@dimah-s3/server 0.1.0

package/dist/index.js

@@ -0,0 +1,1047 @@
+import { S3_API_ROUTES, DimahS3Error, parseFileName, buildContentDisposition, S3_ERROR_CODES, pluginEndpointPath, S3_API_BASE_PATH, normalizeS3ApiBasePath } from '@dimah-s3/core';
+export { DimahS3Error } from '@dimah-s3/core';
+import { ListPartsCommand, AbortMultipartUploadCommand, CompleteMultipartUploadCommand, HeadObjectCommand, UploadPartCommand, CreateMultipartUploadCommand, DeleteObjectCommand, GetObjectCommand, PutObjectCommand, GetObjectAclCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+
+// src/dimah-s3.ts
+var errors = {
+  notFound: () => new DimahS3Error("Not Found", 404, { code: S3_ERROR_CODES.NOT_FOUND }),
+  invalidJson: () => new DimahS3Error("Invalid JSON payload", 400, {
+    code: S3_ERROR_CODES.INVALID_JSON
+  }),
+  forbidden: () => new DimahS3Error("Forbidden", 403, { code: S3_ERROR_CODES.FORBIDDEN }),
+  internalError: () => new DimahS3Error("Internal server error", 500, {
+    code: S3_ERROR_CODES.INTERNAL_ERROR
+  }),
+  objectNotFound: () => new DimahS3Error("Object not found", 404, {
+    code: S3_ERROR_CODES.OBJECT_NOT_FOUND
+  }),
+  s3NetworkError: (code) => new DimahS3Error(
+    `S3 endpoint unreachable (${code}): check your endpoint URL and network connectivity`,
+    502,
+    { code: S3_ERROR_CODES.S3_NETWORK_ERROR, params: { code } }
+  ),
+  fieldRequired: (name) => new DimahS3Error(`${name} is required`, 400, {
+    code: S3_ERROR_CODES.FIELD_REQUIRED,
+    params: { name }
+  }),
+  /** Missing `key` on query-string routes (download / delete / list-parts). */
+  keyRequired: () => new DimahS3Error("key query parameter is required", 400, {
+    code: S3_ERROR_CODES.KEY_REQUIRED
+  }),
+  uploadIdRequired: () => new DimahS3Error("uploadId is required", 400, {
+    code: S3_ERROR_CODES.UPLOAD_ID_REQUIRED
+  }),
+  partNumberInvalid: () => new DimahS3Error("partNumber must be a positive integer", 400, {
+    code: S3_ERROR_CODES.PART_NUMBER_INVALID
+  }),
+  partsRequired: () => new DimahS3Error("At least one valid part is required", 400, {
+    code: S3_ERROR_CODES.PARTS_REQUIRED
+  }),
+  fileSizeRequiredUpload: () => new DimahS3Error(
+    "fileSize is required when upload.requireFileSize is enabled",
+    400,
+    { code: S3_ERROR_CODES.FILE_SIZE_REQUIRED_UPLOAD }
+  ),
+  fileSizeRequiredMultipart: () => new DimahS3Error(
+    "fileSize is required when multipart.requireFileSize is enabled",
+    400,
+    { code: S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART }
+  )
+};
+function requireString(value, name) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed) throw errors.fieldRequired(name);
+  return trimmed;
+}
+function statusOf(err, fallback) {
+  return typeof err?.status === "number" ? err.status : fallback;
+}
+function toDimahS3Error(err, fallbackMessage, fallbackStatus = 403, options) {
+  if (err instanceof DimahS3Error) return err;
+  const message = err instanceof Error && err.message.trim() ? err.message : fallbackMessage;
+  const status = statusOf(err, fallbackStatus);
+  return new DimahS3Error(message, status, {
+    cause: err instanceof Error ? err : void 0,
+    ...{}
+  });
+}
+async function parseBody(request) {
+  try {
+    const body = await request.json();
+    return body && typeof body === "object" ? body : null;
+  } catch {
+    return null;
+  }
+}
+function errorJson(err) {
+  return Response.json(
+    {
+      message: err.message,
+      ...err.code !== void 0 ? { code: err.code } : {},
+      ...err.params !== void 0 ? { params: err.params } : {}
+    },
+    { status: err.status }
+  );
+}
+var NETWORK_CODES = /* @__PURE__ */ new Set([
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENOTFOUND"
+]);
+function toErrorResponse(err) {
+  if (err instanceof DimahS3Error) {
+    return errorJson(err);
+  }
+  const code = err?.code;
+  if (typeof code === "string" && NETWORK_CODES.has(code)) {
+    const networkErr = errors.s3NetworkError(code);
+    console.error("[S3 API]", networkErr.message, err);
+    return errorJson(networkErr);
+  }
+  console.error("[S3 API]", err);
+  return errorJson(errors.internalError());
+}
+function wrapHandler(handler) {
+  return async (request) => {
+    try {
+      return await handler(request);
+    } catch (err) {
+      return toErrorResponse(err);
+    }
+  };
+}
+async function runHook(hook, context) {
+  if (!hook) return;
+  try {
+    await hook(context);
+  } catch (err) {
+    if (err instanceof DimahS3Error) throw err;
+    if (err instanceof Error && err.message.trim()) {
+      throw toDimahS3Error(err, errors.forbidden().message, 403);
+    }
+    throw errors.forbidden();
+  }
+}
+async function runLifecycleHook(hook, context) {
+  if (!hook) return;
+  try {
+    await hook(context);
+  } catch (err) {
+    if (err instanceof DimahS3Error) throw err;
+    console.error("[S3 API] lifecycle hook failed", err);
+    throw errors.internalError();
+  }
+}
+function normalizeExpiresIn(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 600;
+}
+function requestFromHeaders(headers) {
+  return new Request("http://dimah-s3.local", { headers });
+}
+
+// src/helpers/is-aws-not-found.ts
+function isAwsNotFound(err) {
+  const e = err;
+  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
+}
+var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
+async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const result = await s3.send(
+      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
+      { abortSignal: controller.signal }
+    );
+    const isPublic = result.Grants?.some(
+      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+    );
+    return isPublic ? "public-read" : "private";
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// src/procedures/confirm.ts
+async function confirm(config, input, request) {
+  const key = requireString(input.key, "key");
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  await runHook(config.upload?.confirmGuard, {
+    request,
+    key,
+    bucket
+  });
+  const head = await config.s3.send(
+    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  );
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.s3, bucket, key) : void 0;
+  const fileName = parseFileName(head.ContentDisposition);
+  const context = {
+    request,
+    key,
+    bucket,
+    contentType: head.ContentType,
+    contentLength: head.ContentLength ?? 0,
+    eTag: head.ETag?.replace(/"/g, ""),
+    metadata: head.Metadata,
+    acl,
+    fileName,
+    versionId: head.VersionId,
+    lastModified: head.LastModified?.toISOString()
+  };
+  await runLifecycleHook(config.upload?.onConfirmed, context);
+  return {
+    key,
+    bucket,
+    contentType: context.contentType,
+    contentLength: context.contentLength,
+    eTag: context.eTag,
+    metadata: context.metadata ?? {},
+    acl,
+    fileName,
+    versionId: context.versionId,
+    lastModified: context.lastModified
+  };
+}
+async function deleteObject(config, input, request) {
+  const key = input.key?.trim();
+  if (!key) {
+    throw errors.keyRequired();
+  }
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  await runHook(config.delete?.guard, {
+    request,
+    key,
+    bucket
+  });
+  try {
+    await config.s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+  } catch (err) {
+    if (isAwsNotFound(err)) {
+      throw errors.objectNotFound();
+    }
+    throw err;
+  }
+  await config.s3.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+  await runLifecycleHook(config.delete?.onDeleted, { request, key, bucket });
+  return { success: true, bucket, key };
+}
+async function download(config, input, request) {
+  const key = input.key?.trim();
+  if (!key) {
+    throw errors.keyRequired();
+  }
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const fileName = input.fileName?.trim();
+  await runHook(config.download?.presignGuard, {
+    request,
+    key,
+    bucket,
+    fileName: fileName || void 0
+  });
+  try {
+    await config.s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+  } catch (err) {
+    if (isAwsNotFound(err)) {
+      throw errors.objectNotFound();
+    }
+    throw err;
+  }
+  const url = await getSignedUrl(
+    config.s3,
+    new GetObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      ResponseContentDisposition: fileName ? buildContentDisposition(fileName) : "attachment"
+    }),
+    { expiresIn }
+  );
+  await runLifecycleHook(config.download?.onPresigned, {
+    request,
+    key,
+    bucket,
+    fileName: fileName || void 0,
+    url,
+    expiresIn
+  });
+  return { bucket, key, url, expiresIn };
+}
+async function multipartAbort(config, input, request) {
+  const key = requireString(input.key, "key");
+  const uploadId = requireString(input.uploadId, "uploadId");
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  await runHook(config.multipart?.abortGuard, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  await config.s3.send(
+    new AbortMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId
+    })
+  );
+  await runLifecycleHook(config.multipart?.onAbort, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  return { bucket, key, uploadId, aborted: true };
+}
+async function multipartComplete(config, input, request) {
+  const key = requireString(input.key, "key");
+  const uploadId = requireString(input.uploadId, "uploadId");
+  const parts = (Array.isArray(input.parts) ? input.parts : []).map(({ partNumber }) => Number(partNumber)).filter((n) => Number.isInteger(n) && n > 0).sort((a, b) => a - b);
+  if (!parts.length) {
+    throw errors.partsRequired();
+  }
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  const partRefs = parts.map((partNumber) => ({ partNumber }));
+  await runHook(config.multipart?.completeGuard, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    parts: partRefs
+  });
+  const listed = await config.s3.send(
+    new ListPartsCommand({ Bucket: bucket, Key: key, UploadId: uploadId })
+  );
+  const listedParts = listed.Parts ?? [];
+  const completeParts = parts.map((partNumber) => {
+    const found = listedParts.find((p) => p.PartNumber === partNumber);
+    return { PartNumber: partNumber, ETag: found?.ETag ?? "" };
+  });
+  const completeResult = await config.s3.send(
+    new CompleteMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      MultipartUpload: { Parts: completeParts }
+    })
+  );
+  let head = await config.s3.send(
+    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  );
+  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
+    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
+    head = await config.s3.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
+  }
+  const contentLength = head.ContentLength ?? 0;
+  const contentType = head.ContentType;
+  const eTag = (head.ETag ?? completeResult.ETag ?? "").replace(/"/g, "");
+  const metadata = head.Metadata ?? {};
+  const versionId = head.VersionId;
+  const lastModified = head.LastModified?.toISOString();
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.s3, bucket, key) : void 0;
+  const fileName = parseFileName(head.ContentDisposition);
+  await runLifecycleHook(config.multipart?.onComplete, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    contentLength,
+    contentType,
+    eTag,
+    metadata,
+    acl,
+    fileName,
+    versionId,
+    lastModified
+  });
+  return {
+    bucket,
+    key,
+    uploadId,
+    contentLength,
+    contentType,
+    eTag,
+    metadata,
+    acl,
+    fileName,
+    versionId,
+    lastModified
+  };
+}
+async function multipartInit(config, input, request) {
+  const key = requireString(input.key, "key");
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : void 0;
+  if (config.multipart?.requireFileSize && fileSize === void 0) {
+    throw errors.fileSizeRequiredMultipart();
+  }
+  await runHook(config.multipart?.initGuard, {
+    request,
+    key,
+    bucket,
+    fileSize
+  });
+  const { UploadId } = await config.s3.send(
+    new CreateMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      ContentType: input.contentType,
+      ContentDisposition: input.fileName ? buildContentDisposition(input.fileName) : void 0,
+      Metadata: input.metadata,
+      ACL: acl
+    })
+  );
+  await runLifecycleHook(config.multipart?.onInit, {
+    request,
+    key,
+    bucket,
+    uploadId: UploadId,
+    contentType: input.contentType,
+    fileSize,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
+  });
+  return { bucket, key, uploadId: UploadId };
+}
+async function multipartListParts(config, input, request) {
+  const key = input.key?.trim() ?? "";
+  const uploadId = input.uploadId?.trim() ?? "";
+  const bucketParam = input.bucket?.trim();
+  if (!key) {
+    throw errors.keyRequired();
+  }
+  if (!uploadId) {
+    throw errors.uploadIdRequired();
+  }
+  const bucket = bucketParam || config.defaultBucket;
+  await runHook(config.multipart?.listGuard, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  const response = await config.s3.send(
+    new ListPartsCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId
+    })
+  );
+  const parts = (response.Parts ?? []).map((p) => ({
+    partNumber: p.PartNumber ?? 0,
+    size: p.Size ?? 0,
+    eTag: (p.ETag ?? "").replace(/"/g, "")
+  }));
+  await runLifecycleHook(config.multipart?.onList, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    parts
+  });
+  return { parts };
+}
+async function multipartSignPart(config, input, request) {
+  const key = requireString(input.key, "key");
+  const uploadId = requireString(input.uploadId, "uploadId");
+  const partNumber = Number(input.partNumber);
+  if (!Number.isInteger(partNumber) || partNumber <= 0) {
+    throw errors.partNumberInvalid();
+  }
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const partSize = typeof input.partSize === "number" && input.partSize > 0 ? Math.floor(input.partSize) : null;
+  await runHook(config.multipart?.partGuard, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    partNumber,
+    partSize: partSize ?? void 0
+  });
+  const presignedUrl = await getSignedUrl(
+    config.s3,
+    new UploadPartCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      PartNumber: partNumber,
+      ...partSize !== null ? { ContentLength: partSize } : {}
+    }),
+    {
+      expiresIn,
+      ...partSize !== null ? { signableHeaders: /* @__PURE__ */ new Set(["content-length"]) } : {}
+    }
+  );
+  return {
+    presignedUrl,
+    partNumber,
+    uploadId,
+    bucket,
+    expiresIn,
+    ...partSize !== null ? { partSize } : {}
+  };
+}
+async function upload(config, input, request) {
+  const key = requireString(input.key, "key");
+  const bucket = input.bucket?.trim() || config.defaultBucket;
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const contentType = input.contentType?.trim() || "application/octet-stream";
+  const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : null;
+  await runHook(config.upload?.presignGuard, {
+    request,
+    key,
+    bucket,
+    contentType: input.contentType,
+    fileSize: fileSize ?? void 0,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
+  });
+  const method = config.upload?.method ?? "POST";
+  if (method === "PUT" && config.upload?.requireFileSize && fileSize === null) {
+    throw errors.fileSizeRequiredUpload();
+  }
+  if (method === "PUT") {
+    const putHeaders = {
+      "Content-Type": contentType
+    };
+    if (input.fileName) {
+      putHeaders["Content-Disposition"] = buildContentDisposition(
+        input.fileName
+      );
+    }
+    const url2 = await getSignedUrl(
+      config.s3,
+      new PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        ContentType: contentType,
+        ACL: acl,
+        ...input.fileName ? { ContentDisposition: buildContentDisposition(input.fileName) } : {},
+        ...fileSize !== null ? { ContentLength: fileSize } : {}
+      }),
+      {
+        expiresIn,
+        ...fileSize !== null ? { signableHeaders: /* @__PURE__ */ new Set(["content-length"]) } : {}
+      }
+    );
+    await runLifecycleHook(config.upload?.onPresigned, {
+      request,
+      key,
+      bucket,
+      contentType: input.contentType,
+      fileSize: fileSize ?? void 0,
+      metadata: input.metadata,
+      acl,
+      fileName: input.fileName,
+      url: url2,
+      expiresIn
+    });
+    return {
+      bucket,
+      key,
+      url: url2,
+      headers: putHeaders,
+      expiresIn,
+      method: "PUT"
+    };
+  }
+  const fields = { acl, "Content-Type": contentType };
+  if (input.fileName) {
+    fields["Content-Disposition"] = buildContentDisposition(input.fileName);
+  }
+  if (input.metadata) {
+    for (const [k, v] of Object.entries(input.metadata)) {
+      fields[`x-amz-meta-${k}`] = v;
+    }
+  }
+  const rangeMin = fileSize ?? 1;
+  const rangeMax = fileSize ?? void 0;
+  const { url, fields: signedFields } = await createPresignedPost(config.s3, {
+    Bucket: bucket,
+    Key: key,
+    Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
+    Fields: fields,
+    Expires: expiresIn
+  });
+  await runLifecycleHook(config.upload?.onPresigned, {
+    request,
+    key,
+    bucket,
+    contentType: input.contentType,
+    fileSize: fileSize ?? void 0,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName,
+    url,
+    expiresIn
+  });
+  return {
+    bucket,
+    key,
+    url,
+    fields: signedFields,
+    expiresIn,
+    method: "POST"
+  };
+}
+
+// src/procedures/registry.ts
+var PROCEDURE_REGISTRY = {
+  upload: {
+    path: S3_API_ROUTES.upload,
+    method: "POST",
+    isEnabled: (c) => c.upload?.enabled,
+    run: (config, input, request) => upload(config, input, request)
+  },
+  uploadConfirm: {
+    path: S3_API_ROUTES.uploadConfirm,
+    method: "POST",
+    isEnabled: (c) => c.upload?.enabled,
+    run: (config, input, request) => confirm(config, input, request)
+  },
+  download: {
+    path: S3_API_ROUTES.download,
+    method: "GET",
+    isEnabled: (c) => c.download?.enabled,
+    run: (config, input, request) => download(config, input, request)
+  },
+  delete: {
+    path: S3_API_ROUTES.delete,
+    method: "DELETE",
+    isEnabled: (c) => c.delete?.enabled,
+    run: (config, input, request) => deleteObject(
+      config,
+      input,
+      request
+    )
+  },
+  multipartInit: {
+    path: S3_API_ROUTES.multipartInit,
+    method: "POST",
+    status: 201,
+    isEnabled: (c) => c.multipart?.enabled,
+    run: (config, input, request) => multipartInit(
+      config,
+      input,
+      request
+    )
+  },
+  multipartPart: {
+    path: S3_API_ROUTES.multipartPart,
+    method: "POST",
+    isEnabled: (c) => c.multipart?.enabled,
+    run: (config, input, request) => multipartSignPart(
+      config,
+      input,
+      request
+    )
+  },
+  multipartComplete: {
+    path: S3_API_ROUTES.multipartComplete,
+    method: "POST",
+    isEnabled: (c) => c.multipart?.enabled,
+    run: (config, input, request) => multipartComplete(
+      config,
+      input,
+      request
+    )
+  },
+  multipartAbort: {
+    path: S3_API_ROUTES.multipartAbort,
+    method: "POST",
+    isEnabled: (c) => c.multipart?.enabled,
+    run: (config, input, request) => multipartAbort(
+      config,
+      input,
+      request
+    )
+  },
+  multipartListParts: {
+    path: S3_API_ROUTES.multipartListParts,
+    method: "GET",
+    isEnabled: (c) => c.multipart?.enabled,
+    run: (config, input, request) => multipartListParts(
+      config,
+      input,
+      request
+    )
+  }
+};
+
+// src/api.ts
+async function runProcedure(config, entry, headers, input) {
+  const request = requestFromHeaders(headers);
+  await runHook(config.guard, { request });
+  if (!entry.isEnabled(config)) {
+    throw errors.notFound();
+  }
+  return entry.run(config, input, request);
+}
+function createServerApi(config) {
+  return {
+    upload: (payload) => {
+      const { headers, ...input } = payload;
+      return runProcedure(config, PROCEDURE_REGISTRY.upload, headers, input);
+    },
+    confirm: (payload) => {
+      const { headers, ...input } = payload;
+      return runProcedure(
+        config,
+        PROCEDURE_REGISTRY.uploadConfirm,
+        headers,
+        input
+      );
+    },
+    download: (key, options) => {
+      const { headers, ...rest } = options ?? {};
+      return runProcedure(config, PROCEDURE_REGISTRY.download, headers, {
+        key,
+        ...rest
+      });
+    },
+    delete: (key, options) => {
+      const { headers, ...rest } = options ?? {};
+      return runProcedure(config, PROCEDURE_REGISTRY.delete, headers, {
+        key,
+        ...rest
+      });
+    },
+    multipart: {
+      init: (payload) => {
+        const { headers, ...input } = payload;
+        return runProcedure(
+          config,
+          PROCEDURE_REGISTRY.multipartInit,
+          headers,
+          input
+        );
+      },
+      signPart: (payload) => {
+        const { headers, ...input } = payload;
+        return runProcedure(
+          config,
+          PROCEDURE_REGISTRY.multipartPart,
+          headers,
+          input
+        );
+      },
+      listParts: (payload) => {
+        const { headers, ...input } = payload;
+        return runProcedure(
+          config,
+          PROCEDURE_REGISTRY.multipartListParts,
+          headers,
+          input
+        );
+      },
+      complete: (payload) => {
+        const { headers, ...input } = payload;
+        return runProcedure(
+          config,
+          PROCEDURE_REGISTRY.multipartComplete,
+          headers,
+          input
+        );
+      },
+      abort: (payload) => {
+        const { headers, ...input } = payload;
+        return runProcedure(
+          config,
+          PROCEDURE_REGISTRY.multipartAbort,
+          headers,
+          input
+        );
+      }
+    }
+  };
+}
+async function requireJson(request) {
+  const body = await parseBody(request);
+  if (!body) {
+    throw errors.invalidJson();
+  }
+  return body;
+}
+function decodeInput(entry, ctx) {
+  const { request, url } = ctx;
+  const { searchParams } = url;
+  switch (entry.path) {
+    case PROCEDURE_REGISTRY.download.path: {
+      const expiresRaw = searchParams.get("expiresIn");
+      return Promise.resolve({
+        key: searchParams.get("key")?.trim() ?? "",
+        bucket: searchParams.get("bucket")?.trim() || void 0,
+        fileName: searchParams.get("fileName")?.trim() || void 0,
+        expiresIn: expiresRaw != null ? Number(expiresRaw) : void 0
+      });
+    }
+    case PROCEDURE_REGISTRY.delete.path:
+      return Promise.resolve({
+        key: searchParams.get("key")?.trim() ?? "",
+        bucket: searchParams.get("bucket")?.trim() || void 0
+      });
+    case PROCEDURE_REGISTRY.multipartListParts.path:
+      return Promise.resolve({
+        key: searchParams.get("key")?.trim() ?? "",
+        uploadId: searchParams.get("uploadId")?.trim() ?? "",
+        bucket: searchParams.get("bucket")?.trim() || void 0
+      });
+    default:
+      return requireJson(request);
+  }
+}
+var routes = Object.values(PROCEDURE_REGISTRY).map((entry) => ({
+  method: entry.method,
+  path: entry.path,
+  enabled: entry.isEnabled,
+  status: "status" in entry ? entry.status : void 0,
+  run: async (ctx) => {
+    const input = await decodeInput(entry, ctx);
+    return entry.run(ctx.config, input, ctx.request);
+  }
+}));
+function createHandler(config, basePath = S3_API_BASE_PATH, pluginEndpoints = []) {
+  const base = normalizeS3ApiBasePath(basePath);
+  const pluginRoutes = pluginEndpoints.map((e) => ({
+    method: e.method,
+    path: pluginEndpointPath(e.pluginId, e.path),
+    status: e.status,
+    enabled: () => true,
+    run: ({ config: cfg, request, url }) => e.handler({
+      request,
+      url,
+      config: cfg,
+      errors,
+      json: () => parseBody(request)
+    })
+  }));
+  const allRoutes = [...routes, ...pluginRoutes];
+  return wrapHandler(async (request) => {
+    await runHook(config.guard, { request });
+    const url = new URL(request.url);
+    const subpath = url.pathname.slice(base.length).replace(/^\//, "");
+    const route = allRoutes.find(
+      (r) => r.method === request.method && r.path === subpath
+    );
+    if (!route || !route.enabled(config)) {
+      throw errors.notFound();
+    }
+    const data = await route.run({ config, request, url, errors });
+    return Response.json(
+      data,
+      route.status ? { status: route.status } : void 0
+    );
+  });
+}
+
+// src/plugin/chain-hooks.ts
+function chainHooks(...hooks) {
+  return async (context) => {
+    for (const hook of hooks) {
+      if (hook) await hook(context);
+    }
+  };
+}
+
+// src/plugin/hook-registry.ts
+var FEATURE_HOOK_KEYS = {
+  upload: ["presignGuard", "onPresigned", "confirmGuard", "onConfirmed"],
+  download: ["presignGuard", "onPresigned"],
+  delete: ["guard", "onDeleted"],
+  multipart: [
+    "initGuard",
+    "partGuard",
+    "completeGuard",
+    "abortGuard",
+    "listGuard",
+    "onInit",
+    "onComplete",
+    "onAbort",
+    "onList"
+  ]
+};
+
+// src/plugin/types.ts
+var RESERVED_PLUGIN_IDS = [
+  "handler",
+  "api",
+  "context",
+  "getPlugin"
+];
+
+// src/plugin/apply-plugins.ts
+function mergeHookField(pluginHooks, userHook) {
+  const present = [...pluginHooks, userHook].filter(
+    (h) => h != null
+  );
+  if (present.length === 0) return void 0;
+  if (present.length === 1) return present[0];
+  return chainHooks(...present);
+}
+function mergeFeatureHooks(feature, keys, plugins, userFeature) {
+  if (!userFeature && plugins.every((p) => !p.hooks?.[feature])) {
+    return userFeature;
+  }
+  const merged = { ...userFeature };
+  for (const key of keys) {
+    const fromPlugins = plugins.map(
+      (p) => p.hooks?.[feature]?.[key]
+    );
+    const userHook = userFeature?.[key];
+    const next = mergeHookField(fromPlugins, userHook);
+    if (next !== void 0) {
+      merged[key] = next;
+    }
+  }
+  return merged;
+}
+function applyPlugins(config) {
+  const plugins = config.plugins ?? [];
+  const seen = /* @__PURE__ */ new Set();
+  const byId = /* @__PURE__ */ new Map();
+  const context = {};
+  const getPlugin = (id) => byId.get(id);
+  for (const plugin of plugins) {
+    if (RESERVED_PLUGIN_IDS.includes(plugin.id)) {
+      throw new Error(
+        `Plugin id "${plugin.id}" is reserved on the dimahS3 instance. Choose a different id.`
+      );
+    }
+    if (seen.has(plugin.id)) {
+      throw new Error(
+        `Duplicate dimah-s3 plugin id "${plugin.id}". Each plugin id must be unique.`
+      );
+    }
+    seen.add(plugin.id);
+    byId.set(plugin.id, plugin);
+  }
+  for (const plugin of plugins) {
+    for (const dep of plugin.dependsOn ?? []) {
+      if (!seen.has(dep)) {
+        throw new Error(
+          `Plugin "${plugin.id}" depends on "${dep}", which is not registered.`
+        );
+      }
+    }
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  function visit(id, stack) {
+    if (visited.has(id)) return;
+    if (visiting.has(id)) {
+      throw new Error(
+        `Circular plugin dependency detected: ${[...stack, id].join(" -> ")}.`
+      );
+    }
+    visiting.add(id);
+    const plugin = byId.get(id);
+    for (const dep of plugin?.dependsOn ?? []) {
+      visit(dep, [...stack, id]);
+    }
+    visiting.delete(id);
+    visited.add(id);
+  }
+  for (const plugin of plugins) {
+    visit(plugin.id, []);
+  }
+  for (const plugin of plugins) {
+    if (plugin.context !== void 0) {
+      context[plugin.id] = plugin.context;
+    }
+  }
+  const reservedRoutePaths = new Set(Object.values(S3_API_ROUTES));
+  const seenEndpointKeys = /* @__PURE__ */ new Set();
+  const endpoints = [];
+  for (const plugin of plugins) {
+    for (const [name, endpoint] of Object.entries(plugin.endpoints ?? {})) {
+      const mounted = pluginEndpointPath(plugin.id, endpoint.path);
+      if (reservedRoutePaths.has(mounted)) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" collides with a core route.`
+        );
+      }
+      const routeKey = `${endpoint.method} ${mounted}`;
+      if (seenEndpointKeys.has(routeKey)) {
+        throw new Error(`Duplicate plugin endpoint ${routeKey}.`);
+      }
+      seenEndpointKeys.add(routeKey);
+      endpoints.push({ ...endpoint, pluginId: plugin.id });
+    }
+  }
+  const { plugins: _omit, ...rest } = config;
+  for (const plugin of plugins) {
+    plugin.init?.({ config: rest, getPlugin });
+  }
+  const guard = mergeHookField(
+    plugins.map((p) => p.hooks?.guard),
+    rest.guard
+  );
+  const merged = {
+    ...rest,
+    ...guard !== void 0 ? { guard } : {}
+  };
+  for (const feature of Object.keys(FEATURE_HOOK_KEYS)) {
+    merged[feature] = mergeFeatureHooks(
+      feature,
+      FEATURE_HOOK_KEYS[feature],
+      plugins,
+      rest[feature]
+    );
+  }
+  return {
+    config: merged,
+    context,
+    getPlugin,
+    endpoints
+  };
+}
+
+// src/plugin/create-endpoint.ts
+function createEndpoint(path, options, handler) {
+  return {
+    path,
+    method: options.method,
+    status: options.status,
+    handler
+  };
+}
+
+// src/plugin/define-plugin.ts
+function definePlugin(plugin) {
+  return plugin;
+}
+
+// src/dimah-s3.ts
+function dimahS3(config) {
+  const {
+    config: resolved,
+    context,
+    getPlugin,
+    endpoints
+  } = applyPlugins(config);
+  const basePath = resolved.basePath ?? S3_API_BASE_PATH;
+  return {
+    handler: createHandler(resolved, basePath, endpoints),
+    api: createServerApi(resolved),
+    context,
+    getPlugin,
+    ...context
+  };
+}
+
+export { FEATURE_HOOK_KEYS, RESERVED_PLUGIN_IDS, applyPlugins, chainHooks, createEndpoint, definePlugin, dimahS3, errors, resolveObjectAcl };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map