@dimah-s3/server 0.7.4 → 0.8.0

package/dist/plugins.js

@@ -0,0 +1,984 @@
+import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, buildContentDisposition } from '@dimah-s3/core';
+import { HeadObjectCommand, DeleteObjectCommand, GetObjectCommand, AbortMultipartUploadCommand, ListPartsCommand, CompleteMultipartUploadCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand, GetObjectAclCommand } from '@aws-sdk/client-s3';
+import { createMiddleware, createEndpoint } from 'better-call';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+
+// src/plugin/apply-plugins.ts
+
+// src/helpers/is-aws-not-found.ts
+function isAwsNotFound(err) {
+  const e = err;
+  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
+}
+var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
+async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const result = await s3.send(
+      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
+      { abortSignal: controller.signal }
+    );
+    const isPublic = result.Grants?.some(
+      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+    );
+    return isPublic ? "public-read" : "private";
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+var errors = {
+  notFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.NOT_FOUND),
+  unauthorized: () => DimahS3Error.from("UNAUTHORIZED", S3_ERROR_CODES.UNAUTHORIZED),
+  forbidden: () => DimahS3Error.from("FORBIDDEN", S3_ERROR_CODES.FORBIDDEN),
+  conflict: () => DimahS3Error.from("CONFLICT", S3_ERROR_CODES.CONFLICT),
+  internalError: () => DimahS3Error.from("INTERNAL_SERVER_ERROR", S3_ERROR_CODES.INTERNAL_ERROR),
+  objectNotFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.OBJECT_NOT_FOUND),
+  featureDisabled: (feature) => DimahS3Error.from("NOT_FOUND", {
+    code: S3_ERROR_CODES.FEATURE_DISABLED.code,
+    message: S3_ERROR_CODES.FEATURE_DISABLED.message.replaceAll(
+      "{feature}",
+      feature
+    ),
+    params: { feature }
+  }),
+  invalidKey: () => DimahS3Error.from("BAD_REQUEST", S3_ERROR_CODES.INVALID_KEY),
+  invalidBucket: (bucket) => DimahS3Error.from("FORBIDDEN", {
+    code: S3_ERROR_CODES.INVALID_BUCKET.code,
+    message: S3_ERROR_CODES.INVALID_BUCKET.message,
+    params: { bucket }
+  }),
+  s3NetworkError: (code) => DimahS3Error.from("BAD_GATEWAY", {
+    code: S3_ERROR_CODES.S3_NETWORK_ERROR.code,
+    message: S3_ERROR_CODES.S3_NETWORK_ERROR.message.replaceAll(
+      "{code}",
+      code
+    ),
+    params: { code }
+  }),
+  fileSizeRequiredUpload: () => DimahS3Error.from("BAD_REQUEST", S3_ERROR_CODES.FILE_SIZE_REQUIRED_UPLOAD),
+  fileSizeRequiredMultipart: () => DimahS3Error.from(
+    "BAD_REQUEST",
+    S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART
+  ),
+  validationError: (message) => DimahS3Error.from("BAD_REQUEST", {
+    code: S3_ERROR_CODES.VALIDATION_ERROR.code,
+    message
+  })
+};
+
+// src/internal-helpers.ts
+async function runHook(hook, context) {
+  if (!hook) return;
+  try {
+    await hook(context);
+  } catch (err) {
+    if (isAPIError(err)) throw err;
+    if (err instanceof Error && err.message.trim()) {
+      throw new DimahS3Error("FORBIDDEN", {
+        message: err.message,
+        cause: err
+      });
+    }
+    throw errors.forbidden();
+  }
+}
+async function runLifecycleHook(hook, context) {
+  if (!hook) return;
+  try {
+    await hook(context);
+  } catch (err) {
+    if (isAPIError(err)) throw err;
+    console.error("[S3 API] lifecycle hook failed", err);
+    throw errors.internalError();
+  }
+}
+function normalizeExpiresIn(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 600;
+}
+function requestFromHeaders(headers) {
+  return new Request("http://dimah-s3.local", { headers });
+}
+
+// src/helpers/resolve-target.ts
+function assertSafeObjectKey(key) {
+  const trimmed = key.replace(/^\/+/u, "").replace(/\/+$/u, "");
+  if (!trimmed) {
+    throw errors.invalidKey();
+  }
+  if (trimmed.includes("\\") || trimmed.includes("\0")) {
+    throw errors.invalidKey();
+  }
+  const parts = trimmed.split("/");
+  if (parts.some((part) => part === "" || part === "." || part === "..")) {
+    throw errors.invalidKey();
+  }
+  return parts.join("/");
+}
+function applyPrefix(prefix, key) {
+  const p = assertSafeObjectKey(prefix);
+  const k = assertSafeObjectKey(key);
+  if (k === p || k.startsWith(`${p}/`)) return k;
+  return `${p}/${k}`;
+}
+async function resolveObjectKey(policy, context) {
+  if (policy?.resolveKey) {
+    return assertSafeObjectKey(await policy.resolveKey(context));
+  }
+  const prefix = typeof policy?.prefix === "function" ? await policy.prefix(context) : policy?.prefix;
+  if (prefix) {
+    return applyPrefix(prefix, context.proposedKey);
+  }
+  return assertSafeObjectKey(context.proposedKey);
+}
+function resolveBucket(config, requested) {
+  if (!requested) return config.bucket;
+  if (config.allowClientBucket) return requested;
+  if (config.buckets?.length) {
+    if (config.buckets.includes(requested)) return requested;
+    throw errors.invalidBucket(requested);
+  }
+  return config.bucket;
+}
+async function resolveRequestTarget(config, policy, input) {
+  const bucket = resolveBucket(config, input.bucket);
+  const key = await resolveObjectKey(policy, {
+    request: input.request,
+    proposedKey: input.key,
+    fileName: input.fileName,
+    contentType: input.contentType,
+    bucket
+  });
+  return { key, bucket };
+}
+function normalizeFeature(value) {
+  if (value === void 0) return void 0;
+  if (value === false) return { enabled: false };
+  if (value === true) return { enabled: true };
+  return { ...value, enabled: value.enabled ?? true };
+}
+function isFeatureEnabled(config, feature) {
+  return config[feature]?.enabled === true;
+}
+function applyMultipartDefault(config, multipartInput) {
+  let next = config;
+  if (multipartInput === void 0 && config.upload?.enabled) {
+    next = {
+      ...config,
+      multipart: { ...config.multipart, enabled: true }
+    };
+  }
+  if (next.multipart && next.upload) {
+    next = {
+      ...next,
+      multipart: {
+        ...next.multipart,
+        prefix: next.multipart.prefix ?? next.upload.prefix,
+        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey
+      }
+    };
+  }
+  return next;
+}
+function normalizeFeatures(config) {
+  return {
+    upload: normalizeFeature(config.upload),
+    download: normalizeFeature(config.download),
+    delete: normalizeFeature(config.delete),
+    multipart: normalizeFeature(config.multipart)
+  };
+}
+
+// src/api/assert-feature-enabled.ts
+function assertFeatureEnabled(config, feature) {
+  if (!isFeatureEnabled(config, feature)) {
+    throw errors.featureDisabled(feature);
+  }
+}
+var s3ContextMiddleware = createMiddleware(async (ctx) => {
+  const injected = ctx.context;
+  if (!injected?.config) {
+    throw new Error(
+      "createS3Endpoint requires dimahS3 router context. Call endpoints through dimahS3().api or the HTTP handler."
+    );
+  }
+  const request = ctx.request ?? injected.request ?? requestFromHeaders(ctx.headers);
+  await runHook(injected.config.guard, { request });
+  return {
+    config: injected.config,
+    request
+  };
+});
+var createS3Middleware = createMiddleware.create({
+  use: [s3ContextMiddleware]
+});
+
+// src/api/create-s3-endpoint.ts
+var createEndpointWithContext = createEndpoint.create({
+  use: [s3ContextMiddleware]
+});
+function withS3Validation(options) {
+  return {
+    ...options,
+    onValidationError: options.onValidationError ?? (({ message }) => {
+      throw errors.validationError(message);
+    })
+  };
+}
+var createS3Endpoint = ((pathOrOptions, optionsOrHandler, maybeHandler) => {
+  if (typeof pathOrOptions === "string") {
+    return createEndpointWithContext(
+      pathOrOptions,
+      withS3Validation(optionsOrHandler),
+      maybeHandler
+    );
+  }
+  return createEndpointWithContext(
+    withS3Validation(pathOrOptions),
+    optionsOrHandler
+  );
+});
+
+// src/api/routes/confirm.ts
+async function handleConfirm(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.upload, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  await runHook(config.upload?.confirmGuard, {
+    request,
+    key,
+    bucket
+  });
+  const head = await config.client.send(
+    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  );
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
+  const fileName = parseFileName(head.ContentDisposition);
+  const context = {
+    request,
+    key,
+    bucket,
+    contentType: head.ContentType,
+    contentLength: head.ContentLength ?? 0,
+    eTag: head.ETag?.replace(/"/g, ""),
+    metadata: head.Metadata,
+    acl,
+    fileName,
+    versionId: head.VersionId,
+    lastModified: head.LastModified?.toISOString()
+  };
+  await runLifecycleHook(config.upload?.onConfirmed, context);
+  return {
+    key,
+    bucket,
+    contentType: context.contentType,
+    contentLength: context.contentLength,
+    eTag: context.eTag,
+    metadata: context.metadata ?? {},
+    acl,
+    fileName,
+    versionId: context.versionId,
+    lastModified: context.lastModified
+  };
+}
+var confirm = createS3Endpoint(
+  S3_API_ROUTES.uploadConfirm,
+  { method: "POST", body: confirmBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "upload");
+    return handleConfirm(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleDelete(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.delete, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  await runHook(config.delete?.guard, {
+    request,
+    key,
+    bucket
+  });
+  try {
+    await config.client.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
+  } catch (err) {
+    if (isAwsNotFound(err)) {
+      throw errors.objectNotFound();
+    }
+    throw err;
+  }
+  await config.client.send(
+    new DeleteObjectCommand({ Bucket: bucket, Key: key })
+  );
+  await runLifecycleHook(config.delete?.onDeleted, { request, key, bucket });
+  return { success: true, bucket, key };
+}
+var deleteObject = createS3Endpoint(
+  S3_API_ROUTES.delete,
+  { method: "DELETE", query: deleteQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "delete");
+    return handleDelete(ctx.context.config, ctx.query, ctx.context.request);
+  }
+);
+async function handleDownload(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.download, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName
+  });
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const fileName = input.fileName;
+  await runHook(config.download?.guard, {
+    request,
+    key,
+    bucket,
+    fileName
+  });
+  try {
+    await config.client.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
+  } catch (err) {
+    if (isAwsNotFound(err)) {
+      throw errors.objectNotFound();
+    }
+    throw err;
+  }
+  const url = await getSignedUrl(
+    config.client,
+    new GetObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      ResponseContentDisposition: fileName ? buildContentDisposition(fileName) : "attachment"
+    }),
+    { expiresIn }
+  );
+  await runLifecycleHook(config.download?.onPresigned, {
+    request,
+    key,
+    bucket,
+    fileName,
+    url,
+    expiresIn
+  });
+  return { bucket, key, url, expiresIn };
+}
+var download = createS3Endpoint(
+  S3_API_ROUTES.download,
+  { method: "GET", query: downloadQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "download");
+    return handleDownload(ctx.context.config, ctx.query, ctx.context.request);
+  }
+);
+async function handleAbort(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  await runHook(config.multipart?.abortGuard, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  await config.client.send(
+    new AbortMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId
+    })
+  );
+  await runLifecycleHook(config.multipart?.onAbort, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  return { bucket, key, uploadId, aborted: true };
+}
+var multipartAbort = createS3Endpoint(
+  S3_API_ROUTES.multipartAbort,
+  { method: "POST", body: multipartAbortBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleAbort(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleComplete(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  const parts = input.parts.map(({ partNumber }) => partNumber).sort((a, b) => a - b);
+  const partRefs = parts.map((partNumber) => ({ partNumber }));
+  await runHook(config.multipart?.completeGuard, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    parts: partRefs
+  });
+  const listed = await config.client.send(
+    new ListPartsCommand({ Bucket: bucket, Key: key, UploadId: uploadId })
+  );
+  const listedParts = listed.Parts ?? [];
+  const completeParts = parts.map((partNumber) => {
+    const found = listedParts.find((p) => p.PartNumber === partNumber);
+    return { PartNumber: partNumber, ETag: found?.ETag ?? "" };
+  });
+  const completeResult = await config.client.send(
+    new CompleteMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      MultipartUpload: { Parts: completeParts }
+    })
+  );
+  let head = await config.client.send(
+    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  );
+  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
+    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
+    head = await config.client.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
+  }
+  const contentLength = head.ContentLength ?? 0;
+  const contentType = head.ContentType;
+  const eTag = (head.ETag ?? completeResult.ETag ?? "").replace(/"/g, "");
+  const metadata = head.Metadata ?? {};
+  const versionId = head.VersionId;
+  const lastModified = head.LastModified?.toISOString();
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
+  const fileName = parseFileName(head.ContentDisposition);
+  await runLifecycleHook(config.multipart?.onComplete, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    contentLength,
+    contentType,
+    eTag,
+    metadata,
+    acl,
+    fileName,
+    versionId,
+    lastModified
+  });
+  return {
+    bucket,
+    key,
+    uploadId,
+    contentLength,
+    contentType,
+    eTag,
+    metadata,
+    acl,
+    fileName,
+    versionId,
+    lastModified
+  };
+}
+var multipartComplete = createS3Endpoint(
+  S3_API_ROUTES.multipartComplete,
+  { method: "POST", body: multipartCompleteBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleComplete(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleMultipartInit(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName,
+    contentType: input.contentType
+  });
+  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : void 0;
+  if (config.multipart?.requireFileSize && fileSize === void 0) {
+    throw errors.fileSizeRequiredMultipart();
+  }
+  await runHook(config.multipart?.initGuard, {
+    request,
+    key,
+    bucket,
+    fileSize
+  });
+  const { UploadId } = await config.client.send(
+    new CreateMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      ContentType: input.contentType,
+      ContentDisposition: input.fileName ? buildContentDisposition(input.fileName) : void 0,
+      Metadata: input.metadata,
+      ACL: acl
+    })
+  );
+  await runLifecycleHook(config.multipart?.onInit, {
+    request,
+    key,
+    bucket,
+    uploadId: UploadId,
+    contentType: input.contentType,
+    fileSize,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
+  });
+  return { bucket, key, uploadId: UploadId };
+}
+var multipartInit = createS3Endpoint(
+  S3_API_ROUTES.multipartInit,
+  { method: "POST", body: multipartInitBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    ctx.setStatus(201);
+    return handleMultipartInit(
+      ctx.context.config,
+      ctx.body,
+      ctx.context.request
+    );
+  }
+);
+async function handleListParts(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  await runHook(config.multipart?.listGuard, {
+    request,
+    key,
+    bucket,
+    uploadId
+  });
+  const response = await config.client.send(
+    new ListPartsCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId
+    })
+  );
+  const parts = (response.Parts ?? []).map((p) => ({
+    partNumber: p.PartNumber ?? 0,
+    size: p.Size ?? 0,
+    eTag: (p.ETag ?? "").replace(/"/g, "")
+  }));
+  await runLifecycleHook(config.multipart?.onList, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    parts
+  });
+  return { parts };
+}
+var multipartListParts = createS3Endpoint(
+  S3_API_ROUTES.multipartListParts,
+  { method: "GET", query: multipartListPartsQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleListParts(ctx.context.config, ctx.query, ctx.context.request);
+  }
+);
+async function handleSignPart(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  const partNumber = input.partNumber;
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const partSize = typeof input.partSize === "number" && input.partSize > 0 ? Math.floor(input.partSize) : null;
+  await runHook(config.multipart?.partGuard, {
+    request,
+    key,
+    bucket,
+    uploadId,
+    partNumber,
+    partSize: partSize ?? void 0
+  });
+  const presignedUrl = await getSignedUrl(
+    config.client,
+    new UploadPartCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      PartNumber: partNumber,
+      ...partSize !== null ? { ContentLength: partSize } : {}
+    }),
+    {
+      expiresIn,
+      ...partSize !== null ? { signableHeaders: /* @__PURE__ */ new Set(["content-length"]) } : {}
+    }
+  );
+  return {
+    presignedUrl,
+    partNumber,
+    uploadId,
+    bucket,
+    expiresIn,
+    ...partSize !== null ? { partSize } : {}
+  };
+}
+var multipartPart = createS3Endpoint(
+  S3_API_ROUTES.multipartPart,
+  { method: "POST", body: multipartSignPartBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleSignPart(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleUpload(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.upload, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName,
+    contentType: input.contentType
+  });
+  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const contentType = input.contentType ?? "application/octet-stream";
+  const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : null;
+  await runHook(config.upload?.guard, {
+    request,
+    key,
+    bucket,
+    contentType: input.contentType,
+    fileSize: fileSize ?? void 0,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
+  });
+  const method = config.upload?.method ?? "POST";
+  if (method === "PUT" && config.upload?.requireFileSize && fileSize === null) {
+    throw errors.fileSizeRequiredUpload();
+  }
+  if (method === "PUT") {
+    const putHeaders = {
+      "Content-Type": contentType
+    };
+    if (input.fileName) {
+      putHeaders["Content-Disposition"] = buildContentDisposition(
+        input.fileName
+      );
+    }
+    const url2 = await getSignedUrl(
+      config.client,
+      new PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        ContentType: contentType,
+        ACL: acl,
+        ...input.fileName ? { ContentDisposition: buildContentDisposition(input.fileName) } : {},
+        ...fileSize !== null ? { ContentLength: fileSize } : {}
+      }),
+      {
+        expiresIn,
+        ...fileSize !== null ? { signableHeaders: /* @__PURE__ */ new Set(["content-length"]) } : {}
+      }
+    );
+    await runLifecycleHook(config.upload?.onPresigned, {
+      request,
+      key,
+      bucket,
+      contentType: input.contentType,
+      fileSize: fileSize ?? void 0,
+      metadata: input.metadata,
+      acl,
+      fileName: input.fileName,
+      url: url2,
+      expiresIn
+    });
+    return {
+      bucket,
+      key,
+      url: url2,
+      headers: putHeaders,
+      expiresIn,
+      method: "PUT"
+    };
+  }
+  const fields = { acl, "Content-Type": contentType };
+  if (input.fileName) {
+    fields["Content-Disposition"] = buildContentDisposition(input.fileName);
+  }
+  if (input.metadata) {
+    for (const [k, v] of Object.entries(input.metadata)) {
+      fields[`x-amz-meta-${k}`] = v;
+    }
+  }
+  const rangeMin = fileSize ?? 1;
+  const rangeMax = fileSize ?? void 0;
+  const { url, fields: signedFields } = await createPresignedPost(
+    config.client,
+    {
+      Bucket: bucket,
+      Key: key,
+      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
+      Fields: fields,
+      Expires: expiresIn
+    }
+  );
+  await runLifecycleHook(config.upload?.onPresigned, {
+    request,
+    key,
+    bucket,
+    contentType: input.contentType,
+    fileSize: fileSize ?? void 0,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName,
+    url,
+    expiresIn
+  });
+  return {
+    bucket,
+    key,
+    url,
+    fields: signedFields,
+    expiresIn,
+    method: "POST"
+  };
+}
+var upload = createS3Endpoint(
+  S3_API_ROUTES.upload,
+  { method: "POST", body: uploadBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "upload");
+    return handleUpload(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+
+// src/api/routes/index.ts
+var coreEndpoints = {
+  upload,
+  confirm,
+  download,
+  delete: deleteObject,
+  multipartInit,
+  multipartPart,
+  multipartListParts,
+  multipartComplete,
+  multipartAbort
+};
+var CORE_ENDPOINT_NAMES = Object.keys(
+  coreEndpoints
+);
+
+// src/plugin/chain-hooks.ts
+function chainHooks(...hooks) {
+  return async (context) => {
+    for (const hook of hooks) {
+      if (hook) await hook(context);
+    }
+  };
+}
+
+// src/plugin/hook-registry.ts
+var FEATURE_HOOK_KEYS = {
+  upload: ["guard", "onPresigned", "confirmGuard", "onConfirmed"],
+  download: ["guard", "onPresigned"],
+  delete: ["guard", "onDeleted"],
+  multipart: [
+    "initGuard",
+    "partGuard",
+    "completeGuard",
+    "abortGuard",
+    "listGuard",
+    "onInit",
+    "onComplete",
+    "onAbort",
+    "onList"
+  ]
+};
+
+// src/plugin/types.ts
+var RESERVED_PLUGIN_IDS = [
+  "handler",
+  "api",
+  "context",
+  "getPlugin",
+  "$ERROR_CODES",
+  "$Infer"
+];
+
+// src/plugin/apply-plugins.ts
+function mergeHookField(pluginHooks, userHook) {
+  const present = [...pluginHooks, userHook].filter(
+    (h) => h != null
+  );
+  if (present.length === 0) return void 0;
+  if (present.length === 1) return present[0];
+  return chainHooks(...present);
+}
+function mergeFeatureHooks(feature, keys, plugins, userFeature) {
+  if (!userFeature && plugins.every((p) => !p.hooks?.[feature])) {
+    return userFeature;
+  }
+  const merged = { ...userFeature ?? {} };
+  for (const key of keys) {
+    const fromPlugins = plugins.map(
+      (p) => p.hooks?.[feature]?.[key]
+    );
+    const userHook = userFeature?.[key];
+    const next = mergeHookField(fromPlugins, userHook);
+    if (next !== void 0) {
+      merged[key] = next;
+    }
+  }
+  return merged;
+}
+function applyPlugins(config) {
+  const plugins = config.plugins ?? [];
+  const seen = /* @__PURE__ */ new Set();
+  const byId = /* @__PURE__ */ new Map();
+  const context = {};
+  const getPlugin = (id) => byId.get(id);
+  for (const plugin of plugins) {
+    if (RESERVED_PLUGIN_IDS.includes(plugin.id)) {
+      throw new Error(
+        `Plugin id "${plugin.id}" is reserved on the dimahS3 instance. Choose a different id.`
+      );
+    }
+    if (seen.has(plugin.id)) {
+      throw new Error(
+        `Duplicate dimah-s3 plugin id "${plugin.id}". Each plugin id must be unique.`
+      );
+    }
+    seen.add(plugin.id);
+    byId.set(plugin.id, plugin);
+  }
+  for (const plugin of plugins) {
+    for (const dep of plugin.dependsOn ?? []) {
+      if (!seen.has(dep)) {
+        throw new Error(
+          `Plugin "${plugin.id}" depends on "${dep}", which is not registered.`
+        );
+      }
+    }
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  function visit(id, stack) {
+    if (visited.has(id)) return;
+    if (visiting.has(id)) {
+      throw new Error(
+        `Circular plugin dependency detected: ${[...stack, id].join(" -> ")}.`
+      );
+    }
+    visiting.add(id);
+    const plugin = byId.get(id);
+    for (const dep of plugin?.dependsOn ?? []) {
+      visit(dep, [...stack, id]);
+    }
+    visiting.delete(id);
+    visited.add(id);
+  }
+  for (const plugin of plugins) {
+    visit(plugin.id, []);
+  }
+  for (const plugin of plugins) {
+    if (plugin.context !== void 0) {
+      context[plugin.id] = plugin.context;
+    }
+  }
+  const reservedRoutePaths = new Set(Object.values(S3_API_ROUTES));
+  const reservedNames = /* @__PURE__ */ new Set([...CORE_ENDPOINT_NAMES, "multipart"]);
+  const seenEndpointKeys = /* @__PURE__ */ new Set();
+  const endpoints = {};
+  for (const plugin of plugins) {
+    for (const [name, endpoint] of Object.entries(plugin.endpoints ?? {})) {
+      if (reservedNames.has(name) || name in endpoints) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" collides with an existing endpoint.`
+        );
+      }
+      const path = endpoint.path;
+      if (typeof path !== "string" || !path.startsWith("/")) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" path must start with "/".`
+        );
+      }
+      if (reservedRoutePaths.has(path)) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" collides with a core route.`
+        );
+      }
+      const methods = Array.isArray(endpoint.options.method) ? endpoint.options.method : [endpoint.options.method];
+      for (const method of methods) {
+        const routeKey = `${method} ${path}`;
+        if (seenEndpointKeys.has(routeKey)) {
+          throw new Error(`Duplicate plugin endpoint ${routeKey}.`);
+        }
+        seenEndpointKeys.add(routeKey);
+      }
+      endpoints[name] = endpoint;
+    }
+  }
+  const { plugins: _omit, ...rest } = config;
+  for (const plugin of plugins) {
+    plugin.init?.({ config: rest, getPlugin });
+  }
+  const features = normalizeFeatures(rest);
+  const {
+    upload: _upload,
+    download: _download,
+    delete: _delete,
+    multipart: _multipart,
+    ...base
+  } = rest;
+  const guard = mergeHookField(
+    plugins.map((p) => p.hooks?.guard),
+    rest.guard
+  );
+  const merged = {
+    ...base,
+    ...features,
+    ...guard !== void 0 ? { guard } : {}
+  };
+  for (const feature of Object.keys(FEATURE_HOOK_KEYS)) {
+    merged[feature] = mergeFeatureHooks(
+      feature,
+      FEATURE_HOOK_KEYS[feature],
+      plugins,
+      merged[feature]
+    );
+  }
+  return {
+    config: applyMultipartDefault(merged, rest.multipart),
+    context,
+    getPlugin,
+    endpoints
+  };
+}
+
+// src/plugin/define-plugin.ts
+function definePlugin(plugin) {
+  return plugin;
+}
+
+export { CORE_ENDPOINT_NAMES, FEATURE_HOOK_KEYS, RESERVED_PLUGIN_IDS, applyPlugins, chainHooks, createS3Endpoint, createS3Middleware, definePlugin };
+//# sourceMappingURL=plugins.js.map
+//# sourceMappingURL=plugins.js.map