From 9b1122a17a5ffa1e3bb6dd79071e5794f14e4a7a Mon Sep 17 00:00:00 2001
From: Carles Escrig Royo <esroyo@gmail.com>
Date: Thu, 21 May 2026 17:35:47 +0200
Subject: [PATCH 1/2] feat(s3): add sessionToken support for temporary AWS
 credentials

---
 src/drivers/s3.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/drivers/s3.ts b/src/drivers/s3.ts
index 170f7aac0..df5276fde 100644
--- a/src/drivers/s3.ts
+++ b/src/drivers/s3.ts
@@ -42,6 +42,11 @@ export interface S3DriverOptions {
    * Enabled by default to speedup `clear()` operation. Set to `false` if provider is not implementing [DeleteObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html).
    */
   bulkDelete?: boolean;
+
+  /**
+   * akin to AWS_SESSION_TOKEN if using temp credentials.
+   */
+  sessionToken?: string;
 }
 
 export interface S3ItemOptions {
@@ -84,6 +89,7 @@ const driver: DriverFactory<S3DriverOptions> = (options) => {
         service: "s3",
         accessKeyId: options.accessKeyId,
         secretAccessKey: options.secretAccessKey,
+        sessionToken: options.sessionToken,
         region: options.region,
       });
     }

From 1a7bac6766ba8278886076e318fa63d86f3f0a6d Mon Sep 17 00:00:00 2001
From: Carles Escrig Royo <esroyo@gmail.com>
Date: Thu, 21 May 2026 20:47:21 +0200
Subject: [PATCH 2/2] fix: finetune withTracing signature to keep original
 Storage<T>

---
 src/tracing.ts | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/tracing.ts b/src/tracing.ts
index cd7401d91..4a926c5d0 100644
--- a/src/tracing.ts
+++ b/src/tracing.ts
@@ -46,17 +46,21 @@ export interface TraceContext {
   };
 }
 
-type MaybeTracedStorage<T extends StorageValue> = Storage<T> & {
-  __traced?: boolean;
-};
+/**
+ * Runtime-only brand attached to wrapped storages so re-wrapping is a no-op.
+ * Kept off the public return type.
+ */
+type TracedBrand = { __traced?: boolean };
 
 /**
  * Wraps a storage instance with tracing capabilities.
  * All storage operations will emit tracing events through Node.js diagnostics channels.
  */
-export function withTracing<T extends StorageValue>(storage: MaybeTracedStorage<T>): Storage<T> {
+export function withTracing(storage: Storage<any>): Storage<StorageValue>;
+export function withTracing<T extends Storage<any>>(storage: T): T;
+export function withTracing<T extends Storage<any>>(storage: T): T {
   // Avoid wrapping already traced storages
-  if (storage.__traced) {
+  if ((storage as TracedBrand).__traced) {
     return storage;
   }
 
@@ -107,7 +111,10 @@ export function withTracing<T extends StorageValue>(storage: MaybeTracedStorage<
     return channel ? channel.tracePromise(exec, data) : exec();
   }
 
-  const tracedStorage: MaybeTracedStorage<T> = { ...storage, __traced: true };
+  const tracedStorage: T & TracedBrand = {
+    ...storage,
+    __traced: true,
+  };
 
   // Helper to get mount info for a key
   const getMountInfo = (key: string) => {
@@ -160,7 +167,9 @@ export function withTracing<T extends StorageValue>(storage: MaybeTracedStorage<
   }
 
   for (const operation in operations) {
-    tracedStorage[operation] = wrapOperation(operation as TracedOperation);
+    (tracedStorage as Record<TracedOperation, any>)[operation] = wrapOperation(
+      operation as TracedOperation,
+    );
   }
 
   // Wrap aliases