Retry policy, as for the AI client (ADR-0053): HTTP 429, any 5xx (S3's
+// SlowDown is a 503) and a dropped connection are sent again, a bounded number
+// of times, honouring Retry-After. Every operation here is idempotent.
+const MAX_RETRIES = 2;
+const BACKOFF_BASE = 0.5; // seconds; retry n waits up to base * 2**n, jittered
+const BACKOFF_CAP = 20.0;
+
+/** An S3 request returned a non-2xx status; `status` holds the HTTP code. */
+export class S3Error extends Error {
+  /** Seconds from a Retry-After header in its delta-seconds form, else null. */
+  retryAfter: number | null = null;
+  constructor(public readonly status: number, message: string) {
+    super(message);
+    this.name = "S3Error";
+  }
+}
+
+/** The client cannot sign a request: no access key or secret was given. */
+export class S3ConfigError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "S3ConfigError";
+  }
+}
+
+/** Seconds from a Retry-After header in its delta-seconds form, else null. */
+function retryAfterSeconds(raw: string | null): number | null {
+  if (raw == null) return null;
+  const n = Number(raw);
+  return Number.isFinite(n) ? Math.max(0, n) : null;
+}
+
+const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+/**
+ * SigV4 canonical encoding: keep the RFC 3986 unreserved set literal; keep "/"
+ * in a path and encode it in a query; every other byte becomes %XX (upper-case).
+ */
+export function uriEncode(value: string, isPath: boolean): string {
+  let out = "";
+  for (const byte of Buffer.from(value, "utf8")) {
+    const ch = String.fromCharCode(byte);
+    if (UNRESERVED.test(ch) || (isPath && ch === "/")) out += ch;
+    else out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+
+function sha256Hex(data: Buffer | string): string {
+  return createHash("sha256").update(data).digest("hex");
+}
+
+function hmac(key: Buffer | string, msg: string): Buffer {
+  return createHmac("sha256", key).update(msg, "utf8").digest();
+}
+
+export class S3Client {
+  private readonly scheme: string;
+  private readonly host: string; // authority (host[:port]) — matches the Host header
+  private readonly prefix: string; // path an endpoint carries (https://host/s3 -> "/s3"), "" if none
+  private readonly region: string;
+  private readonly accessKey: string;
+  private readonly secretKey: string;
+  private readonly timeout: number;
+
+  constructor(opts: {
+    endpoint?: string;
+    accessKey?: string;
+    secretKey?: string;
+    region?: string;
+    timeout?: number;
+  } = {}) {
+    this.region = opts.region || "us-east-1";
+    this.accessKey = opts.accessKey || "";
+    this.secretKey = opts.secretKey || "";
+    this.timeout = opts.timeout ?? 30000;
+    let base = opts.endpoint || `https://s3.${this.region}.amazonaws.com`;
+    while (base.endsWith("/")) base = base.slice(0, -1); // strip trailing slashes without a regex
+    // Split scheme :// authority [ / path ]. The authority alone is the Host
+    // header and the signed `host:`; an endpoint behind a path (https://host/s3)
+    // keeps that path in front of every request path, and in what is signed.
+    const m = /^([a-z][a-z0-9+.-]*):\/\/([^/]+)(\/.*)?$/i.exec(base);
+    this.scheme = m ? m[1] : "https";
+    this.host = m ? m[2] : base;
+    let p = m && m[3] ? m[3] : "";
+    while (p.endsWith("/")) p = p.slice(0, -1);
+    this.prefix = p;
+  }
+
+  // -- public API (the subset S3Storage uses) --------------------------------
+
+  async putObject(bucket: string, key: string, data: Buffer | string, contentType = "application/octet-stream"): Promise<void> {
+    const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    await this.request("PUT", this.canonicalUri(bucket, key), body, { "content-type": contentType });
+  }
+
+  async getObject(bucket: string, key: string): Promise<Buffer> {
+    return (await this.request("GET", this.canonicalUri(bucket, key), Buffer.alloc(0))).body;
+  }
+
+  async deleteObject(bucket: string, key: string): Promise<void> {
+    await this.request("DELETE", this.canonicalUri(bucket, key), Buffer.alloc(0));
+  }
+
+  async headObject(bucket: string, key: string): Promise<void> {
+    await this.request("HEAD", this.canonicalUri(bucket, key), Buffer.alloc(0));
+  }
+
+  /** Create the bucket (path-style `PUT /<bucket>`); an already-owned bucket (409) is success. */
+  async createBucket(bucket: string): Promise<void> {
+    try {
+      await this.request("PUT", `${this.prefix}/${uriEncode(bucket, true)}`, Buffer.alloc(0));
+    } catch (e) {
+      if (!(e instanceof S3Error) || e.status !== 409) throw e;
+    }
+  }
+
+  /** A URL that fetches the object directly, signed via SigV4 query params. */
+  presignedGetUrl(bucket: string, key: string, expires = 3600): string {
+    this.requireCredentials();
+    const { amzDate, dateStamp } = this.now();
+    const uri = this.canonicalUri(bucket, key);
+    const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+    const query: Record<string, string> = {
+      "X-Amz-Algorithm": ALGORITHM,
+      "X-Amz-Credential": `${this.accessKey}/${scope}`,
+      "X-Amz-Date": amzDate,
+      "X-Amz-Expires": String(expires),
+      "X-Amz-SignedHeaders": "host",
+    };
+    const canonicalQs = this.canonicalQuery(query);
+    const canonicalRequest = ["GET", uri, canonicalQs, `host:${this.host}\n`, "host", "UNSIGNED-PAYLOAD"].join("\n");
+    const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+    return `${this.scheme}://${this.host}${uri}?${canonicalQs}&X-Amz-Signature=${signature}`;
+  }
+
+  // -- signing + transport ----------------------------------------------------
+
+  private requireCredentials(): void {
+    // Signing with an empty key only earns a 403 from the server, which says
+    // nothing about the cause. Name the settings instead, before sending.
+    if (!this.accessKey || !this.secretKey) {
+      throw new S3ConfigError(
+        "S3 credentials are not set: set TINA4_STORAGE_KEY and TINA4_STORAGE_SECRET",
+      );
+    }
+  }
+
+  private now(): { amzDate: string; dateStamp: string } {
+    const iso = new Date().toISOString().replace(/[:-]|\.\d{3}/g, "");
+    return { amzDate: iso, dateStamp: iso.slice(0, 8) };
+  }
+
+  private canonicalUri(bucket: string, key: string): string {
+    return `${this.prefix}/${uriEncode(bucket, true)}/${uriEncode(key, true)}`;
+  }
+
+  private canonicalQuery(query: Record<string, string>): string {
+    return Object.keys(query)
+      .sort()
+      .map((k) => `${uriEncode(k, false)}=${uriEncode(query[k], false)}`)
+      .join("&");
+  }
+
+  private signingKey(dateStamp: string): Buffer {
+    const kDate = hmac(`AWS4${this.secretKey}`, dateStamp);
+    const kRegion = hmac(kDate, this.region);
+    const kService = hmac(kRegion, SERVICE);
+    return hmac(kService, "aws4_request");
+  }
+
+  private sign(canonicalRequest: string, amzDate: string, dateStamp: string, scope: string): string {
+    const stringToSign = [ALGORITHM, amzDate, scope, sha256Hex(canonicalRequest)].join("\n");
+    return createHmac("sha256", this.signingKey(dateStamp)).update(stringToSign, "utf8").digest("hex");
+  }
+
+  private async request(
+    method: string,
+    uri: string,
+    body: Buffer,
+    extraHeaders: Record<string, string> = {},
+  ): Promise<{ status: number; body: Buffer }> {
+    this.requireCredentials();
+    for (let attempt = 0; ; attempt++) {
+      const last = attempt === MAX_RETRIES;
+      let delay: number | null = null;
+      try {
+        // Signed afresh each attempt: x-amz-date moves on.
+        return await this.send(method, uri, body, extraHeaders);
+      } catch (e) {
+        if (e instanceof S3Error) {
+          if (last || !(e.status === 429 || e.status >= 500)) throw e;
+          delay = e.retryAfter;
+        } else {
+          // Connection refused or dropped, timeout: nothing was answered.
+          if (last) throw e;
+          delay = null;
+        }
+      }
+      if (delay == null) delay = Math.random() * (BACKOFF_BASE * 2 ** attempt);
+      await sleep(Math.min(delay, BACKOFF_CAP) * 1000);
+    }
+  }
+
+  private async send(
+    method: string,
+    uri: string,
+    body: Buffer,
+    extraHeaders: Record<string, string> = {},
+  ): Promise<{ status: number; body: Buffer }> {
+    const { amzDate, dateStamp } = this.now();
+    const payloadHash = sha256Hex(body);
+
+    const signed: Record<string, string> = {
+      host: this.host,
+      "x-amz-content-sha256": payloadHash,
+      "x-amz-date": amzDate,
+    };
+    const signedKeys = Object.keys(signed).sort();
+    const canonicalHeaders = signedKeys.map((k) => `${k}:${signed[k]}\n`).join("");
+    const signedHeaders = signedKeys.join(";");
+    const canonicalRequest = [method, uri, "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+    const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+    const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+    const authorization = `${ALGORITHM} Credential=${this.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+    const headers: Record<string, string> = {
+      Authorization: authorization,
+      "x-amz-content-sha256": payloadHash,
+      "x-amz-date": amzDate,
+      ...extraHeaders,
+    };
+
+    const url = `${this.scheme}://${this.host}${uri}`;
+    const init: RequestInit = { method, headers, redirect: "manual" };
+    if (method === "PUT" || method === "POST") init.body = body;
+    if (AbortSignal.timeout) init.signal = AbortSignal.timeout(this.timeout);
+
+    const response = await fetch(url, init);
+    if (response.status < 200 || response.status >= 300) {
+      const err = new S3Error(response.status, `${method} ${uri}: HTTP ${response.status}`);
+      err.retryAfter = retryAfterSeconds(response.headers.get("retry-after"));
+      throw err;
+    }
+    return { status: response.status, body: Buffer.from(await response.arrayBuffer()) };
+  }
+}

package/packages/orm/src/realtime/storage.ts

@@ -9,38 +9,15 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { randomBytes } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync, unlinkSync, statSync } from "node:fs";
 import { resolve, sep } from "node:path";
-import { createRequire } from "node:module";
 import { Log } from "../../../core/src/index.js";
-import { optionalPackageMissing } from "../../../core/src/optionalPackage.js";
-
-// ESM has no global `require`; create one so the OPTIONAL aws-sdk can be loaded
-// synchronously in S3Storage's constructor.
-const require = createRequire(import.meta.url);
-
-/** S3 needs both SDK packages, so a missing one names the command for both. */
-const S3_PACKAGES = ["@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner"];
-
-/**
- * Load an @aws-sdk package (an optional peer, ADR-0067). A missing one throws
- * the actionable install error; selectStorage() catches it and logs it while
- * degrading to local storage. Any OTHER load failure is re-thrown untouched,
- * so an installed-but-broken SDK is never mislabelled "not installed".
- */
-function loadAwsSdk(packageName: string): any {
-  try {
-    return require(packageName);
-  } catch (error: any) {
-    const missing = error?.code === "MODULE_NOT_FOUND" && String(error?.message ?? "").includes(`'${packageName}'`);
-    if (!missing) throw error;
-    throw optionalPackageMissing("S3Storage", S3_PACKAGES);
-  }
-}
+import { S3Client } from "./s3Client.js";
 
 /**
  * Pluggable file storage for the realtime "files" feature. StorageBackend is
  * the interface; LocalStorage (default, zero-dependency, filesystem) and
- * S3Storage (opt-in, S3-compatible via @aws-sdk/client-s3) are the shipped
- * implementations. Selection mirrors the cache/session/queue backend pattern:
+ * S3Storage (opt-in, S3-compatible, also zero-dependency — it uses Tina4's own
+ * stdlib SigV4 client, not @aws-sdk) are the shipped implementations.
+ * Selection mirrors the cache/session/queue backend pattern:
  * TINA4_STORAGE_BACKEND (local default | s3) plus per-backend env vars, with a
  * graceful fallback to local if an s3 backend cannot be constructed - a real
  * persistent store, never a silent no-op. Parity with Python's storage.py.
@@ -124,63 +101,46 @@ export class LocalStorage implements StorageBackend {
 }
 
 /**
- * S3-compatible store (AWS S3, MinIO, ...). Opt-in; the app installs the SDK:
- * `npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner`.
- * Presigned GET URLs let clients fetch large blobs straight from object
- * storage instead of streaming through the app.
+ * S3-compatible store (AWS S3, MinIO, Garage, ...). Opt-in, zero dependencies.
+ *
+ * Talks to S3 through Tina4's own stdlib SigV4 client (S3Client, node:crypto +
+ * global fetch) — no @aws-sdk packages. Presigned GET URLs let clients fetch
+ * large blobs straight from object storage instead of streaming through the app.
  */
 export class S3Storage implements StorageBackend {
-  private client: any;
+  private client: S3Client;
   private bucket: string;
 
   constructor(opts: { endpoint?: string; key?: string; secret?: string; bucket?: string; region?: string } = {}) {
     this.bucket = opts.bucket || process.env.TINA4_STORAGE_BUCKET || "";
     if (!this.bucket) throw new Error("S3Storage requires TINA4_STORAGE_BUCKET");
-    // Loaded lazily; a missing SDK throws the install command here, and
-    // selectStorage() logs it and falls back to local storage.
-    const { S3Client } = loadAwsSdk("@aws-sdk/client-s3");
-    // url() needs the presigner; check it now so a half-installed SDK refuses
-    // at construction instead of failing on the first download link.
-    loadAwsSdk("@aws-sdk/s3-request-presigner");
-    const endpoint = opts.endpoint || process.env.TINA4_STORAGE_URL;
     this.client = new S3Client({
-      endpoint: endpoint || undefined,
-      forcePathStyle: true,
+      endpoint: opts.endpoint || process.env.TINA4_STORAGE_URL || undefined,
       region: opts.region || process.env.TINA4_STORAGE_REGION || "us-east-1",
-      credentials: {
-        accessKeyId: opts.key || process.env.TINA4_STORAGE_KEY || "",
-        secretAccessKey: opts.secret || process.env.TINA4_STORAGE_SECRET || "",
-      },
+      accessKey: opts.key || process.env.TINA4_STORAGE_KEY || "",
+      secretKey: opts.secret || process.env.TINA4_STORAGE_SECRET || "",
     });
   }
 
   async put(key: string, data: Buffer | string, mime = "application/octet-stream"): Promise<void> {
-    const { PutObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-    await this.client.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: data, ContentType: mime }));
+    await this.client.putObject(this.bucket, key, data, mime);
   }
 
   async get(key: string): Promise<Buffer | null> {
     try {
-      const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-      const res = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
-      const chunks: Buffer[] = [];
-      for await (const chunk of res.Body as AsyncIterable<Buffer>) chunks.push(Buffer.from(chunk));
-      return Buffer.concat(chunks);
+      return await this.client.getObject(this.bucket, key);
     } catch {
       return null;
     }
   }
 
   async url(key: string, ttl = 3600): Promise<string | null> {
-    const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-    const { getSignedUrl } = loadAwsSdk("@aws-sdk/s3-request-presigner");
-    return getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.bucket, Key: key }), { expiresIn: ttl });
+    return this.client.presignedGetUrl(this.bucket, key, ttl);
   }
 
   async delete(key: string): Promise<void> {
     try {
-      const { DeleteObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-      await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+      await this.client.deleteObject(this.bucket, key);
     } catch (e) {
       Log.error(`S3Storage delete failed for ${key}: ${(e as Error).message}`);
     }
@@ -188,8 +148,7 @@ export class S3Storage implements StorageBackend {
 
   async exists(key: string): Promise<boolean> {
     try {
-      const { HeadObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-      await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+      await this.client.headObject(this.bucket, key);
       return true;
     } catch {
       return false;
@@ -200,7 +159,7 @@ export class S3Storage implements StorageBackend {
 /**
  * Resolve the storage backend from an explicit instance or the environment.
  * Falls back to LocalStorage (logging why) when an s3 backend cannot be built
- * (driver missing or config incomplete) - a real store, never a silent no-op.
+ * (config incomplete, e.g. no bucket) - a real store, never a silent no-op.
  */
 export function selectStorage(storage?: StorageBackend): StorageBackend {
   if (storage) return storage;