@lacrous/omnicloud 0.2.2 → 0.2.4

package/server/index.js

@@ -0,0 +1,4912 @@
+import { createRequire as __omnicloudCreateRequire } from "node:module";
+const require = __omnicloudCreateRequire(import.meta.url);
+
+// ../shared/src/mime.ts
+var MIME_BY_EXTENSION = {
+  // Documents
+  pdf: "application/pdf",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  odt: "application/vnd.oasis.opendocument.text",
+  ods: "application/vnd.oasis.opendocument.spreadsheet",
+  txt: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  rtf: "application/rtf",
+  html: "text/html",
+  htm: "text/html",
+  css: "text/css",
+  xml: "application/xml",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  json: "application/json",
+  epub: "application/epub+zip",
+  // Images
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  tiff: "image/tiff",
+  tif: "image/tiff",
+  avif: "image/avif",
+  heic: "image/heic",
+  // Audio
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  flac: "audio/flac",
+  m4a: "audio/mp4",
+  aac: "audio/aac",
+  opus: "audio/opus",
+  // Video
+  mp4: "video/mp4",
+  mkv: "video/x-matroska",
+  webm: "video/webm",
+  avi: "video/x-msvideo",
+  mov: "video/quicktime",
+  wmv: "video/x-ms-wmv",
+  flv: "video/x-flv",
+  // Archives
+  zip: "application/zip",
+  rar: "application/vnd.rar",
+  "7z": "application/x-7z-compressed",
+  tar: "application/x-tar",
+  gz: "application/gzip",
+  bz2: "application/x-bzip2",
+  xz: "application/x-xz",
+  // Other
+  apk: "application/vnd.android.package-archive",
+  exe: "application/x-msdownload",
+  dmg: "application/x-apple-diskimage",
+  iso: "application/x-iso9660-image",
+  bin: "application/octet-stream"
+};
+var DEFAULT_MIME_TYPE = "application/octet-stream";
+function fileExtension(filename) {
+  const base = filename.split(/[/\\]/).pop() ?? "";
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0 || dot === base.length - 1) return "";
+  return base.slice(dot + 1).toLowerCase();
+}
+function mimeFromFilename(filename) {
+  return MIME_BY_EXTENSION[fileExtension(filename)] ?? DEFAULT_MIME_TYPE;
+}
+var PREFIXED_CATEGORIES = [
+  ["image/", "image"],
+  ["video/", "video"],
+  ["audio/", "audio"],
+  ["application/pdf", "pdf"],
+  ["application/zip", "archive"],
+  ["application/x-tar", "archive"],
+  ["application/gzip", "archive"],
+  ["application/x-7z-compressed", "archive"],
+  ["application/vnd.rar", "archive"],
+  ["application/x-bzip2", "archive"],
+  ["application/x-xz", "archive"],
+  ["text/", "text"],
+  ["application/json", "text"],
+  ["application/xml", "text"],
+  ["application/yaml", "text"],
+  ["application/javascript", "text"],
+  ["text/markdown", "text"]
+];
+var OFFICE_MIMES = /* @__PURE__ */ new Set([
+  "application/msword",
+  "application/vnd.ms-excel",
+  "application/vnd.ms-powerpoint",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  "application/vnd.oasis.opendocument.text",
+  "application/vnd.oasis.opendocument.spreadsheet",
+  "application/rtf",
+  "application/epub+zip"
+]);
+function fileCategory(mimeType) {
+  for (const [prefix, category] of PREFIXED_CATEGORIES) {
+    if (mimeType.startsWith(prefix)) return category;
+  }
+  if (OFFICE_MIMES.has(mimeType)) return "document";
+  return "other";
+}
+var FILE_CATEGORIES = [
+  "image",
+  "video",
+  "audio",
+  "pdf",
+  "archive",
+  "document",
+  "text",
+  "other"
+];
+var CATEGORY_PREFIXES = {
+  image: ["image/"],
+  video: ["video/"],
+  audio: ["audio/"],
+  pdf: ["application/pdf"],
+  archive: [
+    "application/zip",
+    "application/x-tar",
+    "application/gzip",
+    "application/x-7z-compressed",
+    "application/vnd.rar",
+    "application/x-bzip2",
+    "application/x-xz"
+  ],
+  text: [
+    "text/",
+    "application/json",
+    "application/xml",
+    "application/yaml",
+    "application/javascript"
+  ],
+  document: [...OFFICE_MIMES],
+  other: []
+};
+function isFileCategory(value) {
+  return FILE_CATEGORIES.includes(value);
+}
+function mimeMatchersForType(value) {
+  const normalized = value.toLowerCase().trim();
+  if (!normalized) return null;
+  if (isFileCategory(normalized)) {
+    const prefixes = CATEGORY_PREFIXES[normalized];
+    return prefixes.length > 0 ? prefixes : null;
+  }
+  return [normalized];
+}
+
+// ../shared/src/query.ts
+var SORT_FIELDS = ["name", "size", "createdAt", "updatedAt", "type"];
+var SORT_ORDERS = ["asc", "desc"];
+var ITEM_STATUSES = ["active", "trashed", "all"];
+var DEFAULT_PAGE_SIZE = 50;
+var MAX_PAGE_SIZE = 200;
+var SIZE_UNITS = {
+  b: 1,
+  kb: 1024,
+  mb: 1024 ** 2,
+  gb: 1024 ** 3,
+  tb: 1024 ** 4
+};
+function parseSize(value) {
+  const match = /^\s*([0-9]+(?:\.[0-9]+)?)\s*([a-zA-Z]*)\s*$/.exec(value);
+  if (!match) return null;
+  const amount = Number(match[1]);
+  if (!Number.isFinite(amount) || amount < 0) return null;
+  const unit = (match[2] ?? "").toLowerCase() || "b";
+  const factor = SIZE_UNITS[unit];
+  if (factor === void 0) return null;
+  return Math.round(amount * factor);
+}
+function parseSizeComparison(value) {
+  const match = /^\s*(>=|<=|>|<|=)?\s*(.+)$/.exec(value);
+  if (!match) return null;
+  const operator = match[1] ?? "=";
+  const bytes = parseSize(match[2]);
+  if (bytes === null) return null;
+  switch (operator) {
+    case ">":
+      return { min: bytes + 1 };
+    case ">=":
+      return { min: bytes };
+    case "<":
+      return { max: bytes - 1 };
+    case "<=":
+      return { max: bytes };
+    default:
+      return { min: bytes, max: bytes };
+  }
+}
+function parseBoolean(value) {
+  const normalized = value.toLowerCase();
+  if (["true", "1", "yes", "y", "on"].includes(normalized)) return true;
+  if (["false", "0", "no", "n", "off"].includes(normalized)) return false;
+  return null;
+}
+function parseDate(value, endOfDay) {
+  const trimmed = value.trim();
+  if (/^\d{4}-\d{2}-\d{2}$/.test(trimmed)) {
+    const date2 = /* @__PURE__ */ new Date(`${trimmed}T${endOfDay ? "23:59:59.999" : "00:00:00.000"}Z`);
+    return Number.isNaN(date2.getTime()) ? null : date2;
+  }
+  const date = new Date(trimmed);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+function parseSearchQuery(input, base = {}) {
+  const query = { ...base };
+  const terms = [];
+  for (const rawToken of input.trim().split(/\s+/)) {
+    if (!rawToken) continue;
+    const separator = rawToken.indexOf(":");
+    if (separator <= 0) {
+      terms.push(rawToken);
+      continue;
+    }
+    const field = rawToken.slice(0, separator).toLowerCase();
+    const value = rawToken.slice(separator + 1);
+    if (!value) {
+      terms.push(rawToken);
+      continue;
+    }
+    switch (field) {
+      case "name":
+      case "filename":
+        terms.push(value);
+        break;
+      case "type":
+        query.type = value.toLowerCase();
+        break;
+      case "ext":
+      case "extension":
+        query.ext = value.replace(/^\./, "").toLowerCase();
+        break;
+      case "size": {
+        const comparison = parseSizeComparison(value);
+        if (!comparison) {
+          terms.push(rawToken);
+          break;
+        }
+        if (comparison.min !== void 0) query.minSize = comparison.min;
+        if (comparison.max !== void 0) query.maxSize = comparison.max;
+        break;
+      }
+      case "folder":
+        query.folderName = value;
+        break;
+      case "starred": {
+        const parsed = parseBoolean(value);
+        if (parsed === null) terms.push(rawToken);
+        else query.starred = parsed;
+        break;
+      }
+      case "trashed":
+      case "deleted": {
+        const parsed = parseBoolean(value);
+        if (parsed === null) terms.push(rawToken);
+        else query.status = parsed ? "trashed" : "active";
+        break;
+      }
+      case "after":
+      case "since": {
+        const date = parseDate(value, false);
+        if (!date) terms.push(rawToken);
+        else query.from = date.toISOString();
+        break;
+      }
+      case "before": {
+        const date = parseDate(value, true);
+        if (!date) terms.push(rawToken);
+        else query.to = date.toISOString();
+        break;
+      }
+      default:
+        terms.push(rawToken);
+        break;
+    }
+  }
+  const freeText = terms.join(" ").trim();
+  if (freeText) query.q = freeText;
+  return { query, freeText };
+}
+function normalizePage(value) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1) return 1;
+  return parsed;
+}
+function normalizeLimit(value) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1) return DEFAULT_PAGE_SIZE;
+  return Math.min(parsed, MAX_PAGE_SIZE);
+}
+function normalizeSort(value) {
+  if (typeof value !== "string") return void 0;
+  return SORT_FIELDS.includes(value) ? value : void 0;
+}
+function normalizeOrder(value) {
+  if (typeof value !== "string") return void 0;
+  return SORT_ORDERS.includes(value) ? value : void 0;
+}
+function paginationMeta(page, limit, total) {
+  return { page, limit, total, hasMore: page * limit < total };
+}
+
+// ../shared/src/index.ts
+var BATCH_FILE_OPERATIONS = [
+  "trash",
+  "restore",
+  "delete",
+  "star",
+  "unstar",
+  "move"
+];
+var BATCH_FOLDER_OPERATIONS = [
+  "trash",
+  "restore",
+  "delete",
+  "star",
+  "unstar",
+  "move"
+];
+var ERROR_CODES = {
+  AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_INVALID: "AUTH_INVALID",
+  PERMISSION_DENIED: "PERMISSION_DENIED",
+  INVALID_REQUEST: "INVALID_REQUEST",
+  NOT_FOUND: "NOT_FOUND",
+  FILE_NOT_FOUND: "FILE_NOT_FOUND",
+  FOLDER_NOT_FOUND: "FOLDER_NOT_FOUND",
+  CONFLICT: "CONFLICT",
+  PAYLOAD_TOO_LARGE: "PAYLOAD_TOO_LARGE",
+  RATE_LIMITED: "RATE_LIMITED",
+  STORAGE_NOT_INITIALIZED: "STORAGE_NOT_INITIALIZED",
+  STORAGE_UNAVAILABLE: "STORAGE_UNAVAILABLE",
+  TELEGRAM_AUTH_REQUIRED: "TELEGRAM_AUTH_REQUIRED",
+  TELEGRAM_CONNECTION_FAILED: "TELEGRAM_CONNECTION_FAILED",
+  TELEGRAM_FILE_NOT_FOUND: "TELEGRAM_FILE_NOT_FOUND",
+  UPLOAD_FAILED: "UPLOAD_FAILED",
+  DOWNLOAD_FAILED: "DOWNLOAD_FAILED",
+  INTEGRITY_CHECK_FAILED: "INTEGRITY_CHECK_FAILED",
+  INTERNAL: "INTERNAL_ERROR"
+};
+var SESSION_COOKIE = "omnicloud_session";
+var REQUEST_ID_HEADER = "x-request-id";
+
+// ../core/src/errors.ts
+var DomainError = class extends Error {
+  code;
+  status;
+  details;
+  /** Whether repeating the same operation may succeed. Defaults to false. */
+  retryable = false;
+  /** Server-requested delay before a retry, in seconds, when the provider gave one. */
+  retryAfterSeconds;
+  constructor(code, status, message, details, retry) {
+    super(message);
+    this.name = new.target.name;
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    this.retryable = retry?.retryable ?? false;
+    this.retryAfterSeconds = retry?.retryAfterSeconds;
+  }
+};
+var ValidationError = class extends DomainError {
+  constructor(message, details) {
+    super(ERROR_CODES.INVALID_REQUEST, 400, message, details);
+  }
+};
+var UnauthorizedError = class extends DomainError {
+  constructor(message = "Authentication required") {
+    super(ERROR_CODES.AUTH_REQUIRED, 401, message);
+  }
+};
+var AuthInvalidError = class extends DomainError {
+  constructor(message = "Your session is no longer valid \u2014 please sign in again") {
+    super(ERROR_CODES.AUTH_INVALID, 401, message);
+  }
+};
+var ForbiddenError = class extends DomainError {
+  constructor(message = "You do not have access to this resource") {
+    super(ERROR_CODES.PERMISSION_DENIED, 403, message);
+  }
+};
+var NotFoundError = class extends DomainError {
+  constructor(message = "Resource not found", resource) {
+    super(
+      resource === "file" ? ERROR_CODES.FILE_NOT_FOUND : resource === "folder" ? ERROR_CODES.FOLDER_NOT_FOUND : ERROR_CODES.NOT_FOUND,
+      404,
+      message
+    );
+  }
+};
+var ConflictError = class extends DomainError {
+  constructor(message) {
+    super(ERROR_CODES.CONFLICT, 409, message);
+  }
+};
+var PayloadTooLargeError = class extends DomainError {
+  constructor(message = "File is too large") {
+    super(ERROR_CODES.PAYLOAD_TOO_LARGE, 413, message);
+  }
+};
+var RateLimitedError = class extends DomainError {
+  constructor(message = "Too many requests, please retry later", options = {}) {
+    super(ERROR_CODES.RATE_LIMITED, 429, message, void 0, {
+      retryable: true,
+      retryAfterSeconds: options.retryAfterSeconds
+    });
+  }
+};
+var StorageNotInitializedError = class extends DomainError {
+  constructor() {
+    super(ERROR_CODES.STORAGE_NOT_INITIALIZED, 409, "Storage is not initialized for this account");
+  }
+};
+var TelegramAuthRequiredError = class extends DomainError {
+  constructor(message = "Your Telegram session has expired \u2014 please reconnect") {
+    super(ERROR_CODES.TELEGRAM_AUTH_REQUIRED, 401, message);
+  }
+};
+var TelegramConnectionError = class extends DomainError {
+  constructor(message = "Could not reach Telegram", details) {
+    super(ERROR_CODES.TELEGRAM_CONNECTION_FAILED, 502, message, details, { retryable: true });
+  }
+};
+var TelegramFileNotFoundError = class extends DomainError {
+  constructor(message = "The stored file is missing from Telegram") {
+    super(ERROR_CODES.TELEGRAM_FILE_NOT_FOUND, 404, message);
+  }
+};
+var UploadFailedError = class extends DomainError {
+  constructor(message = "Upload failed", details) {
+    super(ERROR_CODES.UPLOAD_FAILED, 502, message, details);
+  }
+};
+var IntegrityCheckError = class extends DomainError {
+  constructor(message = "Integrity check failed", details) {
+    super(ERROR_CODES.INTEGRITY_CHECK_FAILED, 502, message, details);
+  }
+};
+var OperationCancelledError = class extends DomainError {
+  constructor(message = "Operation cancelled") {
+    super(ERROR_CODES.INVALID_REQUEST, 499, message);
+  }
+};
+function mapProviderError(message, error) {
+  if (error instanceof DomainError) return error;
+  const detail = error instanceof Error ? error.message : String(error);
+  return new UploadFailedError(detail ? `${message}: ${detail}` : message, error);
+}
+
+// ../core/src/storage/engine.ts
+import { createHash as createHash2 } from "node:crypto";
+import { Readable, Transform } from "node:stream";
+
+// ../core/src/storage/retry.ts
+function isRetryableError(error) {
+  if (error instanceof OperationCancelledError) return false;
+  if (error instanceof DomainError) return error.retryable;
+  return false;
+}
+function retryDelayMs(error, attempt, baseDelayMs, random = Math.random) {
+  if (error instanceof DomainError && error.retryAfterSeconds !== void 0) {
+    return error.retryAfterSeconds * 1e3;
+  }
+  const ceiling = baseDelayMs * 2 ** (attempt - 1);
+  return Math.floor(random() * ceiling);
+}
+
+// ../core/src/utils/hash.ts
+import { createHash } from "node:crypto";
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+
+// ../core/src/storage/engine.ts
+var DEFAULT_RETRY_POLICY = { attempts: 3, baseDelayMs: 400 };
+function delay(ms, signal) {
+  return new Promise((resolve2, reject) => {
+    if (signal?.aborted) {
+      reject(new OperationCancelledError());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      reject(new OperationCancelledError());
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw new OperationCancelledError();
+}
+var StorageEngine = class {
+  constructor(provider, retryPolicy = DEFAULT_RETRY_POLICY) {
+    this.provider = provider;
+    this.retryPolicy = retryPolicy;
+  }
+  get providerName() {
+    return this.provider.name;
+  }
+  /**
+   * Uploads an object, computing its SHA-256 as it goes and reporting
+   * progress. Retries transient failures with exponential backoff.
+   */
+  async upload(input, control = {}) {
+    if (input.data) {
+      const sha2562 = sha256Hex(input.data);
+      const size2 = input.data.byteLength;
+      control.onProgress?.({ transferred: 0, total: size2, percent: 0 });
+      const stored2 = await this.withRetry(
+        () => this.provider.put(input, control),
+        control,
+        (error) => new UploadFailedError("Upload failed", error)
+      );
+      control.onProgress?.({ transferred: size2, total: size2, percent: 100 });
+      return { stored: stored2, sha256: sha2562, size: size2 };
+    }
+    const { path, size, sha256 } = input;
+    if (!path || size === void 0 || !sha256) {
+      throw new UploadFailedError("Upload input has neither data nor a complete spooled file");
+    }
+    control.onProgress?.({ transferred: 0, total: size, percent: 0 });
+    const stored = await this.withRetry(
+      () => this.provider.put(input, control),
+      control,
+      (error) => new UploadFailedError("Upload failed", error)
+    );
+    control.onProgress?.({ transferred: size, total: size, percent: 100 });
+    return { stored, sha256, size };
+  }
+  async download(ref, control = {}) {
+    return this.withRetry(
+      () => this.provider.get(ref, control),
+      control,
+      (error) => mapProviderError("Download failed", error)
+    );
+  }
+  /**
+   * Streams the object and verifies its SHA-256 against `expectedSha256`.
+   *
+   * The last chunk is held back until the digest of everything before it has
+   * been checked, so a corrupt object errors the stream before its final bytes
+   * are released. A consumer therefore never sees a complete-looking body that
+   * fails the checksum. Memory stays bounded to about two provider chunks.
+   */
+  async downloadStream(ref, expectedSha256, control = {}) {
+    const source = await this.withRetry(
+      () => this.provider.getStream(ref, control),
+      control,
+      (error) => mapProviderError("Download failed", error)
+    );
+    const hash = createHash2("sha256");
+    let held = null;
+    const gate = new Transform({
+      transform(chunk, _encoding, callback) {
+        hash.update(chunk);
+        if (held) this.push(held);
+        held = chunk;
+        callback();
+      },
+      flush(callback) {
+        if (hash.digest("hex") !== expectedSha256) {
+          callback(new IntegrityCheckError("Downloaded content does not match its checksum"));
+          return;
+        }
+        if (held) this.push(held);
+        callback();
+      }
+    });
+    source.once("error", (error) => gate.destroy(error));
+    source.pipe(gate);
+    return gate;
+  }
+  async remove(ref) {
+    await this.withRetry(
+      () => this.provider.delete(ref),
+      {},
+      (error) => mapProviderError("Delete failed", error)
+    );
+  }
+  async exists(ref) {
+    try {
+      return await this.provider.exists(ref);
+    } catch (error) {
+      throw mapProviderError("Storage lookup failed", error);
+    }
+  }
+  /** Read-only listing of stored objects, for reconciliation. Never modifies anything. */
+  async list(limit) {
+    try {
+      return await this.provider.listObjects(limit);
+    } catch (error) {
+      throw mapProviderError("Storage listing failed", error);
+    }
+  }
+  async stat(ref) {
+    try {
+      return await this.provider.stat(ref);
+    } catch (error) {
+      throw mapProviderError("Storage lookup failed", error);
+    }
+  }
+  async health() {
+    try {
+      return await this.provider.healthCheck();
+    } catch (error) {
+      return {
+        healthy: false,
+        latencyMs: null,
+        message: error instanceof Error ? error.message : "Storage health check failed",
+        targetTitle: null
+      };
+    }
+  }
+  async verifyIntegrity(data, expectedSha256) {
+    return sha256Hex(data) === expectedSha256;
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  async withRetry(operation, control, wrapError) {
+    const { attempts, baseDelayMs } = this.retryPolicy;
+    let lastError;
+    for (let attempt = 1; attempt <= Math.max(1, attempts); attempt += 1) {
+      throwIfAborted(control.signal);
+      try {
+        return await operation();
+      } catch (error) {
+        lastError = error;
+        if (attempt >= attempts || !isRetryableError(error)) break;
+        await delay(retryDelayMs(error, attempt, baseDelayMs), control.signal);
+      }
+    }
+    throw wrapError(lastError);
+  }
+};
+
+// ../core/src/services/query-resolver.ts
+async function resolveItemQuery(folders, userId, input) {
+  const query = {};
+  if (input.folderId !== void 0) query.folderId = input.folderId;
+  if (input.q && input.q.trim()) query.nameContains = input.q.trim();
+  if (input.ext) query.ext = input.ext.replace(/^\./, "").toLowerCase();
+  if (input.starred !== void 0) query.starred = input.starred;
+  if (input.minSize !== void 0) query.minSize = input.minSize;
+  if (input.maxSize !== void 0) query.maxSize = input.maxSize;
+  if (input.sort) query.sort = input.sort;
+  if (input.order) query.order = input.order;
+  switch (input.status) {
+    case "active":
+      query.trashed = false;
+      break;
+    case "trashed":
+      query.trashed = true;
+      break;
+    default:
+      query.trashed = void 0;
+      break;
+  }
+  if (input.type) {
+    const matchers = mimeMatchersForType(input.type);
+    if (matchers) query.mimeMatchers = matchers;
+  }
+  if (input.from) {
+    const from = new Date(input.from);
+    if (!Number.isNaN(from.getTime())) query.from = from;
+  }
+  if (input.to) {
+    const to = new Date(input.to);
+    if (!Number.isNaN(to.getTime())) query.to = to;
+  }
+  if (input.folderName) {
+    query.folderIds = await folders.findIdsByName(userId, input.folderName);
+  }
+  return query;
+}
+
+// ../core/src/services/auth-session-service.ts
+import { createHash as createHash3, randomBytes } from "node:crypto";
+var DEFAULT_SESSION_TTL_DAYS = 30;
+function hashToken(token) {
+  return createHash3("sha256").update(token, "utf8").digest("hex");
+}
+var AuthSessionService = class {
+  constructor(repo, options = {}) {
+    this.repo = repo;
+    this.ttlMs = (options.ttlDays ?? DEFAULT_SESSION_TTL_DAYS) * 24 * 60 * 60 * 1e3;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  ttlMs;
+  now;
+  async issue(userId, context = {}) {
+    const token = randomBytes(32).toString("base64url");
+    const session = await this.repo.create({
+      userId,
+      tokenHash: hashToken(token),
+      expiresAt: new Date(this.now().getTime() + this.ttlMs),
+      userAgent: truncate(context.userAgent ?? null, 256),
+      ip: context.ip ?? null
+    });
+    return { token, session };
+  }
+  /**
+   * Resolves a raw token to its active session. Returns null for an unknown,
+   * expired, or revoked token. Successful lookups refresh `lastUsedAt`.
+   */
+  async resolve(token) {
+    if (!token || token.length < 16 || token.length > 128) return null;
+    const session = await this.repo.findByTokenHash(hashToken(token));
+    if (!session) return null;
+    const now = this.now();
+    if (session.revokedAt !== null || session.expiresAt.getTime() <= now.getTime()) {
+      return null;
+    }
+    await this.repo.touch(session.id, now);
+    return session;
+  }
+  /** Revokes the session behind a token. Unknown tokens are a no-op. */
+  async revoke(token) {
+    if (!token) return;
+    const session = await this.repo.findByTokenHash(hashToken(token));
+    if (session && session.revokedAt === null) {
+      await this.repo.revoke(session.id, this.now());
+    }
+  }
+  /** Revokes every session for a user, for "sign out everywhere". */
+  async revokeAll(userId) {
+    return this.repo.revokeAllForUser(userId, this.now());
+  }
+  listActive(userId) {
+    return this.repo.listActiveForUser(userId, this.now());
+  }
+  /** Housekeeping: removes sessions that expired more than `graceDays` ago. */
+  async pruneExpired(graceDays = 7) {
+    const cutoff = new Date(this.now().getTime() - graceDays * 24 * 60 * 60 * 1e3);
+    return this.repo.deleteExpiredBefore(cutoff);
+  }
+};
+function truncate(value, max) {
+  return value === null ? null : value.slice(0, max);
+}
+
+// ../core/src/services/upload-operation.ts
+function isValidOperationId(id) {
+  return /^[A-Za-z0-9_-]{8,64}$/.test(id);
+}
+var OperationAlreadyExistsError = class extends Error {
+  constructor() {
+    super("An upload with this operation id already exists");
+    this.name = "OperationAlreadyExistsError";
+  }
+};
+
+// ../core/src/services/reconciliation.ts
+function reconcile(channel, references) {
+  const inChannel = new Set(channel.map((message) => message.messageId));
+  const unknown = [];
+  let referenced = 0;
+  for (const message of channel) {
+    const isReferenced = references.fileMessageIds.has(message.messageId) || references.pendingUploadMessageIds.has(message.messageId);
+    if (isReferenced) {
+      referenced += 1;
+    } else {
+      unknown.push({ kind: "unknown", messageId: message.messageId, sizeBytes: message.sizeBytes });
+    }
+  }
+  const dangling = [];
+  for (const messageId of references.fileMessageIds) {
+    if (!inChannel.has(messageId))
+      dangling.push({ kind: "dangling", messageId, recordedBy: "file" });
+  }
+  for (const messageId of references.pendingUploadMessageIds) {
+    if (!inChannel.has(messageId)) {
+      dangling.push({ kind: "dangling", messageId, recordedBy: "upload" });
+    }
+  }
+  return {
+    scannedMessages: channel.length,
+    referencedMessages: referenced,
+    unknown,
+    dangling
+  };
+}
+
+// ../core/src/services/reconciliation-service.ts
+var SCAN_LIMIT = 5e3;
+var ReconciliationService = class {
+  constructor(repos, engineFor) {
+    this.repos = repos;
+    this.engineFor = engineFor;
+  }
+  async run(userId) {
+    const engine = await this.engineFor(userId);
+    const listed = await engine.list(SCAN_LIMIT);
+    const fileMessageIds = /* @__PURE__ */ new Set();
+    for (const file of await this.repos.files.listByUser(userId)) {
+      fileMessageIds.add(file.telegramMessageId);
+    }
+    for (const version of await this.versionMessageIds(userId)) {
+      fileMessageIds.add(version);
+    }
+    const pendingUploadMessageIds = await this.pendingUploadMessageIds(userId);
+    return reconcile(
+      listed.map((object) => ({
+        messageId: Number(object.messageId),
+        sizeBytes: object.size
+      })),
+      { fileMessageIds, pendingUploadMessageIds }
+    );
+  }
+  /**
+   * Objects stored by an upload that has not yet completed. They are in-flight,
+   * not orphaned, so they count as referenced until the operation settles.
+   */
+  async pendingUploadMessageIds(userId) {
+    const ids = /* @__PURE__ */ new Set();
+    for (const status of ["UPLOADING", "PENDING"]) {
+      for (const operation of await this.repos.uploadOperations.listByStatus(userId, status)) {
+        if (operation.telegramMessageId !== null) ids.add(operation.telegramMessageId);
+      }
+    }
+    return ids;
+  }
+  /** Every version's message id for this user's files, including trashed ones. */
+  async versionMessageIds(userId) {
+    const files = await this.repos.files.listByUser(userId);
+    const byFile = await this.repos.files.listVersionsForFiles(files.map((file) => file.id));
+    return [...byFile.values()].flat().map((version) => version.telegramMessageId);
+  }
+};
+
+// ../core/src/services/reconciliation-repair.ts
+function planRepairs(report) {
+  const actions = [];
+  for (const finding of report.dangling) {
+    actions.push({
+      id: `detach-${finding.recordedBy}-${finding.messageId}`,
+      kind: "detach-dangling",
+      messageId: finding.messageId,
+      recordedBy: finding.recordedBy,
+      reason: "A record points at a Telegram message that is no longer in the channel. Detaching marks the record as missing; it does not delete it.",
+      destructive: false
+    });
+  }
+  for (const finding of report.unknown) {
+    actions.push({
+      id: `adopt-${finding.messageId}`,
+      kind: "adopt-unknown",
+      messageId: finding.messageId,
+      sizeBytes: finding.sizeBytes,
+      reason: "A channel message has no record. Adopting creates a file record for it. The message is not removed.",
+      destructive: false
+    });
+  }
+  return { actions, deletions: [] };
+}
+function selectApproved(plan, approvedIds) {
+  const offered = new Map(plan.actions.map((action) => [action.id, action]));
+  const selected = [];
+  for (const id of new Set(approvedIds)) {
+    const action = offered.get(id);
+    if (!action) throw new ValidationError(`Repair '${id}' was not offered by the plan`);
+    selected.push(action);
+  }
+  return selected;
+}
+
+// ../core/src/services/reconciliation-apply.ts
+var ReconciliationApplier = class {
+  constructor(repos, userId, engine) {
+    this.repos = repos;
+    this.userId = userId;
+    this.engine = engine;
+  }
+  async apply(actions) {
+    const applied = [];
+    const failed = [];
+    for (const action of actions) {
+      try {
+        if (action.kind === "detach-dangling") {
+          await this.detach(action);
+        } else {
+          await this.adopt(action);
+        }
+        applied.push({ id: action.id, kind: action.kind });
+      } catch (error) {
+        failed.push({
+          id: action.id,
+          message: error instanceof Error ? error.message : "repair failed"
+        });
+      }
+    }
+    return { applied, failed };
+  }
+  async detach(action) {
+    if (action.recordedBy !== "file") return;
+    const file = (await this.repos.files.listByUser(this.userId)).find(
+      (candidate) => candidate.telegramMessageId === action.messageId
+    );
+    if (!file) return;
+    await this.repos.files.update(file.id, { deletedAt: /* @__PURE__ */ new Date(), trashBatchId: null });
+  }
+  async adopt(action) {
+    const ref = { messageId: String(action.messageId) };
+    const object = await this.engine.stat(ref);
+    if (!object) throw new Error("The channel message is no longer available");
+    const data = await this.engine.download(ref);
+    if (data.byteLength !== object.size) {
+      throw new Error("The stored bytes do not match the object's reported size");
+    }
+    const record = await this.repos.files.create({
+      userId: this.userId,
+      folderId: null,
+      name: `recovered-${action.messageId}-${object.name}`,
+      size: object.size,
+      mimeType: object.mimeType,
+      sha256: sha256Hex(data),
+      telegramMessageId: action.messageId
+    });
+    await this.repos.files.createVersion({
+      fileId: record.id,
+      userId: this.userId,
+      size: object.size,
+      mimeType: object.mimeType,
+      sha256: record.sha256,
+      telegramMessageId: action.messageId
+    });
+  }
+};
+
+// ../core/src/services/reconciliation-flow.ts
+var ReconciliationFlow = class {
+  constructor(repos, engineFor) {
+    this.repos = repos;
+    this.engineFor = engineFor;
+    this.reconcile = new ReconciliationService(repos, engineFor);
+  }
+  reconcile;
+  async plan(userId) {
+    return planRepairs(await this.reconcile.run(userId));
+  }
+  async apply(userId, approvedIds) {
+    const fresh = await this.plan(userId);
+    const selected = selectApproved(fresh, approvedIds);
+    const engine = await this.engineFor(userId);
+    const applier = new ReconciliationApplier(this.repos, userId, engine);
+    return applier.apply(selected);
+  }
+};
+
+// ../core/src/utils/operation-log.ts
+async function timedOperation(sink, base, run, now = Date.now) {
+  const started = now();
+  const emit = (status, errorCode) => {
+    if (!sink) return;
+    const record = {
+      operation: base.operation,
+      userId: base.userId,
+      resourceId: base.resourceId ?? null,
+      sizeBytes: base.sizeBytes ?? null,
+      durationMs: now() - started,
+      status,
+      errorCode
+    };
+    try {
+      if (status === "ok") sink.info({ ...record }, `${base.operation}.completed`);
+      else sink.warn({ ...record }, `${base.operation}.failed`);
+    } catch {
+    }
+  };
+  try {
+    const result = await run();
+    emit("ok", null);
+    return result;
+  } catch (error) {
+    const code = error.code ?? "INTERNAL_ERROR";
+    emit("error", code);
+    throw error;
+  }
+}
+
+// ../core/src/services/activity-service.ts
+var ActivityService = class {
+  constructor(activity, retentionDays = 90) {
+    this.activity = activity;
+    this.retentionDays = retentionDays;
+  }
+  /**
+   * Records an event. Never throws — a logging failure must not fail the
+   * user-facing operation that produced it.
+   */
+  async record(input) {
+    try {
+      await this.activity.record({
+        userId: input.userId,
+        action: input.action,
+        resourceType: input.resourceType,
+        resourceId: input.resourceId,
+        resourceName: input.resourceName ?? null,
+        metadata: sanitizeMetadata(input.metadata)
+      });
+    } catch {
+    }
+  }
+  async list(userId, page) {
+    return this.activity.list(userId, page);
+  }
+  /** Most recent distinct files for the given actions, for the Recent view. */
+  async recentFiles(userId, actions, limit) {
+    return this.activity.recentFiles(userId, actions, limit);
+  }
+  async prune() {
+    const cutoff = new Date(Date.now() - this.retentionDays * 24 * 60 * 60 * 1e3);
+    return this.activity.pruneOlderThan(cutoff);
+  }
+};
+var SENSITIVE_KEY = /(password|secret|token|session|hash|credential)/i;
+function sanitizeMetadata(metadata) {
+  if (!metadata) return null;
+  const clean = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (SENSITIVE_KEY.test(key)) continue;
+    if (value === void 0) continue;
+    clean[key] = value;
+  }
+  return Object.keys(clean).length > 0 ? clean : null;
+}
+var noopActivityRecorder = {
+  async record() {
+  }
+};
+
+// ../core/src/utils/filename.ts
+function sanitizeFileName(name) {
+  const base = name.split(/[/\\]/).pop() ?? name;
+  const cleaned = base.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[<>:"|?*]/g, "_").trim();
+  if (!cleaned || cleaned === "." || cleaned === "..") return "";
+  return cleaned.slice(0, 255);
+}
+
+// ../core/src/services/file-service.ts
+var FileService = class {
+  constructor(files, folders, engineFor, activity = noopActivityRecorder, operations = null, log = null) {
+    this.files = files;
+    this.folders = folders;
+    this.engineFor = engineFor;
+    this.activity = activity;
+    this.operations = operations;
+    this.log = log;
+  }
+  // ── Upload ───────────────────────────────────────────────────────────────
+  async upload(userId, input) {
+    return timedOperation(
+      this.log,
+      {
+        operation: "upload",
+        userId,
+        resourceId: input.replaceFileId ?? null,
+        sizeBytes: input.spooled?.size ?? input.data?.byteLength ?? null
+      },
+      () => input.operationId && this.operations ? this.uploadOnce(userId, input, input.operationId, this.operations) : this.performUpload(userId, input)
+    );
+  }
+  /**
+   * Idempotent upload keyed by a client-supplied operation id. A retry never
+   * writes a second Telegram object: a completed operation returns its file, and
+   * an operation whose object was already stored is committed without uploading.
+   */
+  async uploadOnce(userId, input, operationId, operations) {
+    if (!isValidOperationId(operationId)) {
+      throw new ValidationError("Invalid upload operation id");
+    }
+    let op = await operations.findByOperationId(userId, operationId);
+    if (op?.status === "COMPLETED" && op.fileId) {
+      return this.get(userId, op.fileId);
+    }
+    if (op?.status === "UPLOADING" && op.telegramMessageId !== null) {
+      return this.commitStoredObject(userId, input, operations, op);
+    }
+    if (!op) {
+      try {
+        op = await operations.create({ userId, operationId });
+      } catch (error) {
+        if (!(error instanceof OperationAlreadyExistsError)) throw error;
+        const outcome = await this.followWinner(userId, input, operationId, operations);
+        if (outcome) return outcome;
+        throw new ConflictError("A concurrent upload with this operation id is still in progress");
+      }
+    }
+    const claimed = await operations.claim(op.id, "PENDING", "UPLOADING") || await operations.claim(op.id, "FAILED", "UPLOADING");
+    if (!claimed) {
+      const outcome = await this.followWinner(userId, input, operationId, operations);
+      if (outcome) return outcome;
+      throw new ConflictError("A concurrent upload with this operation id is still in progress");
+    }
+    try {
+      const record = await this.performUpload(userId, input, {
+        onStored: async (stored) => {
+          await operations.update(op.id, { telegramMessageId: Number(stored.messageId) });
+        }
+      });
+      await operations.update(op.id, { status: "COMPLETED", fileId: record.id });
+      return record;
+    } catch (error) {
+      await operations.update(op.id, {
+        status: "FAILED",
+        error: error instanceof Error ? error.message.slice(0, 200) : "upload failed"
+      });
+      throw error;
+    }
+  }
+  /**
+   * Follows an operation another request is driving, for a bounded time. Returns
+   * the finished file if the winner completes, or the stored object's commit if
+   * it has stored one. Returns null when the winner is still in progress after the
+   * budget, so the caller can report a conflict instead of waiting forever.
+   */
+  async followWinner(userId, input, operationId, operations) {
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      const current = await operations.findByOperationId(userId, operationId);
+      if (current?.status === "COMPLETED" && current.fileId) {
+        return this.get(userId, current.fileId);
+      }
+      if (current?.status === "FAILED") {
+        return null;
+      }
+      if (current?.status === "UPLOADING" && current.telegramMessageId !== null) {
+        return this.commitStoredObject(userId, input, operations, current);
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, 10));
+    }
+    return null;
+  }
+  /** Commits metadata for an object that is already in Telegram. */
+  async commitStoredObject(userId, input, operations, op) {
+    const name = sanitizeFileName(input.name);
+    const mimeType = mimeFromFilename(name);
+    const size = op.size ?? input.spooled?.size ?? input.data?.byteLength ?? 0;
+    const sha256 = op.sha256 ?? input.spooled?.sha256 ?? sha256Hex(input.data ?? Buffer.alloc(0));
+    const record = await this.commitRecord(userId, input, {
+      name,
+      mimeType,
+      size,
+      sha256,
+      telegramMessageId: op.telegramMessageId
+    });
+    await operations.update(op.id, { status: "COMPLETED", fileId: record.id });
+    return record;
+  }
+  async performUpload(userId, input, hooks = {}) {
+    const name = sanitizeFileName(input.name);
+    if (!name) throw new ValidationError("Invalid file name");
+    let folderId = input.folderId;
+    if (input.replaceFileId) {
+      const existing = await this.get(userId, input.replaceFileId);
+      folderId = existing.folderId;
+    } else if (folderId !== null) {
+      await this.assertFolder(userId, folderId);
+    }
+    const mimeType = mimeFromFilename(name);
+    const engine = await this.engineFor(userId);
+    const control = {
+      onProgress: input.onProgress,
+      signal: input.signal
+    };
+    if (!input.data && !input.spooled) {
+      throw new ValidationError("An upload needs content");
+    }
+    const { stored, sha256, size } = await engine.upload(
+      input.spooled ? {
+        name,
+        mimeType,
+        path: input.spooled.path,
+        size: input.spooled.size,
+        sha256: input.spooled.sha256
+      } : { name, mimeType, data: input.data },
+      control
+    );
+    await hooks.onStored?.(stored);
+    try {
+      return await this.commitRecord(userId, input, {
+        name,
+        mimeType,
+        size,
+        sha256,
+        telegramMessageId: Number(stored.messageId)
+      });
+    } catch (error) {
+      await engine.remove({ messageId: String(stored.messageId) }).catch(() => void 0);
+      throw error;
+    }
+  }
+  /** Persists the file (or the new version of a file) for an object already stored. */
+  async commitRecord(userId, input, next) {
+    const { name, mimeType, size, sha256, telegramMessageId } = next;
+    if (input.replaceFileId) {
+      return this.replaceVersion(userId, input.replaceFileId, {
+        name,
+        size,
+        mimeType,
+        sha256,
+        telegramMessageId
+      });
+    }
+    const folderId = input.folderId;
+    if (folderId !== null) {
+      await this.assertFolder(userId, folderId);
+    }
+    const record = await this.files.create({
+      userId,
+      folderId,
+      name,
+      size,
+      mimeType,
+      sha256,
+      telegramMessageId
+    });
+    const version = await this.files.createVersion({
+      fileId: record.id,
+      userId,
+      size,
+      mimeType,
+      sha256,
+      telegramMessageId
+    });
+    const withVersion = await this.files.update(record.id, {
+      currentVersionId: version.id,
+      versionCount: 1
+    });
+    await this.activity.record({
+      userId,
+      action: "upload",
+      resourceType: "file",
+      resourceId: withVersion.id,
+      resourceName: withVersion.name,
+      metadata: { size, mimeType }
+    });
+    return withVersion;
+  }
+  /** Uploads a new version of an existing file and makes it current. */
+  async replaceVersion(userId, fileId, next) {
+    const existing = await this.get(userId, fileId);
+    const version = await this.files.createVersion({
+      fileId,
+      userId,
+      size: next.size,
+      mimeType: next.mimeType,
+      sha256: next.sha256,
+      telegramMessageId: next.telegramMessageId
+    });
+    const count = await this.files.countVersions(fileId);
+    const updated = await this.files.update(fileId, {
+      name: next.name,
+      size: next.size,
+      mimeType: next.mimeType,
+      sha256: next.sha256,
+      telegramMessageId: next.telegramMessageId,
+      currentVersionId: version.id,
+      versionCount: count
+    });
+    await this.activity.record({
+      userId,
+      action: "replace",
+      resourceType: "file",
+      resourceId: fileId,
+      resourceName: updated.name,
+      metadata: { previousSha256: existing.sha256, size: next.size }
+    });
+    return updated;
+  }
+  // ── Reads ────────────────────────────────────────────────────────────────
+  async list(userId, folderId) {
+    if (folderId !== null) await this.assertFolder(userId, folderId);
+    return this.files.listByFolder(userId, folderId);
+  }
+  async query(userId, input, page) {
+    if (input.folderId != null) await this.assertFolder(userId, input.folderId);
+    const query = await resolveItemQuery(this.folders, userId, input);
+    return this.files.query(userId, query, page);
+  }
+  async get(userId, id) {
+    const record = await this.files.findById(id);
+    if (!record || record.userId !== userId) throw new NotFoundError("File not found", "file");
+    return record;
+  }
+  /** Like get(), but rejects trashed files (for download/open). */
+  async getActive(userId, id) {
+    const record = await this.get(userId, id);
+    if (record.deletedAt) throw new NotFoundError("File not found", "file");
+    return record;
+  }
+  async listVersions(userId, id) {
+    await this.get(userId, id);
+    return this.files.listVersions(id);
+  }
+  // ── Mutations ────────────────────────────────────────────────────────────
+  async rename(userId, id, name) {
+    const existing = await this.get(userId, id);
+    const clean = sanitizeFileName(name);
+    if (!clean) throw new ValidationError("Invalid file name");
+    const updated = await this.files.update(id, { name: clean });
+    await this.activity.record({
+      userId,
+      action: "rename",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: clean,
+      metadata: { previousName: existing.name }
+    });
+    return updated;
+  }
+  async move(userId, id, folderId) {
+    const existing = await this.get(userId, id);
+    if (folderId !== null) await this.assertFolder(userId, folderId);
+    const updated = await this.files.update(id, { folderId });
+    await this.activity.record({
+      userId,
+      action: "move",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: updated.name,
+      metadata: { from: existing.folderId, to: folderId }
+    });
+    return updated;
+  }
+  async setStarred(userId, id, starred) {
+    await this.get(userId, id);
+    const updated = await this.files.update(id, { starred });
+    await this.activity.record({
+      userId,
+      action: starred ? "star" : "unstar",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: updated.name
+    });
+    return updated;
+  }
+  /**
+   * Moves a file to Trash (soft delete). The remote object is untouched, so
+   * restore is lossless.
+   */
+  async trash(userId, id) {
+    const record = await this.get(userId, id);
+    if (record.deletedAt) return record;
+    const updated = await this.files.update(id, {
+      deletedAt: /* @__PURE__ */ new Date(),
+      trashBatchId: `solo-${id}`
+    });
+    await this.activity.record({
+      userId,
+      action: "trash",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: updated.name
+    });
+    return updated;
+  }
+  /** Restores a trashed file to its previous folder (or root). */
+  async restore(userId, id) {
+    const record = await this.get(userId, id);
+    let folderId = record.folderId;
+    if (folderId !== null) {
+      const folder = await this.folders.findById(folderId);
+      if (!folder || folder.userId !== userId || folder.deletedAt) folderId = null;
+    }
+    const updated = await this.files.update(id, { deletedAt: null, trashBatchId: null, folderId });
+    await this.activity.record({
+      userId,
+      action: "restore",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: updated.name
+    });
+    return updated;
+  }
+  /**
+   * Permanently deletes a file: the Telegram object is removed first, then the
+   * metadata. If the remote delete fails we keep the metadata so the user can
+   * retry, rather than silently orphaning the storage object.
+   */
+  async deletePermanently(userId, id) {
+    return timedOperation(
+      this.log,
+      { operation: "delete", userId, resourceId: id },
+      () => this.performPermanentDelete(userId, id)
+    );
+  }
+  async performPermanentDelete(userId, id) {
+    const record = await this.get(userId, id);
+    const engine = await this.engineFor(userId);
+    const versions = await this.files.listVersions(id);
+    const messageIds = /* @__PURE__ */ new Set([String(record.telegramMessageId)]);
+    for (const version of versions) messageIds.add(String(version.telegramMessageId));
+    for (const messageId of messageIds) {
+      await engine.remove({ messageId });
+    }
+    await this.files.deleteVersionsByFileIds([id]);
+    await this.files.deleteMany([id]);
+    await this.activity.record({
+      userId,
+      action: "delete",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: record.name
+    });
+  }
+  /**
+   * v0.1-compatible hard delete used by the current API: permanently removes
+   * the file. Retained so existing clients keep working.
+   */
+  async delete(userId, id) {
+    await this.deletePermanently(userId, id);
+  }
+  // ── Download ─────────────────────────────────────────────────────────────
+  async download(userId, id, control = {}) {
+    const record = await this.getActive(userId, id);
+    const engine = await this.engineFor(userId);
+    const data = await engine.download({ messageId: String(record.telegramMessageId) }, control);
+    const integrityVerified = await engine.verifyIntegrity(data, record.sha256);
+    await this.activity.record({
+      userId,
+      action: "download",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: record.name,
+      metadata: { size: record.size, integrityVerified }
+    });
+    return { record, data, integrityVerified };
+  }
+  /**
+   * Streaming download for large files. The caller must consume `stream` to
+   * the end and then await `verified` to learn whether the bytes match the
+   * stored checksum. The download activity is recorded when the stream opens.
+   */
+  async downloadStreamed(userId, id, control = {}) {
+    return timedOperation(
+      this.log,
+      { operation: "download", userId, resourceId: id },
+      () => this.performStreamedDownload(userId, id, control)
+    );
+  }
+  async performStreamedDownload(userId, id, control) {
+    const record = await this.getActive(userId, id);
+    const engine = await this.engineFor(userId);
+    const stream = await engine.downloadStream(
+      { messageId: String(record.telegramMessageId) },
+      record.sha256,
+      control
+    );
+    await this.activity.record({
+      userId,
+      action: "download",
+      resourceType: "file",
+      resourceId: id,
+      resourceName: record.name,
+      metadata: { size: record.size, streamed: true }
+    });
+    return { record, stream };
+  }
+  /** Records an "open" event (the UI opening the details panel, say). */
+  async touch(userId, id, action = "open") {
+    const record = await this.get(userId, id);
+    await this.activity.record({
+      userId,
+      action,
+      resourceType: "file",
+      resourceId: id,
+      resourceName: record.name
+    });
+  }
+  // ── Batch operations ─────────────────────────────────────────────────────
+  /**
+   * Applies an operation to many files, collecting per-item failures instead
+   * of aborting the whole batch.
+   */
+  async batch(userId, ids, operation, options = {}) {
+    const errors = [];
+    let succeeded = 0;
+    if (ids.length === 0) throw new ValidationError("No items selected");
+    if (operation === "move") {
+      const target = options.folderId ?? null;
+      if (target !== null) await this.assertFolder(userId, target);
+    }
+    for (const id of ids) {
+      try {
+        switch (operation) {
+          case "trash":
+            await this.trash(userId, id);
+            break;
+          case "restore":
+            await this.restore(userId, id);
+            break;
+          case "delete":
+            await this.deletePermanently(userId, id);
+            break;
+          case "star":
+            await this.setStarred(userId, id, true);
+            break;
+          case "unstar":
+            await this.setStarred(userId, id, false);
+            break;
+          case "move":
+            await this.move(userId, id, options.folderId ?? null);
+            break;
+        }
+        succeeded += 1;
+      } catch (error) {
+        errors.push({ id, message: error instanceof Error ? error.message : "Operation failed" });
+      }
+    }
+    return {
+      ...options.operationId ? { operationId: options.operationId } : {},
+      requested: ids.length,
+      succeeded,
+      failed: errors.length,
+      errors
+    };
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  async assertFolder(userId, folderId) {
+    const folder = await this.folders.findById(folderId);
+    if (!folder || folder.userId !== userId) {
+      throw new NotFoundError("Folder not found", "folder");
+    }
+    if (folder.deletedAt) throw new ConflictError("The target folder is in the Trash");
+  }
+};
+
+// ../core/src/services/folder-service.ts
+var FolderService = class {
+  constructor(folders, files, engineFor, activity = noopActivityRecorder) {
+    this.folders = folders;
+    this.files = files;
+    this.engineFor = engineFor;
+    this.activity = activity;
+  }
+  // ── Create / read ────────────────────────────────────────────────────────
+  async create(userId, input) {
+    const name = sanitizeFileName(input.name);
+    if (!name) throw new ValidationError("Invalid folder name");
+    if (input.parentId !== null) {
+      const parent = await this.get(userId, input.parentId);
+      if (parent.deletedAt) throw new ConflictError("The parent folder is in the Trash");
+    }
+    const folder = await this.folders.create({ userId, parentId: input.parentId, name });
+    await this.activity.record({
+      userId,
+      action: "create_folder",
+      resourceType: "folder",
+      resourceId: folder.id,
+      resourceName: folder.name
+    });
+    return folder;
+  }
+  /** Active folders directly inside a folder (null = root). */
+  async listChildren(userId, parentId) {
+    if (parentId !== null) await this.get(userId, parentId);
+    return this.folders.listChildren(userId, parentId);
+  }
+  async query(userId, input, page) {
+    const query = await resolveItemQuery(this.folders, userId, input);
+    return this.folders.query(userId, query, page);
+  }
+  /** Every active folder for the user (used to build trees). */
+  async tree(userId) {
+    const all = await this.folders.listByUser(userId);
+    return all.filter((folder) => folder.deletedAt === null);
+  }
+  async get(userId, id) {
+    const record = await this.folders.findById(id);
+    if (!record || record.userId !== userId) throw new NotFoundError("Folder not found", "folder");
+    return record;
+  }
+  // ── Mutations ────────────────────────────────────────────────────────────
+  async rename(userId, id, name) {
+    const existing = await this.get(userId, id);
+    const clean = sanitizeFileName(name);
+    if (!clean) throw new ValidationError("Invalid folder name");
+    const updated = await this.folders.update(id, { name: clean });
+    await this.activity.record({
+      userId,
+      action: "rename",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: clean,
+      metadata: { previousName: existing.name }
+    });
+    return updated;
+  }
+  async move(userId, id, newParentId) {
+    const existing = await this.get(userId, id);
+    if (newParentId === id) throw new ValidationError("Cannot move a folder into itself");
+    if (newParentId !== null) {
+      const target = await this.get(userId, newParentId);
+      if (target.deletedAt) throw new ConflictError("The target folder is in the Trash");
+      let cursor = newParentId;
+      while (cursor !== null) {
+        if (cursor === id) {
+          throw new ValidationError("Cannot move a folder into one of its subfolders");
+        }
+        const parent = await this.folders.findById(cursor);
+        if (!parent || parent.userId !== userId)
+          throw new NotFoundError("Folder not found", "folder");
+        cursor = parent.parentId;
+      }
+    }
+    const updated = await this.folders.moveSafely(id, newParentId);
+    await this.activity.record({
+      userId,
+      action: "move",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: updated.name,
+      metadata: { from: existing.parentId, to: newParentId }
+    });
+    return updated;
+  }
+  async setStarred(userId, id, starred) {
+    await this.get(userId, id);
+    const updated = await this.folders.update(id, { starred });
+    await this.activity.record({
+      userId,
+      action: starred ? "star" : "unstar",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: updated.name
+    });
+    return updated;
+  }
+  // ── Trash lifecycle ──────────────────────────────────────────────────────
+  /**
+   * Moves a folder and its entire subtree to the Trash. Nothing is deleted
+   * from Telegram, so restore is lossless.
+   */
+  async trash(userId, id) {
+    const record = await this.get(userId, id);
+    if (record.deletedAt) {
+      return { affectedFolders: 1, affectedFiles: 0 };
+    }
+    const subtree = await this.collectSubtree(userId, id);
+    const fileIds = await this.collectFileIds(userId, subtree);
+    const batchId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const stampedAt = /* @__PURE__ */ new Date();
+    await this.folders.updateMany(
+      subtree.map((folder) => folder.id),
+      { deletedAt: stampedAt, trashBatchId: batchId }
+    );
+    await this.files.updateMany(fileIds, { deletedAt: stampedAt, trashBatchId: batchId });
+    await this.activity.record({
+      userId,
+      action: "trash",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: record.name,
+      metadata: { folders: subtree.length, files: fileIds.length }
+    });
+    return { affectedFolders: subtree.length, affectedFiles: fileIds.length };
+  }
+  /**
+   * Restores a folder subtree. Only nodes trashed at the same instant as the
+   * folder itself are restored, so items the user trashed separately stay put.
+   */
+  async restore(userId, id) {
+    const record = await this.get(userId, id);
+    let parentId = record.parentId;
+    if (parentId !== null) {
+      const parent = await this.folders.findById(parentId);
+      if (!parent || parent.userId !== userId || parent.deletedAt) parentId = null;
+    }
+    const subtree = await this.collectSubtree(userId, id, { includeTrashed: true });
+    const batchId = record.trashBatchId;
+    const belongsToBatch = (deletedAt, marker) => deletedAt !== null && (batchId !== null ? marker === batchId : record.deletedAt !== null && deletedAt.getTime() === record.deletedAt.getTime());
+    const restorableFolders = subtree.filter(
+      (folder) => belongsToBatch(folder.deletedAt, folder.trashBatchId)
+    );
+    const restorableFolderIds = new Set(restorableFolders.map((folder) => folder.id));
+    const allFiles = await this.files.listByUser(userId);
+    const restorableFiles = allFiles.filter(
+      (file) => file.folderId !== null && restorableFolderIds.has(file.folderId) && belongsToBatch(file.deletedAt, file.trashBatchId)
+    );
+    const restorableFileIds = restorableFiles.map((file) => file.id);
+    if (restorableFolders.length > 0) {
+      await this.folders.updateMany(
+        restorableFolders.map((folder) => folder.id),
+        { deletedAt: null, trashBatchId: null }
+      );
+      await this.folders.update(id, { parentId });
+    }
+    if (restorableFileIds.length > 0) {
+      await this.files.updateMany(restorableFileIds, { deletedAt: null, trashBatchId: null });
+    }
+    await this.activity.record({
+      userId,
+      action: "restore",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: record.name,
+      metadata: { folders: restorableFolders.length, files: restorableFiles.length }
+    });
+    return { affectedFolders: restorableFolders.length, affectedFiles: restorableFiles.length };
+  }
+  /**
+   * Permanently deletes a folder subtree: remote objects first, then
+   * metadata. Files whose remote delete fails are left in the Trash so the
+   * user can retry rather than losing data silently.
+   */
+  async deletePermanently(userId, id) {
+    await this.get(userId, id);
+    const subtree = await this.collectSubtree(userId, id, { includeTrashed: true });
+    const folderIds = subtree.map((folder) => folder.id);
+    const allFiles = await this.files.listByUser(userId);
+    const affected = allFiles.filter(
+      (file) => file.folderId !== null && folderIds.includes(file.folderId)
+    );
+    const engine = await this.engineFor(userId);
+    const removedFileIds = [];
+    for (const file of affected) {
+      try {
+        await engine.remove({ messageId: String(file.telegramMessageId) });
+        removedFileIds.push(file.id);
+      } catch {
+      }
+    }
+    if (removedFileIds.length > 0) {
+      await this.files.deleteVersionsByFileIds(removedFileIds);
+      await this.files.deleteMany(removedFileIds);
+    }
+    const remainingFolderIds = new Set(
+      affected.filter((file) => !removedFileIds.includes(file.id)).map((file) => file.folderId)
+    );
+    const deletable = folderIds.filter((folderId) => !remainingFolderIds.has(folderId));
+    if (deletable.length > 0) {
+      await this.folders.deleteMany(deletable);
+    }
+    await this.activity.record({
+      userId,
+      action: "delete",
+      resourceType: "folder",
+      resourceId: id,
+      resourceName: subtree[0]?.name ?? "folder",
+      metadata: { folders: deletable.length, files: removedFileIds.length }
+    });
+    return { affectedFolders: deletable.length, affectedFiles: removedFileIds.length };
+  }
+  /**
+   * v0.1-compatible recursive delete. Now routes through the v0.2 permanent
+   * delete so remote cleanup and orphan prevention are consistent.
+   */
+  async delete(userId, id) {
+    return this.deletePermanently(userId, id);
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  /** The folder plus every descendant (BFS), optionally including trashed. */
+  async collectSubtree(userId, rootId, options = {}) {
+    const all = await this.folders.listByUser(userId);
+    const childrenOf = /* @__PURE__ */ new Map();
+    for (const folder of all) {
+      const list = childrenOf.get(folder.parentId) ?? [];
+      list.push(folder);
+      childrenOf.set(folder.parentId, list);
+    }
+    const root = all.find((folder) => folder.id === rootId);
+    if (!root) throw new NotFoundError("Folder not found", "folder");
+    const collected = [root];
+    const queue = [rootId];
+    while (queue.length > 0) {
+      const current = queue.shift();
+      for (const child of childrenOf.get(current) ?? []) {
+        if (!options.includeTrashed && child.deletedAt) continue;
+        collected.push(child);
+        queue.push(child.id);
+      }
+    }
+    return collected;
+  }
+  /** Ids of files inside the given folders that are not already trashed. */
+  async collectFileIds(userId, folders) {
+    const ids = new Set(folders.map((folder) => folder.id));
+    const allFiles = await this.files.listByUser(userId);
+    return allFiles.filter((file) => file.deletedAt === null && file.folderId !== null && ids.has(file.folderId)).map((file) => file.id);
+  }
+};
+
+// ../core/src/services/search-service.ts
+var MAX_QUERY_LENGTH = 200;
+var SearchService = class {
+  constructor(files, folders) {
+    this.files = files;
+    this.folders = folders;
+  }
+  async search(userId, rawQuery, page, overrides = {}) {
+    const trimmed = rawQuery.trim();
+    if (!trimmed) throw new ValidationError("Search query must not be empty");
+    if (trimmed.length > MAX_QUERY_LENGTH) {
+      throw new ValidationError(`Search query must be at most ${MAX_QUERY_LENGTH} characters`);
+    }
+    const { query } = parseSearchQuery(trimmed, overrides);
+    if (query.status === void 0) query.status = "all";
+    const itemQuery = await resolveItemQuery(this.folders, userId, query);
+    const [filePage, folderPage] = await Promise.all([
+      this.files.query(userId, itemQuery, page),
+      this.folders.query(userId, itemQuery, page)
+    ]);
+    const total = filePage.total + folderPage.total;
+    return {
+      files: filePage.items,
+      folders: folderPage.items,
+      pagination: paginationMeta(page.page, page.limit, total)
+    };
+  }
+  /** Convenience wrapper returning the shared DTO shape. */
+  async searchDTO(userId, rawQuery, page) {
+    return this.search(userId, rawQuery, page);
+  }
+};
+
+// ../core/src/services/stats-service.ts
+var LARGEST_FILES = 10;
+var StatsService = class {
+  constructor(files, folders) {
+    this.files = files;
+    this.folders = folders;
+  }
+  async stats(userId, quotaBytes = null) {
+    const [counters, allFiles] = await Promise.all([
+      this.files.statsByUser(userId),
+      // Metadata-only aggregation; v0.2 datasets fit comfortably in memory.
+      this.files.listByUser(userId)
+    ]);
+    const active = allFiles.filter((file) => file.deletedAt === null);
+    const categoryBytes = /* @__PURE__ */ new Map();
+    for (const file of active) {
+      const category = fileCategory(file.mimeType);
+      const bucket = categoryBytes.get(category) ?? { bytes: 0, count: 0 };
+      bucket.bytes += file.size;
+      bucket.count += 1;
+      categoryBytes.set(category, bucket);
+    }
+    const byType = [...categoryBytes.entries()].map(([category, bucket]) => ({ category, bytes: bucket.bytes, count: bucket.count })).sort((a, b) => b.bytes - a.bytes);
+    const largestFiles = [...active].sort((a, b) => b.size - a.size).slice(0, LARGEST_FILES);
+    return {
+      fileCount: counters.fileCount,
+      folderCount: counters.folderCount,
+      totalBytes: counters.totalBytes,
+      trashBytes: counters.trashBytes,
+      trashFileCount: counters.trashFileCount,
+      starredCount: counters.starredCount,
+      byType,
+      largestFiles,
+      quotaBytes
+    };
+  }
+};
+
+// ../core/src/services/trash-service.ts
+var TrashService = class {
+  constructor(files, folders, engineFor) {
+    this.files = files;
+    this.folders = folders;
+    this.engineFor = engineFor;
+  }
+  async list(userId, page, extra = {}) {
+    const itemQuery = await resolveItemQuery(this.folders, userId, {
+      ...extra,
+      status: "trashed",
+      folderId: void 0
+    });
+    const [filePage, folderPage] = await Promise.all([
+      this.files.query(userId, itemQuery, page),
+      this.folders.query(userId, itemQuery, page)
+    ]);
+    const total = filePage.total + folderPage.total;
+    return {
+      files: filePage.items,
+      folders: folderPage.items,
+      pagination: paginationMeta(page.page, page.limit, total)
+    };
+  }
+  /**
+   * Permanently removes everything in the Trash for a user. Folders are
+   * processed root-first so removing a parent also removes its contents.
+   */
+  async empty(userId) {
+    const engine = await this.engineFor(userId);
+    const allFiles = await this.files.listByUser(userId);
+    const trashedFiles = allFiles.filter((file) => file.deletedAt !== null);
+    let deletedFiles = 0;
+    let failedFiles = 0;
+    const deletedFileIds = [];
+    for (const file of trashedFiles) {
+      try {
+        await engine.remove({ messageId: String(file.telegramMessageId) });
+        deletedFileIds.push(file.id);
+        deletedFiles += 1;
+      } catch {
+        failedFiles += 1;
+      }
+    }
+    if (deletedFileIds.length > 0) {
+      await this.files.deleteVersionsByFileIds(deletedFileIds);
+      await this.files.deleteMany(deletedFileIds);
+    }
+    const allFolders = await this.folders.listByUser(userId);
+    const trashedFolders = allFolders.filter((folder) => folder.deletedAt !== null);
+    const depth = (folder) => {
+      let level = 0;
+      let cursor = folder.parentId;
+      const seen = /* @__PURE__ */ new Set();
+      while (cursor !== null && !seen.has(cursor)) {
+        seen.add(cursor);
+        const parent = allFolders.find((candidate) => candidate.id === cursor);
+        if (!parent) break;
+        level += 1;
+        cursor = parent.parentId;
+      }
+      return level;
+    };
+    trashedFolders.sort((a, b) => depth(a) - depth(b));
+    let deletedFolders = 0;
+    for (const folder of trashedFolders) {
+      const stillHasFiles = await this.files.query(
+        userId,
+        { folderId: folder.id, trashed: true },
+        { page: 1, limit: 1 }
+      );
+      if (stillHasFiles.total > 0) continue;
+      await this.folders.deleteMany([folder.id]);
+      deletedFolders += 1;
+    }
+    return { deletedFiles, deletedFolders, failedFiles };
+  }
+  /** Restores a single trashed item (used by the batch restore endpoint). */
+  async verifyTrashedFile(userId, id) {
+    const file = await this.files.findById(id);
+    if (!file || file.userId !== userId || file.deletedAt === null) {
+      throw new NotFoundError("File is not in the Trash", "file");
+    }
+    return file;
+  }
+};
+
+// ../core/src/services/integrity-service.ts
+var IntegrityService = class {
+  constructor(files, engineFor) {
+    this.files = files;
+    this.engineFor = engineFor;
+  }
+  async check(userId, options = {}) {
+    const startedAt = Date.now();
+    const all = await this.files.listByUser(userId);
+    const active = all.filter((file) => file.deletedAt === null);
+    const targets = options.limit ? active.slice(0, options.limit) : active;
+    const engine = await this.engineFor(userId);
+    const issues = [];
+    let healthy = 0;
+    const versionsByFile = await this.files.listVersionsForFiles(targets.map((file) => file.id));
+    for (const file of targets) {
+      const issue = await this.inspect(file, options.deep ?? false, engine);
+      if (issue) issues.push(issue);
+      else healthy += 1;
+      for (const version of versionsByFile.get(file.id) ?? []) {
+        if (version.telegramMessageId === file.telegramMessageId) continue;
+        const versionIssue = await this.inspectObject(
+          {
+            id: file.id,
+            name: file.name,
+            telegramMessageId: version.telegramMessageId,
+            size: version.size,
+            sha256: version.sha256
+          },
+          options.deep ?? false,
+          engine,
+          version.id
+        );
+        if (versionIssue) issues.push(versionIssue);
+        else healthy += 1;
+      }
+    }
+    const missing = issues.filter((issue) => issue.kind === "missing").length;
+    const inconsistent = issues.filter(
+      (issue) => issue.kind === "size_mismatch" || issue.kind === "hash_mismatch"
+    ).length;
+    const unreadable = issues.filter((issue) => issue.kind === "unreadable").length;
+    return {
+      checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      filesChecked: targets.length,
+      healthy,
+      missing,
+      inconsistent,
+      unreadable,
+      issues,
+      durationMs: Date.now() - startedAt
+    };
+  }
+  async inspect(file, deep, engine) {
+    return this.inspectObject(
+      {
+        id: file.id,
+        name: file.name,
+        telegramMessageId: file.telegramMessageId,
+        size: file.size,
+        sha256: file.sha256
+      },
+      deep,
+      engine,
+      void 0
+    );
+  }
+  async inspectObject(target, deep, engine, versionId) {
+    const ref = { messageId: String(target.telegramMessageId) };
+    const withVersion = (issue) => versionId ? { ...issue, versionId } : issue;
+    let stat;
+    try {
+      stat = await engine.stat(ref);
+    } catch (error) {
+      return withVersion({
+        fileId: target.id,
+        name: target.name,
+        kind: "unreadable",
+        detail: error instanceof Error ? error.message : "Storage lookup failed"
+      });
+    }
+    if (!stat) {
+      return withVersion({
+        fileId: target.id,
+        name: target.name,
+        kind: "missing",
+        detail: "No message with this id exists in the storage channel"
+      });
+    }
+    if (stat.size !== target.size) {
+      return withVersion({
+        fileId: target.id,
+        name: target.name,
+        kind: "size_mismatch",
+        detail: `metadata=${target.size} storage=${stat.size}`
+      });
+    }
+    if (deep) {
+      try {
+        const stream = await engine.downloadStream(ref, target.sha256);
+        for await (const _chunk of stream) {
+        }
+      } catch (error) {
+        if (error instanceof IntegrityCheckError) {
+          return withVersion({
+            fileId: target.id,
+            name: target.name,
+            kind: "hash_mismatch",
+            detail: "Downloaded bytes do not match the stored SHA-256"
+          });
+        }
+        return withVersion({
+          fileId: target.id,
+          name: target.name,
+          kind: "unreadable",
+          detail: error instanceof Error ? error.message : "Download failed"
+        });
+      }
+    }
+    return null;
+  }
+};
+
+// ../core/src/services/recent-service.ts
+var RECENT_ACTIONS = [
+  "upload",
+  "download",
+  "open",
+  "rename",
+  "move",
+  "replace"
+];
+var RecentService = class {
+  constructor(activity, files) {
+    this.activity = activity;
+    this.files = files;
+  }
+  async list(userId, page) {
+    const window = Math.min(page.page * page.limit * 3, 500);
+    const events = await this.activity.recentFiles(userId, RECENT_ACTIONS, window);
+    const seen = /* @__PURE__ */ new Set();
+    for (const event of events) {
+      seen.add(event.resourceId);
+    }
+    const fileIds = [...seen];
+    const records = fileIds.length > 0 ? await this.files.listByIds(userId, fileIds) : [];
+    const byId = new Map(records.map((record) => [record.id, record]));
+    const items = [];
+    for (const fileId of fileIds) {
+      const record = byId.get(fileId);
+      if (!record || record.deletedAt !== null) continue;
+      const event = events.find((candidate) => candidate.resourceId === fileId);
+      items.push({
+        file: {
+          id: record.id,
+          name: record.name,
+          size: record.size,
+          mimeType: record.mimeType,
+          sha256: record.sha256,
+          folderId: record.folderId,
+          starred: record.starred,
+          trashed: false,
+          deletedAt: null,
+          versionCount: record.versionCount,
+          currentVersionId: record.currentVersionId,
+          createdAt: record.createdAt.toISOString(),
+          updatedAt: record.updatedAt.toISOString()
+        },
+        lastAction: event.action,
+        lastActionAt: event.createdAt.toISOString()
+      });
+    }
+    const start = (page.page - 1) * page.limit;
+    const pageItems = items.slice(start, start + page.limit);
+    return {
+      items: pageItems,
+      pagination: paginationMeta(page.page, page.limit, items.length)
+    };
+  }
+};
+
+// ../core/src/utils/spool.ts
+import { createHash as createHash4 } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Transform as Transform2 } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var SPOOL_PREFIX = "omnicloud-upload-";
+async function spoolToFile(source, maxBytes) {
+  const dir = await mkdtemp(join(tmpdir(), `${SPOOL_PREFIX}${process.pid}-`));
+  const path = join(dir, "payload");
+  const discard = () => rm(dir, { recursive: true, force: true });
+  const hash = createHash4("sha256");
+  let size = 0;
+  const meter = new Transform2({
+    transform(chunk, _encoding, callback) {
+      size += chunk.byteLength;
+      if (size > maxBytes) {
+        callback(
+          new PayloadTooLargeError(
+            `Files larger than ${Math.floor(maxBytes / (1024 * 1024))} MB are not supported`
+          )
+        );
+        return;
+      }
+      hash.update(chunk);
+      callback(null, chunk);
+    }
+  });
+  try {
+    await pipeline(source, meter, createWriteStream(path));
+  } catch (error) {
+    await discard();
+    throw error;
+  }
+  return { path, size, sha256: hash.digest("hex"), discard };
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function sweepStaleSpools() {
+  const { readdir } = await import("node:fs/promises");
+  const entries = await readdir(tmpdir()).catch(() => []);
+  let removed = 0;
+  for (const name of entries) {
+    if (!name.startsWith(SPOOL_PREFIX)) continue;
+    const pid = Number(name.slice(SPOOL_PREFIX.length).split("-")[0]);
+    if (!Number.isInteger(pid) || pid <= 0 || isAlive(pid)) continue;
+    await rm(join(tmpdir(), name), { recursive: true, force: true });
+    removed += 1;
+  }
+  return removed;
+}
+
+// ../core/src/utils/secret-box.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "node:crypto";
+var ALGORITHM = "aes-256-gcm";
+var IV_BYTES = 12;
+var KEY_BYTES = 32;
+var SecretBox = class {
+  keys;
+  currentVersion;
+  /**
+   * @param keys key versions available for decryption; the highest version is
+   *   used for new seals.
+   */
+  constructor(keys) {
+    if (keys.length === 0) {
+      throw new ValidationError("At least one encryption key is required");
+    }
+    this.keys = /* @__PURE__ */ new Map();
+    for (const { version, key } of keys) {
+      if (key.byteLength !== KEY_BYTES) {
+        throw new ValidationError(`Encryption key version ${version} must be 32 bytes`);
+      }
+      this.keys.set(version, key);
+    }
+    this.currentVersion = Math.max(...this.keys.keys());
+  }
+  seal(plaintext) {
+    const key = this.keys.get(this.currentVersion);
+    const iv = randomBytes2(IV_BYTES);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [
+      `v${this.currentVersion}`,
+      iv.toString("base64url"),
+      tag.toString("base64url"),
+      ciphertext.toString("base64url")
+    ].join(":");
+  }
+  open(envelope) {
+    const parts = envelope.split(":");
+    if (parts.length !== 4 || !parts[0].startsWith("v")) {
+      throw new SecretBoxError("Malformed sealed value");
+    }
+    const version = Number(parts[0].slice(1));
+    const key = this.keys.get(version);
+    if (!key) throw new SecretBoxError(`No encryption key for version ${version}`);
+    try {
+      const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(parts[1], "base64url"));
+      decipher.setAuthTag(Buffer.from(parts[2], "base64url"));
+      const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(parts[3], "base64url")),
+        decipher.final()
+      ]);
+      return plaintext.toString("utf8");
+    } catch {
+      throw new SecretBoxError("Sealed value failed authentication");
+    }
+  }
+  get currentKeyVersion() {
+    return this.currentVersion;
+  }
+};
+var SecretBoxError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecretBoxError";
+  }
+};
+var KDF_SALT = "omnicloud-secret-box-v1";
+function deriveKey(secret) {
+  if (/^[0-9a-f]{64}$/i.test(secret)) return Buffer.from(secret, "hex");
+  if (secret.length < 32) {
+    throw new ValidationError(
+      "The encryption key must be 64 hex characters or at least 32 characters"
+    );
+  }
+  return scryptSync(secret, KDF_SALT, KEY_BYTES);
+}
+
+// ../../apps/api/src/config.ts
+function optional(env, name, fallback) {
+  const value = env[name];
+  return value && value.trim() !== "" ? value.trim() : fallback;
+}
+function int(env, name, fallback) {
+  const raw = env[name];
+  if (!raw || raw.trim() === "") return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return value;
+}
+function bool(env, name, fallback) {
+  const raw = env[name];
+  if (!raw || raw.trim() === "") return fallback;
+  return raw.trim().toLowerCase() === "true";
+}
+function loadConfig(env = process.env) {
+  const telegramApiId = int(env, "TELEGRAM_API_ID", 0);
+  const telegramApiHash = optional(env, "TELEGRAM_API_HASH", "");
+  if (telegramApiId === 0 || !telegramApiHash) {
+    throw new Error(
+      "TELEGRAM_API_ID and TELEGRAM_API_HASH are required. Create an application at https://my.telegram.org (see .env.example)."
+    );
+  }
+  const nodeEnv = optional(env, "NODE_ENV", "development");
+  const sessionSecret = optional(env, "SESSION_SECRET", "");
+  const encryptionKey = optional(env, "OMNICLOUD_ENCRYPTION_KEY", "");
+  if (!encryptionKey && nodeEnv === "production") {
+    throw new Error("OMNICLOUD_ENCRYPTION_KEY must be set when NODE_ENV=production");
+  }
+  const quotaGb = Number(optional(env, "STORAGE_QUOTA_GB", "0"));
+  return {
+    encryptionKey: encryptionKey || null,
+    port: int(env, "PORT", 4e3),
+    host: optional(env, "HOST", "0.0.0.0"),
+    logLevel: optional(env, "LOG_LEVEL", "info"),
+    nodeEnv,
+    sessionSecret: sessionSecret || "development-only-secret-change-me",
+    cookieSecure: bool(env, "COOKIE_SECURE", false),
+    telegramApiId,
+    telegramApiHash,
+    maxUploadBytes: int(env, "MAX_UPLOAD_MB", 256) * 1024 * 1024,
+    webDistDir: optional(env, "WEB_DIST_DIR", "") || null,
+    allowedOrigins: optional(env, "ALLOWED_ORIGINS", "").split(",").map((origin) => origin.trim()).filter(Boolean),
+    quotaBytes: Number.isFinite(quotaGb) && quotaGb > 0 ? Math.round(quotaGb * 1024 ** 3) : null,
+    trustProxy: bool(env, "TRUST_PROXY", false)
+  };
+}
+
+// ../telegram/src/client.ts
+import { Api, TelegramClient } from "telegram";
+import { StringSession } from "telegram/sessions/index.js";
+
+// ../telegram/src/errors.ts
+import { RPCError } from "telegram/errors/index.js";
+function isTelegramRpcError(error) {
+  return error instanceof RPCError;
+}
+function isPasswordRequiredError(error) {
+  return isTelegramRpcError(error) && error.errorMessage === "SESSION_PASSWORD_NEEDED";
+}
+function mapTelegramError(error, fallbackMessage) {
+  if (error instanceof DomainError) return error;
+  if (isTelegramRpcError(error)) {
+    const msg = error.errorMessage ?? "";
+    if (msg.startsWith("FLOOD_WAIT_")) {
+      const seconds = Number(msg.slice("FLOOD_WAIT_".length)) || 60;
+      return new RateLimitedError(`Telegram rate limit reached \u2014 retry in ${seconds} seconds`, {
+        retryAfterSeconds: seconds
+      });
+    }
+    switch (msg) {
+      case "PHONE_NUMBER_INVALID":
+        return new ValidationError("This phone number is not valid");
+      case "PHONE_NUMBER_UNOCCUPIED":
+        return new ValidationError("No Telegram account exists for this phone number");
+      case "PHONE_CODE_INVALID":
+        return new ValidationError("Invalid confirmation code");
+      case "PHONE_CODE_EXPIRED":
+        return new ValidationError("The confirmation code has expired \u2014 request a new one");
+      case "PHONE_CODE_EMPTY":
+        return new ValidationError("Please enter the confirmation code");
+      case "SESSION_PASSWORD_NEEDED":
+        return new UnauthorizedError("Two-factor authentication is enabled on this account");
+      case "PASSWORD_HASH_INVALID":
+        return new ValidationError("Incorrect two-factor password");
+      case "PHONE_NUMBER_BANNED":
+        return new ForbiddenError("This phone number is banned from Telegram");
+      case "AUTH_KEY_UNREGISTERED":
+      case "AUTH_KEY_DUPLICATED":
+      case "SESSION_REVOKED":
+      case "SESSION_EXPIRED":
+      case "USER_DEACTIVATED":
+      case "USER_DEACTIVATED_BAN":
+        return new TelegramAuthRequiredError();
+      case "CHANNEL_PRIVATE":
+      case "CHANNEL_INVALID":
+      case "CHAT_ID_INVALID":
+        return new StorageNotInitializedError();
+      case "MSG_ID_INVALID":
+      case "MESSAGE_ID_INVALID":
+        return new TelegramFileNotFoundError();
+      case "FILE_REFERENCE_EXPIRED":
+      case "FILE_REFERENCE_INVALID":
+        return new TelegramFileNotFoundError(
+          "The Telegram file reference expired \u2014 re-upload the file to refresh it"
+        );
+      default:
+        return new TelegramConnectionError(fallbackMessage, {
+          code: error.code,
+          telegramError: msg
+        });
+    }
+  }
+  const detail = error instanceof Error ? error.message : String(error);
+  if (/timeout|ECONNRESET|ENOTFOUND|socket|network|connect/i.test(detail)) {
+    return new TelegramConnectionError(`${fallbackMessage} (network error)`, error);
+  }
+  return new TelegramConnectionError(
+    detail ? `${fallbackMessage}: ${detail}` : fallbackMessage,
+    error
+  );
+}
+
+// ../telegram/src/client.ts
+var HEALTH_TTL_MS = 3e4;
+var RECONNECT_COOLDOWN_MS = 5e3;
+var TelegramClientManager = class {
+  constructor(credentials, sessions) {
+    this.credentials = credentials;
+    this.sessions = sessions;
+  }
+  connections = /* @__PURE__ */ new Map();
+  lastReconnectAt = /* @__PURE__ */ new Map();
+  /** Returns a connected client, (re)connecting when needed. */
+  async getForUser(userId) {
+    const existing = this.connections.get(userId);
+    if (existing) {
+      if (existing.state === "CONNECTED" && this.isConnected(existing.client)) {
+        return existing.client;
+      }
+      if (existing.pending) return existing.pending;
+      if (existing.state === "AUTH_REQUIRED") {
+        throw new TelegramAuthRequiredError();
+      }
+      return this.reconnect(userId, existing);
+    }
+    return this.connectUser(userId);
+  }
+  /** Connection status for health reporting and the storage dashboard. */
+  statusForUser(userId) {
+    const connection = this.connections.get(userId);
+    if (!connection) {
+      return { state: "DISCONNECTED", lastError: null, lastCheckAt: null, healthy: null };
+    }
+    return {
+      state: connection.state,
+      lastError: connection.lastError,
+      lastCheckAt: connection.lastCheckAt ? new Date(connection.lastCheckAt) : null,
+      healthy: connection.lastCheckOk
+    };
+  }
+  /**
+   * Probes a user's connection. Cheap by default (connection state only);
+   * `deep` performs a real Telegram round-trip to validate the session.
+   */
+  async healthCheck(userId, deep = false) {
+    const connection = this.connections.get(userId);
+    if (!connection) {
+      try {
+        await this.getForUser(userId);
+      } catch (error) {
+        const state = error instanceof TelegramAuthRequiredError ? "AUTH_REQUIRED" : "ERROR";
+        const current = this.connections.get(userId);
+        if (current) current.state = state;
+        return {
+          healthy: false,
+          latencyMs: null,
+          message: error instanceof Error ? error.message : "Telegram is not connected",
+          targetTitle: null
+        };
+      }
+    }
+    const active = this.connections.get(userId);
+    if (!deep && active.lastCheckAt && Date.now() - active.lastCheckAt < HEALTH_TTL_MS) {
+      return {
+        healthy: active.lastCheckOk ?? false,
+        latencyMs: null,
+        message: active.lastError,
+        targetTitle: null
+      };
+    }
+    const startedAt = Date.now();
+    try {
+      await active.client.getMe();
+      active.lastCheckAt = Date.now();
+      active.lastCheckOk = true;
+      active.lastError = null;
+      active.state = "CONNECTED";
+      return {
+        healthy: true,
+        latencyMs: Date.now() - startedAt,
+        message: null,
+        targetTitle: null
+      };
+    } catch (error) {
+      const mapped = mapTelegramError(error, "Telegram health check failed");
+      active.lastCheckAt = Date.now();
+      active.lastCheckOk = false;
+      active.lastError = mapped.message;
+      active.state = mapped instanceof TelegramAuthRequiredError || mapped instanceof UnauthorizedError ? "AUTH_REQUIRED" : "ERROR";
+      return {
+        healthy: false,
+        latencyMs: Date.now() - startedAt,
+        message: mapped.message,
+        targetTitle: null
+      };
+    }
+  }
+  /** Registers an already-authenticated client (from the login flow). */
+  cacheClient(userId, client) {
+    this.connections.set(userId, {
+      client,
+      state: "CONNECTED",
+      pending: null,
+      lastError: null,
+      lastCheckAt: Date.now(),
+      lastCheckOk: true
+    });
+  }
+  /** Drops a user's connection (e.g. after logout) without touching storage. */
+  async disconnectUser(userId) {
+    const connection = this.connections.get(userId);
+    if (!connection) return;
+    this.connections.delete(userId);
+    try {
+      await connection.client.disconnect();
+    } catch {
+    }
+  }
+  async disconnectAll() {
+    const ids = [...this.connections.keys()];
+    await Promise.all(ids.map((userId) => this.disconnectUser(userId)));
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  isConnected(client) {
+    try {
+      return client.connected === true;
+    } catch {
+      return false;
+    }
+  }
+  async connectUser(userId) {
+    const session = await this.sessions.get(userId);
+    if (!session) {
+      throw new TelegramAuthRequiredError("Telegram account is not connected");
+    }
+    const connection = {
+      client: null,
+      state: "CONNECTING",
+      pending: null,
+      lastError: null,
+      lastCheckAt: null,
+      lastCheckOk: null
+    };
+    const attempt = this.establish(session.stringSession).then((client) => {
+      connection.client = client;
+      connection.state = "CONNECTED";
+      connection.pending = null;
+      connection.lastError = null;
+      return client;
+    });
+    connection.pending = attempt;
+    this.connections.set(userId, connection);
+    try {
+      return await attempt;
+    } catch (error) {
+      connection.pending = null;
+      const mapped = mapTelegramError(error, "Could not connect to Telegram");
+      connection.state = mapped instanceof TelegramAuthRequiredError || mapped instanceof UnauthorizedError ? "AUTH_REQUIRED" : "ERROR";
+      connection.lastError = mapped.message;
+      throw mapped;
+    }
+  }
+  async reconnect(userId, connection) {
+    const lastAttempt = this.lastReconnectAt.get(userId) ?? 0;
+    if (Date.now() - lastAttempt < RECONNECT_COOLDOWN_MS && connection.pending) {
+      return connection.pending;
+    }
+    this.lastReconnectAt.set(userId, Date.now());
+    connection.state = "RECONNECTING";
+    const session = await this.sessions.get(userId);
+    if (!session) {
+      connection.state = "AUTH_REQUIRED";
+      throw new TelegramAuthRequiredError("Telegram account is not connected");
+    }
+    const attempt = (async () => {
+      try {
+        await connection.client.disconnect().catch(() => void 0);
+      } catch {
+      }
+      return this.establish(session.stringSession);
+    })().then((client) => {
+      connection.client = client;
+      connection.state = "CONNECTED";
+      connection.pending = null;
+      connection.lastError = null;
+      return client;
+    }).catch((error) => {
+      connection.pending = null;
+      const mapped = mapTelegramError(error, "Could not reconnect to Telegram");
+      connection.state = mapped instanceof TelegramAuthRequiredError || mapped instanceof UnauthorizedError ? "AUTH_REQUIRED" : "ERROR";
+      connection.lastError = mapped.message;
+      throw mapped;
+    });
+    connection.pending = attempt;
+    return attempt;
+  }
+  async establish(sessionString) {
+    const client = new TelegramClient(
+      new StringSession(sessionString),
+      this.credentials.apiId,
+      this.credentials.apiHash,
+      { connectionRetries: 3 }
+    );
+    try {
+      await client.connect();
+      if (!client.connected) {
+        throw new TelegramConnectionError("Telegram client did not connect");
+      }
+      return client;
+    } catch (error) {
+      throw mapTelegramError(error, "Could not connect to Telegram");
+    }
+  }
+};
+function newTelegramClient(credentials) {
+  return new TelegramClient(new StringSession(""), credentials.apiId, credentials.apiHash, {
+    connectionRetries: 3
+  });
+}
+function extractCreatedChannel(result) {
+  const chats = result instanceof Api.Updates || result instanceof Api.UpdatesCombined ? result.chats : [];
+  for (const chat of chats) {
+    if (chat instanceof Api.Channel) return chat;
+  }
+  throw new TelegramConnectionError("Telegram did not return the created storage channel");
+}
+
+// ../telegram/src/provider.ts
+import { Readable as Readable2 } from "node:stream";
+import { Api as Api2 } from "telegram";
+import bigInt from "big-integer";
+import { CustomFile } from "telegram/client/uploads.js";
+var MAX_DOCUMENT_BYTES = 2 * 1024 * 1024 * 1024;
+var DOWNLOAD_CHUNK_BYTES = 512 * 1024;
+var TelegramStorageProvider = class {
+  constructor(client, options) {
+    this.client = client;
+    this.peer = new Api2.InputPeerChannel({
+      channelId: bigInt(options.chatId),
+      accessHash: bigInt(options.accessHash)
+    });
+    this.title = options.title ?? null;
+  }
+  name = "telegram";
+  peer;
+  title;
+  // ── Upload ───────────────────────────────────────────────────────────────
+  async put(input, control = {}) {
+    const total = input.data ? input.data.byteLength : input.size;
+    if (total === void 0 || !input.data && !input.path) {
+      throw new UploadFailedError("Upload input has neither data nor a spooled file");
+    }
+    if (total > MAX_DOCUMENT_BYTES) {
+      throw new UploadFailedError(
+        `Telegram does not accept documents larger than ${MAX_DOCUMENT_BYTES / (1024 * 1024 * 1024)} GB`
+      );
+    }
+    this.throwIfAborted(control.signal);
+    control.onProgress?.({ transferred: 0, total, percent: 0 });
+    try {
+      const file = input.data ? new CustomFile(input.name, total, "", input.data) : new CustomFile(input.name, total, input.path);
+      const message = await this.client.sendFile(this.peer, {
+        file,
+        forceDocument: true,
+        workers: 1,
+        // Surface transport-level progress to the caller. GramJS reports a
+        // 0..1 fraction. `isCanceled` lets us abort an in-flight upload.
+        progressCallback: Object.assign(
+          (fraction) => {
+            const clamped = Math.max(0, Math.min(1, fraction));
+            control.onProgress?.({
+              transferred: Math.round(clamped * total),
+              total,
+              percent: Math.round(clamped * 100)
+            });
+          },
+          {
+            get isCanceled() {
+              return control.signal?.aborted === true;
+            }
+          }
+        )
+      });
+      if (!(message instanceof Api2.Message)) {
+        throw new UploadFailedError("Telegram returned an unexpected upload response");
+      }
+      control.onProgress?.({ transferred: total, total, percent: 100 });
+      return {
+        messageId: message.id.toString(),
+        name: input.name,
+        size: total,
+        mimeType: input.mimeType
+      };
+    } catch (error) {
+      if (error instanceof OperationCancelledError) throw error;
+      throw mapTelegramError(error, "Telegram upload failed");
+    }
+  }
+  // ── Download ─────────────────────────────────────────────────────────────
+  async get(ref, control = {}) {
+    const message = await this.requireMessage(ref);
+    this.throwIfAborted(control.signal);
+    const size = this.documentSize(message);
+    control.onProgress?.({ transferred: 0, total: size, percent: 0 });
+    let data;
+    try {
+      data = await this.client.downloadMedia(message, {
+        progressCallback: (downloaded, total) => {
+          const transferred = Number(downloaded.toString());
+          const totalBytes = Number(total.toString());
+          control.onProgress?.({
+            transferred,
+            total: totalBytes,
+            percent: totalBytes > 0 ? Math.round(transferred / totalBytes * 100) : null
+          });
+        }
+      });
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram download failed");
+    }
+    if (!data || typeof data === "string") {
+      throw new TelegramFileNotFoundError("Telegram did not return file content");
+    }
+    const buffer = Buffer.from(data);
+    control.onProgress?.({
+      transferred: buffer.byteLength,
+      total: buffer.byteLength,
+      percent: 100
+    });
+    return buffer;
+  }
+  /**
+   * Streams the object in Telegram-sized chunks, so memory use stays bounded
+   * by one chunk regardless of file size. The first request happens here so
+   * that a missing message fails before the caller starts consuming bytes.
+   */
+  async getStream(ref, control = {}) {
+    const message = await this.requireMessage(ref);
+    this.throwIfAborted(control.signal);
+    const size = this.documentSize(message);
+    const media = message.media;
+    if (size === null || !media) {
+      throw new TelegramFileNotFoundError("Telegram did not return file content");
+    }
+    const iterator = this.client.iterDownload({
+      file: media,
+      fileSize: bigInt(size),
+      requestSize: DOWNLOAD_CHUNK_BYTES
+    });
+    let transferred = 0;
+    control.onProgress?.({ transferred: 0, total: size, percent: 0 });
+    const signal = control.signal;
+    return Readable2.from(
+      (async function* () {
+        try {
+          for await (const chunk of iterator) {
+            if (signal?.aborted) throw new OperationCancelledError();
+            const buffer = Buffer.from(chunk);
+            transferred += buffer.byteLength;
+            control.onProgress?.({
+              transferred,
+              total: size,
+              percent: size > 0 ? Math.round(transferred / size * 100) : null
+            });
+            yield buffer;
+          }
+        } catch (error) {
+          if (error instanceof OperationCancelledError) throw error;
+          throw mapTelegramError(error, "Telegram download failed");
+        }
+      })()
+    );
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────────
+  async delete(ref) {
+    try {
+      await this.client.deleteMessages(this.peer, [Number(ref.messageId)], { revoke: true });
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram delete failed");
+    }
+  }
+  async exists(ref) {
+    try {
+      return await this.stat(ref) !== null;
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram lookup failed");
+    }
+  }
+  /**
+   * Read-only listing of stored documents in the channel, newest first, up to
+   * `limit`. Only messages that carry a document are returned; text messages and
+   * service messages are skipped. Nothing is modified.
+   */
+  async listObjects(limit) {
+    const objects = [];
+    try {
+      for await (const message of this.client.iterMessages(this.peer, { limit: limit * 2 })) {
+        if (objects.length >= limit) break;
+        if (!(message instanceof Api2.Message)) continue;
+        const document = message.document;
+        if (!(document instanceof Api2.Document)) continue;
+        let fileName;
+        for (const attr of document.attributes) {
+          if (attr instanceof Api2.DocumentAttributeFilename) {
+            fileName = attr.fileName;
+            break;
+          }
+        }
+        objects.push({
+          messageId: message.id.toString(),
+          name: fileName ?? "file",
+          size: Number(document.size.toString()),
+          mimeType: document.mimeType
+        });
+      }
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram listing failed");
+    }
+    return objects;
+  }
+  async stat(ref) {
+    const message = await this.getMessage(ref.messageId);
+    if (!message?.media) return null;
+    const document = message.document;
+    if (!(document instanceof Api2.Document)) return null;
+    let fileName;
+    for (const attr of document.attributes) {
+      if (attr instanceof Api2.DocumentAttributeFilename) {
+        fileName = attr.fileName;
+        break;
+      }
+    }
+    return {
+      messageId: ref.messageId,
+      name: fileName ?? "file",
+      size: Number(document.size.toString()),
+      mimeType: document.mimeType
+    };
+  }
+  // ── Health ───────────────────────────────────────────────────────────────
+  /**
+   * Validates that the client is connected and the storage channel is
+   * reachable (a real Telegram round-trip on the channel peer).
+   */
+  async healthCheck() {
+    const startedAt = Date.now();
+    try {
+      if (!this.client.connected) {
+        return {
+          healthy: false,
+          latencyMs: null,
+          message: "Telegram client is not connected",
+          targetTitle: this.title
+        };
+      }
+      const result = await this.client.invoke(
+        new Api2.channels.GetFullChannel({ channel: this.peer })
+      );
+      const title = result instanceof Api2.messages.ChatFull && result.chats[0] instanceof Api2.Channel ? result.chats[0].title : this.title;
+      return {
+        healthy: true,
+        latencyMs: Date.now() - startedAt,
+        message: null,
+        targetTitle: title ?? null
+      };
+    } catch (error) {
+      const mapped = mapTelegramError(error, "Telegram storage health check failed");
+      return {
+        healthy: false,
+        latencyMs: Date.now() - startedAt,
+        message: mapped.message,
+        targetTitle: this.title
+      };
+    }
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  throwIfAborted(signal) {
+    if (signal?.aborted) throw new OperationCancelledError();
+    if (!this.client.connected) {
+      throw new TelegramConnectionError("Telegram client is not connected");
+    }
+  }
+  documentSize(message) {
+    const document = message.document;
+    if (document instanceof Api2.Document) return Number(document.size.toString());
+    return null;
+  }
+  async requireMessage(ref) {
+    const message = await this.getMessage(ref.messageId);
+    if (!message?.media) {
+      throw new TelegramFileNotFoundError();
+    }
+    return message;
+  }
+  async getMessage(id) {
+    try {
+      const messages = await this.client.getMessages(this.peer, { ids: [Number(id)] });
+      const first = messages[0];
+      return first instanceof Api2.Message ? first : void 0;
+    } catch (error) {
+      if (error instanceof TelegramAuthRequiredError) throw error;
+      throw mapTelegramError(error, "Telegram lookup failed");
+    }
+  }
+};
+
+// ../telegram/src/connection.ts
+import { Api as Api3 } from "telegram";
+import { computeCheck } from "telegram/Password.js";
+var TELEGRAM_PROVIDER = "telegram";
+var LOGIN_FLOW_TTL_MS = 5 * 60 * 1e3;
+var TelegramConnectionService = class {
+  constructor(repos, clientManager, credentials) {
+    this.repos = repos;
+    this.clientManager = clientManager;
+    this.credentials = credentials;
+  }
+  flows = /* @__PURE__ */ new Map();
+  /** Sends the Telegram confirmation code for the phone number. */
+  async startLogin(phone) {
+    this.sweepExpiredFlows();
+    await this.cancelLogin(phone);
+    const client = newTelegramClient(this.credentials);
+    try {
+      await client.connect();
+      const { phoneCodeHash } = await client.sendCode(
+        { apiId: this.credentials.apiId, apiHash: this.credentials.apiHash },
+        phone
+      );
+      this.flows.set(phone, { phone, client, phoneCodeHash, createdAt: Date.now() });
+    } catch (error) {
+      await this.disconnectQuietly(client);
+      throw mapTelegramError(error, "Could not send the Telegram confirmation code");
+    }
+  }
+  /** Verifies the confirmation code. Returns `password_required` for 2FA accounts. */
+  async verifyCode(phone, code) {
+    const flow = this.requireFlow(phone);
+    try {
+      await flow.client.invoke(
+        new Api3.auth.SignIn({
+          phoneNumber: flow.phone,
+          phoneCodeHash: flow.phoneCodeHash,
+          phoneCode: code
+        })
+      );
+    } catch (error) {
+      if (isPasswordRequiredError(error)) {
+        return { status: "password_required" };
+      }
+      throw mapTelegramError(error, "Telegram sign-in failed");
+    }
+    return this.finalizeLogin(flow);
+  }
+  /** Completes sign-in for accounts with two-factor authentication enabled. */
+  async verifyPassword(phone, password) {
+    const flow = this.requireFlow(phone);
+    try {
+      const passwordInfo = await flow.client.invoke(new Api3.account.GetPassword());
+      const check = await computeCheck(passwordInfo, password);
+      await flow.client.invoke(new Api3.auth.CheckPassword({ password: check }));
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram sign-in failed");
+    }
+    return this.finalizeLogin(flow);
+  }
+  /** Aborts a pending login flow (disconnects the client). */
+  async cancelLogin(phone) {
+    const flow = this.flows.get(phone);
+    if (flow) {
+      this.flows.delete(phone);
+      await this.disconnectQuietly(flow.client);
+    }
+  }
+  /**
+   * Ensures the user has a registered private storage channel, creating it
+   * on first use. Idempotent.
+   */
+  async ensureStorage(userId) {
+    const existing = await this.repos.storages.findByUserAndProvider(userId, TELEGRAM_PROVIDER);
+    if (existing) return existing;
+    const client = await this.clientManager.getForUser(userId);
+    return this.ensureStorageForClient(userId, client);
+  }
+  async ensureStorageForClient(userId, client) {
+    const existing = await this.repos.storages.findByUserAndProvider(userId, TELEGRAM_PROVIDER);
+    if (existing) return existing;
+    let channel;
+    try {
+      const result = await client.invoke(
+        new Api3.channels.CreateChannel({
+          title: "OmniCloud Storage",
+          about: "Private storage channel created by OmniCloud (https://github.com/Lacrous/OmniCloud)",
+          megagroup: false
+        })
+      );
+      channel = extractCreatedChannel(result);
+    } catch (error) {
+      throw mapTelegramError(error, "Could not create the private storage channel");
+    }
+    const accessHash = channel.accessHash?.toString();
+    if (!accessHash) {
+      throw new TelegramConnectionError("Telegram did not provide the channel access hash");
+    }
+    return this.repos.storages.create({
+      userId,
+      provider: TELEGRAM_PROVIDER,
+      title: channel.title ?? "OmniCloud Storage",
+      telegramChatId: channel.id.toString(),
+      telegramAccessHash: accessHash
+    });
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  requireFlow(phone) {
+    const flow = this.flows.get(phone);
+    if (!flow) {
+      throw new NotFoundError("No pending Telegram login for this phone number");
+    }
+    if (Date.now() - flow.createdAt > LOGIN_FLOW_TTL_MS) {
+      this.flows.delete(phone);
+      void this.disconnectQuietly(flow.client);
+      throw new ValidationError("The login session expired \u2014 please start again");
+    }
+    return flow;
+  }
+  async finalizeLogin(flow) {
+    this.flows.delete(flow.phone);
+    let stringSession;
+    let user;
+    try {
+      stringSession = flow.client.session.save();
+      const me = await flow.client.getMe();
+      if (!(me instanceof Api3.User)) {
+        throw new Error("Telegram did not return the authenticated user");
+      }
+      user = await this.repos.users.upsertFromTelegram({
+        telegramUserId: me.id.toString(),
+        username: me.username ?? null,
+        firstName: me.firstName ?? null,
+        lastName: me.lastName ?? null,
+        phone: me.phone ?? flow.phone
+      });
+    } catch (error) {
+      await this.disconnectQuietly(flow.client);
+      throw mapTelegramError(error, "Could not complete the Telegram connection");
+    }
+    await this.repos.sessions.save(user.id, stringSession);
+    await this.ensureStorageForClient(user.id, flow.client);
+    this.clientManager.cacheClient(user.id, flow.client);
+    return { status: "ok", user };
+  }
+  sweepExpiredFlows() {
+    const now = Date.now();
+    for (const [phone, flow] of this.flows) {
+      if (now - flow.createdAt > LOGIN_FLOW_TTL_MS) {
+        this.flows.delete(phone);
+        void this.disconnectQuietly(flow.client);
+      }
+    }
+  }
+  async disconnectQuietly(client) {
+    try {
+      await client.disconnect();
+    } catch {
+    }
+  }
+};
+
+// ../database/src/index.ts
+import {
+  PrismaClient
+} from "@prisma/client";
+import { PrismaClient as PrismaClient2 } from "@prisma/client";
+function createPrismaClient() {
+  return new PrismaClient();
+}
+function mapUser(user) {
+  return {
+    id: user.id,
+    telegramUserId: user.telegramUserId.toString(),
+    username: user.username,
+    firstName: user.firstName,
+    lastName: user.lastName,
+    phone: user.phone,
+    createdAt: user.createdAt
+  };
+}
+function mapStorage(storage) {
+  return {
+    id: storage.id,
+    userId: storage.userId,
+    provider: storage.provider,
+    title: storage.title,
+    telegramChatId: storage.telegramChatId.toString(),
+    telegramAccessHash: storage.telegramAccessHash.toString(),
+    createdAt: storage.createdAt
+  };
+}
+function mapFolder(folder) {
+  return {
+    id: folder.id,
+    userId: folder.userId,
+    parentId: folder.parentId,
+    name: folder.name,
+    starred: folder.starred,
+    deletedAt: folder.deletedAt,
+    trashBatchId: folder.trashBatchId,
+    createdAt: folder.createdAt,
+    updatedAt: folder.updatedAt
+  };
+}
+function mapFile(file) {
+  return {
+    id: file.id,
+    userId: file.userId,
+    folderId: file.folderId,
+    name: file.name,
+    size: Number(file.size),
+    mimeType: file.mimeType,
+    sha256: file.sha256,
+    telegramMessageId: Number(file.telegramMessageId),
+    starred: file.starred,
+    deletedAt: file.deletedAt,
+    trashBatchId: file.trashBatchId,
+    currentVersionId: file.currentVersionId,
+    versionCount: file.versionCount,
+    createdAt: file.createdAt,
+    updatedAt: file.updatedAt
+  };
+}
+function mapVersion(version, _currentVersionId) {
+  return {
+    id: version.id,
+    fileId: version.fileId,
+    userId: version.userId,
+    versionNumber: version.versionNumber,
+    size: Number(version.size),
+    mimeType: version.mimeType,
+    sha256: version.sha256,
+    telegramMessageId: Number(version.telegramMessageId),
+    createdAt: version.createdAt
+  };
+}
+function mapActivity(event) {
+  return {
+    id: event.id,
+    userId: event.userId,
+    action: event.action,
+    resourceType: event.resourceType,
+    resourceId: event.resourceId,
+    resourceName: event.resourceName,
+    metadata: event.metadata ?? null,
+    createdAt: event.createdAt
+  };
+}
+function fileWhere(userId, query) {
+  const where = { userId };
+  if (query.trashed === true) where.deletedAt = { not: null };
+  else if (query.trashed === false) where.deletedAt = null;
+  if (query.folderIds) {
+    where.folderId = { in: query.folderIds };
+  } else if (query.folderId !== void 0) {
+    where.folderId = query.folderId;
+  }
+  if (query.nameContains) {
+    where.name = { contains: query.nameContains, mode: "insensitive" };
+  }
+  if (query.starred !== void 0) where.starred = query.starred;
+  if (query.minSize !== void 0 || query.maxSize !== void 0) {
+    where.size = {};
+    if (query.minSize !== void 0) where.size.gte = BigInt(query.minSize);
+    if (query.maxSize !== void 0) where.size.lte = BigInt(query.maxSize);
+  }
+  if (query.from || query.to) {
+    where.createdAt = {};
+    if (query.from) where.createdAt.gte = query.from;
+    if (query.to) where.createdAt.lte = query.to;
+  }
+  if (query.ext) {
+    where.name = { ...where.name, endsWith: `.${query.ext}`, mode: "insensitive" };
+  }
+  if (query.mimeMatchers && query.mimeMatchers.length > 0) {
+    where.OR = query.mimeMatchers.map(
+      (matcher) => matcher.endsWith("/") ? { mimeType: { startsWith: matcher } } : { mimeType: matcher }
+    );
+  }
+  return where;
+}
+function folderWhere(userId, query) {
+  const where = { userId };
+  if (query.trashed === true) where.deletedAt = { not: null };
+  else if (query.trashed === false) where.deletedAt = null;
+  if (query.folderId !== void 0) where.parentId = query.folderId;
+  if (query.nameContains) where.name = { contains: query.nameContains, mode: "insensitive" };
+  if (query.starred !== void 0) where.starred = query.starred;
+  if (query.from || query.to) {
+    where.createdAt = {};
+    if (query.from) where.createdAt.gte = query.from;
+    if (query.to) where.createdAt.lte = query.to;
+  }
+  return where;
+}
+function fileOrderBy(query) {
+  const order = query.order ?? "asc";
+  switch (query.sort) {
+    case "size":
+      return [{ size: order }];
+    case "createdAt":
+      return [{ createdAt: order }];
+    case "updatedAt":
+      return [{ updatedAt: order }];
+    case "type":
+      return [{ mimeType: order }, { name: "asc" }];
+    case "name":
+    default:
+      return [{ name: order }, { createdAt: "asc" }];
+  }
+}
+function folderOrderBy(query) {
+  const order = query.order ?? "asc";
+  switch (query.sort) {
+    case "createdAt":
+      return [{ createdAt: order }];
+    case "updatedAt":
+      return [{ updatedAt: order }];
+    case "name":
+    default:
+      return [{ name: order }, { createdAt: "asc" }];
+  }
+}
+function skipTake(page) {
+  return { skip: (page.page - 1) * page.limit, take: page.limit };
+}
+function createUserRepo(prisma) {
+  return {
+    async findById(id) {
+      const user = await prisma.user.findUnique({ where: { id } });
+      return user ? mapUser(user) : null;
+    },
+    async findByTelegramId(telegramUserId) {
+      const user = await prisma.user.findUnique({
+        where: { telegramUserId: BigInt(telegramUserId) }
+      });
+      return user ? mapUser(user) : null;
+    },
+    async upsertFromTelegram(input) {
+      const data = {
+        username: input.username,
+        firstName: input.firstName,
+        lastName: input.lastName,
+        phone: input.phone
+      };
+      const user = await prisma.user.upsert({
+        where: { telegramUserId: BigInt(input.telegramUserId) },
+        update: data,
+        create: { telegramUserId: BigInt(input.telegramUserId), ...data }
+      });
+      return mapUser(user);
+    }
+  };
+}
+var SEALED_PREFIX = /^v\d+:/;
+function createSessionRepo(prisma, box) {
+  const seal = (value) => box ? box.seal(value) : value;
+  const open = (stored) => box && SEALED_PREFIX.test(stored) ? box.open(stored) : stored;
+  return {
+    async get(userId) {
+      const session = await prisma.telegramSession.findUnique({ where: { userId } });
+      if (!session) return null;
+      const stringSession = open(session.stringSession);
+      if (box && !SEALED_PREFIX.test(session.stringSession)) {
+        await prisma.telegramSession.update({
+          where: { userId },
+          data: { stringSession: seal(stringSession) }
+        });
+      }
+      const record = { userId: session.userId, stringSession };
+      return record;
+    },
+    async save(userId, stringSession) {
+      await prisma.telegramSession.upsert({
+        where: { userId },
+        update: { stringSession: seal(stringSession) },
+        create: { userId, stringSession: seal(stringSession) }
+      });
+    },
+    async delete(userId) {
+      await prisma.telegramSession.deleteMany({ where: { userId } });
+    }
+  };
+}
+function mapBrowserSession(row) {
+  return { ...row };
+}
+function mapUploadOperation(row) {
+  return {
+    id: row.id,
+    userId: row.userId,
+    operationId: row.operationId,
+    status: row.status,
+    telegramMessageId: row.telegramMessageId === null ? null : Number(row.telegramMessageId),
+    sha256: row.sha256,
+    size: row.size === null ? null : Number(row.size),
+    fileId: row.fileId,
+    error: row.error,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function createUploadOperationRepo(prisma) {
+  return {
+    async findByOperationId(userId, operationId) {
+      const row = await prisma.uploadOperation.findUnique({
+        where: { userId_operationId: { userId, operationId } }
+      });
+      return row ? mapUploadOperation(row) : null;
+    },
+    async listByStatus(userId, status) {
+      const rows = await prisma.uploadOperation.findMany({ where: { userId, status } });
+      return rows.map(mapUploadOperation);
+    },
+    async create(input) {
+      try {
+        const row = await prisma.uploadOperation.create({
+          data: { userId: input.userId, operationId: input.operationId, status: "PENDING" }
+        });
+        return mapUploadOperation(row);
+      } catch (error) {
+        if (error.code === "P2002") throw new OperationAlreadyExistsError();
+        throw error;
+      }
+    },
+    async claim(id, from, to) {
+      const result = await prisma.uploadOperation.updateMany({
+        where: { id, status: from },
+        data: { status: to }
+      });
+      return result.count === 1;
+    },
+    async update(id, patch) {
+      const row = await prisma.uploadOperation.update({
+        where: { id },
+        data: {
+          ...patch.status !== void 0 ? { status: patch.status } : {},
+          ...patch.telegramMessageId !== void 0 ? {
+            telegramMessageId: patch.telegramMessageId === null ? null : BigInt(patch.telegramMessageId)
+          } : {},
+          ...patch.sha256 !== void 0 ? { sha256: patch.sha256 } : {},
+          ...patch.size !== void 0 ? { size: patch.size === null ? null : BigInt(patch.size) } : {},
+          ...patch.fileId !== void 0 ? { fileId: patch.fileId } : {},
+          ...patch.error !== void 0 ? { error: patch.error } : {}
+        }
+      });
+      return mapUploadOperation(row);
+    }
+  };
+}
+function createBrowserSessionRepo(prisma) {
+  return {
+    async create(input) {
+      const row = await prisma.browserSession.create({ data: input });
+      return mapBrowserSession(row);
+    },
+    async findByTokenHash(tokenHash) {
+      const row = await prisma.browserSession.findUnique({ where: { tokenHash } });
+      return row ? mapBrowserSession(row) : null;
+    },
+    async touch(id, at) {
+      await prisma.browserSession.update({ where: { id }, data: { lastUsedAt: at } });
+    },
+    async revoke(id, at) {
+      await prisma.browserSession.updateMany({
+        where: { id, revokedAt: null },
+        data: { revokedAt: at }
+      });
+    },
+    async revokeAllForUser(userId, at) {
+      const result = await prisma.browserSession.updateMany({
+        where: { userId, revokedAt: null },
+        data: { revokedAt: at }
+      });
+      return result.count;
+    },
+    async listActiveForUser(userId, now) {
+      const rows = await prisma.browserSession.findMany({
+        where: { userId, revokedAt: null, expiresAt: { gt: now } },
+        orderBy: { createdAt: "desc" }
+      });
+      return rows.map(mapBrowserSession);
+    },
+    async deleteExpiredBefore(cutoff) {
+      const result = await prisma.browserSession.deleteMany({
+        where: { expiresAt: { lt: cutoff } }
+      });
+      return result.count;
+    }
+  };
+}
+function createStorageRepo(prisma) {
+  return {
+    async findByUserAndProvider(userId, provider) {
+      const storage = await prisma.storage.findUnique({
+        where: { userId_provider: { userId, provider } }
+      });
+      return storage ? mapStorage(storage) : null;
+    },
+    async create(input) {
+      const storage = await prisma.storage.create({
+        data: {
+          userId: input.userId,
+          provider: input.provider,
+          title: input.title,
+          telegramChatId: BigInt(input.telegramChatId),
+          telegramAccessHash: BigInt(input.telegramAccessHash)
+        }
+      });
+      return mapStorage(storage);
+    }
+  };
+}
+function createFolderRepo(prisma) {
+  return {
+    async moveSafely(id, newParentId) {
+      const folder = await prisma.$transaction(
+        async (tx) => {
+          if (newParentId !== null) {
+            let cursor = newParentId;
+            while (cursor !== null) {
+              if (cursor === id) {
+                throw new ConflictError("Cannot move a folder into one of its subfolders");
+              }
+              const parent = await tx.folder.findUnique({
+                where: { id: cursor },
+                select: { parentId: true }
+              });
+              if (!parent) throw new NotFoundError("Folder not found", "folder");
+              cursor = parent.parentId;
+            }
+          }
+          return tx.folder.update({ where: { id }, data: { parentId: newParentId } });
+        },
+        { isolationLevel: "Serializable" }
+      );
+      return mapFolder(folder);
+    },
+    async create(input) {
+      const folder = await prisma.folder.create({
+        data: { userId: input.userId, parentId: input.parentId, name: input.name }
+      });
+      return mapFolder(folder);
+    },
+    async findById(id) {
+      const folder = await prisma.folder.findUnique({ where: { id } });
+      return folder ? mapFolder(folder) : null;
+    },
+    async listByUser(userId) {
+      const rows = await prisma.folder.findMany({
+        where: { userId },
+        orderBy: { createdAt: "asc" }
+      });
+      return rows.map(mapFolder);
+    },
+    async listChildren(userId, parentId) {
+      const rows = await prisma.folder.findMany({
+        where: { userId, parentId, deletedAt: null },
+        orderBy: [{ name: "asc" }, { createdAt: "asc" }]
+      });
+      return rows.map(mapFolder);
+    },
+    async query(userId, query, page) {
+      const where = folderWhere(userId, query);
+      const [rows, total] = await Promise.all([
+        prisma.folder.findMany({
+          where,
+          orderBy: folderOrderBy(query),
+          ...skipTake(page)
+        }),
+        prisma.folder.count({ where })
+      ]);
+      return { items: rows.map(mapFolder), total };
+    },
+    async findIdsByName(userId, name) {
+      const rows = await prisma.folder.findMany({
+        where: { userId, name: { contains: name, mode: "insensitive" }, deletedAt: null },
+        select: { id: true }
+      });
+      return rows.map((row) => row.id);
+    },
+    async update(id, patch) {
+      const folder = await prisma.folder.update({
+        where: { id },
+        data: {
+          ...patch.name !== void 0 ? { name: patch.name } : {},
+          ...patch.parentId !== void 0 ? { parentId: patch.parentId } : {},
+          ...patch.starred !== void 0 ? { starred: patch.starred } : {},
+          ...patch.deletedAt !== void 0 ? { deletedAt: patch.deletedAt } : {},
+          ...patch.trashBatchId !== void 0 ? { trashBatchId: patch.trashBatchId } : {}
+        }
+      });
+      return mapFolder(folder);
+    },
+    async updateMany(ids, patch) {
+      const result = await prisma.folder.updateMany({
+        where: { id: { in: ids } },
+        data: {
+          ...patch.starred !== void 0 ? { starred: patch.starred } : {},
+          ...patch.deletedAt !== void 0 ? { deletedAt: patch.deletedAt } : {},
+          ...patch.trashBatchId !== void 0 ? { trashBatchId: patch.trashBatchId } : {}
+        }
+      });
+      return result.count;
+    },
+    async deleteMany(ids) {
+      let remaining = [...ids];
+      let guard = 0;
+      while (remaining.length > 0 && guard < 100) {
+        guard += 1;
+        const withChildren = await prisma.folder.findMany({
+          where: { parentId: { in: remaining } },
+          select: { parentId: true }
+        });
+        const parentsWithChildren = new Set(
+          withChildren.map((row) => row.parentId).filter((id) => id !== null)
+        );
+        const leaves = remaining.filter((id) => !parentsWithChildren.has(id));
+        if (leaves.length === 0) break;
+        await prisma.folder.deleteMany({ where: { id: { in: leaves } } });
+        remaining = remaining.filter((id) => !leaves.includes(id));
+      }
+      if (remaining.length > 0) {
+        await prisma.folder.deleteMany({ where: { id: { in: remaining } } });
+      }
+    },
+    async countByUser(userId) {
+      return prisma.folder.count({ where: { userId, deletedAt: null } });
+    }
+  };
+}
+function createFileRepo(prisma) {
+  return {
+    async create(input) {
+      const file = await prisma.file.create({
+        data: {
+          userId: input.userId,
+          folderId: input.folderId,
+          name: input.name,
+          size: BigInt(input.size),
+          mimeType: input.mimeType,
+          sha256: input.sha256,
+          telegramMessageId: BigInt(input.telegramMessageId)
+        }
+      });
+      return mapFile(file);
+    },
+    async findById(id) {
+      const file = await prisma.file.findUnique({ where: { id } });
+      return file ? mapFile(file) : null;
+    },
+    async listByFolder(userId, folderId) {
+      const rows = await prisma.file.findMany({
+        where: { userId, folderId, deletedAt: null },
+        orderBy: [{ name: "asc" }, { createdAt: "asc" }]
+      });
+      return rows.map(mapFile);
+    },
+    async listByUser(userId) {
+      const rows = await prisma.file.findMany({ where: { userId } });
+      return rows.map(mapFile);
+    },
+    async listByIds(userId, ids) {
+      if (ids.length === 0) return [];
+      const rows = await prisma.file.findMany({ where: { userId, id: { in: ids } } });
+      return rows.map(mapFile);
+    },
+    async query(userId, query, page) {
+      const where = fileWhere(userId, query);
+      const [rows, total] = await Promise.all([
+        prisma.file.findMany({ where, orderBy: fileOrderBy(query), ...skipTake(page) }),
+        prisma.file.count({ where })
+      ]);
+      return { items: rows.map(mapFile), total };
+    },
+    async update(id, patch) {
+      const file = await prisma.file.update({
+        where: { id },
+        data: {
+          ...patch.name !== void 0 ? { name: patch.name } : {},
+          ...patch.folderId !== void 0 ? { folderId: patch.folderId } : {},
+          ...patch.starred !== void 0 ? { starred: patch.starred } : {},
+          ...patch.deletedAt !== void 0 ? { deletedAt: patch.deletedAt } : {},
+          ...patch.trashBatchId !== void 0 ? { trashBatchId: patch.trashBatchId } : {},
+          ...patch.size !== void 0 ? { size: BigInt(patch.size) } : {},
+          ...patch.mimeType !== void 0 ? { mimeType: patch.mimeType } : {},
+          ...patch.sha256 !== void 0 ? { sha256: patch.sha256 } : {},
+          ...patch.telegramMessageId !== void 0 ? { telegramMessageId: BigInt(patch.telegramMessageId) } : {},
+          ...patch.currentVersionId !== void 0 ? { currentVersionId: patch.currentVersionId } : {},
+          ...patch.versionCount !== void 0 ? { versionCount: patch.versionCount } : {}
+        }
+      });
+      return mapFile(file);
+    },
+    async updateMany(ids, patch) {
+      const result = await prisma.file.updateMany({
+        where: { id: { in: ids } },
+        data: {
+          ...patch.folderId !== void 0 ? { folderId: patch.folderId } : {},
+          ...patch.starred !== void 0 ? { starred: patch.starred } : {},
+          ...patch.deletedAt !== void 0 ? { deletedAt: patch.deletedAt } : {},
+          ...patch.trashBatchId !== void 0 ? { trashBatchId: patch.trashBatchId } : {}
+        }
+      });
+      return result.count;
+    },
+    async statsByUser(userId) {
+      const [fileAgg, folderCount] = await Promise.all([
+        prisma.file.groupBy({
+          by: ["deletedAt"],
+          where: { userId },
+          _count: { _all: true },
+          _sum: { size: true }
+        }),
+        prisma.folder.count({ where: { userId, deletedAt: null } })
+      ]);
+      let fileCount = 0;
+      let totalBytes = 0;
+      let trashBytes = 0;
+      let trashFileCount = 0;
+      for (const group of fileAgg) {
+        const count = group._count._all;
+        const bytes = Number(group._sum.size ?? 0);
+        if (group.deletedAt === null) {
+          fileCount = count;
+          totalBytes = bytes;
+        } else {
+          trashFileCount = count;
+          trashBytes = bytes;
+        }
+      }
+      const starredCount = await prisma.file.count({
+        where: { userId, starred: true, deletedAt: null }
+      });
+      return { fileCount, folderCount, totalBytes, trashBytes, trashFileCount, starredCount };
+    },
+    async deleteMany(ids) {
+      await prisma.file.deleteMany({ where: { id: { in: ids } } });
+    },
+    // ── Versions ───────────────────────────────────────────────────────────
+    async createVersion(input) {
+      const count = await prisma.fileVersion.count({ where: { fileId: input.fileId } });
+      const version = await prisma.fileVersion.create({
+        data: {
+          fileId: input.fileId,
+          userId: input.userId,
+          versionNumber: count + 1,
+          size: BigInt(input.size),
+          mimeType: input.mimeType,
+          sha256: input.sha256,
+          telegramMessageId: BigInt(input.telegramMessageId)
+        }
+      });
+      return mapVersion(version, null);
+    },
+    async listVersionsForFiles(fileIds) {
+      const grouped = /* @__PURE__ */ new Map();
+      for (const id of fileIds) grouped.set(id, []);
+      if (fileIds.length === 0) return grouped;
+      const rows = await prisma.fileVersion.findMany({
+        where: { fileId: { in: fileIds } },
+        orderBy: { versionNumber: "desc" }
+      });
+      for (const row of rows) grouped.get(row.fileId)?.push(mapVersion(row, null));
+      return grouped;
+    },
+    async listVersions(fileId) {
+      const [rows, file] = await Promise.all([
+        prisma.fileVersion.findMany({ where: { fileId }, orderBy: { versionNumber: "desc" } }),
+        prisma.file.findUnique({ where: { id: fileId }, select: { currentVersionId: true } })
+      ]);
+      const currentId = file?.currentVersionId ?? null;
+      return rows.map((row) => mapVersion(row, currentId));
+    },
+    async findVersionById(versionId) {
+      const version = await prisma.fileVersion.findUnique({ where: { id: versionId } });
+      return version ? mapVersion(version, null) : null;
+    },
+    async countVersions(fileId) {
+      return prisma.fileVersion.count({ where: { fileId } });
+    },
+    async deleteVersionsByFileIds(fileIds) {
+      if (fileIds.length === 0) return;
+      await prisma.fileVersion.deleteMany({ where: { fileId: { in: fileIds } } });
+    }
+  };
+}
+function createActivityRepo(prisma) {
+  return {
+    async record(input) {
+      await prisma.activityEvent.create({
+        data: {
+          userId: input.userId,
+          action: input.action,
+          resourceType: input.resourceType,
+          resourceId: input.resourceId,
+          resourceName: input.resourceName ?? null,
+          metadata: input.metadata ?? void 0
+        }
+      });
+    },
+    async list(userId, page) {
+      const where = { userId };
+      const [rows, total] = await Promise.all([
+        prisma.activityEvent.findMany({
+          where,
+          orderBy: { createdAt: "desc" },
+          ...skipTake(page)
+        }),
+        prisma.activityEvent.count({ where })
+      ]);
+      return { items: rows.map(mapActivity), total };
+    },
+    async recentFiles(userId, actions, limit) {
+      const rows = await prisma.activityEvent.findMany({
+        where: { userId, resourceType: "file", action: { in: [...actions] } },
+        orderBy: [{ createdAt: "desc" }, { id: "desc" }],
+        take: limit
+      });
+      const seen = /* @__PURE__ */ new Set();
+      const result = [];
+      for (const row of rows) {
+        if (seen.has(row.resourceId)) continue;
+        seen.add(row.resourceId);
+        result.push(mapActivity(row));
+      }
+      return result;
+    },
+    async countByUser(userId) {
+      return prisma.activityEvent.count({ where: { userId } });
+    },
+    async pruneOlderThan(cutoff) {
+      const result = await prisma.activityEvent.deleteMany({
+        where: { createdAt: { lt: cutoff } }
+      });
+      return result.count;
+    }
+  };
+}
+function createPrismaRepos(prisma, box = null) {
+  return {
+    users: createUserRepo(prisma),
+    sessions: createSessionRepo(prisma, box),
+    browserSessions: createBrowserSessionRepo(prisma),
+    uploadOperations: createUploadOperationRepo(prisma),
+    storages: createStorageRepo(prisma),
+    folders: createFolderRepo(prisma),
+    files: createFileRepo(prisma),
+    activity: createActivityRepo(prisma)
+  };
+}
+
+// ../../apps/api/src/container.ts
+function buildContainer(config2, options = {}) {
+  const prisma = createPrismaClient();
+  const box = config2.encryptionKey ? new SecretBox([{ version: 1, key: deriveKey(config2.encryptionKey) }]) : null;
+  const repos = createPrismaRepos(prisma, box);
+  return buildContainerFromRepos(config2, repos, {
+    operationLog: options.operationLog ?? null,
+    dispose: () => prisma.$disconnect()
+  });
+}
+function buildContainerFromRepos(config2, repos, overrides = {}) {
+  const credentials = {
+    apiId: config2.telegramApiId,
+    apiHash: config2.telegramApiHash
+  };
+  const clientManager = new TelegramClientManager(credentials, repos.sessions);
+  const connection = overrides.connection ?? new TelegramConnectionService(repos, clientManager, credentials);
+  const engineCache = /* @__PURE__ */ new Map();
+  const defaultEngineFor = async (userId) => {
+    const cached = engineCache.get(userId);
+    if (cached) {
+      try {
+        return await cached;
+      } catch {
+        engineCache.delete(userId);
+      }
+    }
+    const promise = (async () => {
+      const storage = await repos.storages.findByUserAndProvider(userId, TELEGRAM_PROVIDER);
+      if (!storage) throw new StorageNotInitializedError();
+      const client = await clientManager.getForUser(userId);
+      return new StorageEngine(
+        new TelegramStorageProvider(client, {
+          chatId: storage.telegramChatId,
+          accessHash: storage.telegramAccessHash,
+          title: storage.title
+        })
+      );
+    })();
+    engineCache.set(userId, promise);
+    try {
+      return await promise;
+    } catch (error) {
+      engineCache.delete(userId);
+      throw error;
+    }
+  };
+  const engineFor = overrides.engineFor ?? defaultEngineFor;
+  const defaultStorageHealth = {
+    async health(userId, deep = false) {
+      const status = clientManager.statusForUser(userId);
+      const storage = await repos.storages.findByUserAndProvider(userId, TELEGRAM_PROVIDER);
+      if (!storage) {
+        return {
+          healthy: false,
+          latencyMs: null,
+          message: "Storage is not initialized",
+          targetTitle: null,
+          state: "DISCONNECTED"
+        };
+      }
+      const probe = await clientManager.healthCheck(userId, deep);
+      return {
+        ...probe,
+        targetTitle: probe.targetTitle ?? storage.title,
+        state: clientManager.statusForUser(userId).state || status.state
+      };
+    },
+    async disconnect(userId) {
+      await clientManager.disconnectUser(userId);
+    }
+  };
+  const activity = new ActivityService(repos.activity);
+  return {
+    config: config2,
+    repos,
+    connection,
+    storageHealth: overrides.storageHealth ?? defaultStorageHealth,
+    files: new FileService(
+      repos.files,
+      repos.folders,
+      engineFor,
+      activity,
+      repos.uploadOperations,
+      overrides.operationLog ?? null
+    ),
+    folders: new FolderService(repos.folders, repos.files, engineFor, activity),
+    search: new SearchService(repos.files, repos.folders),
+    stats: new StatsService(repos.files, repos.folders),
+    trash: new TrashService(repos.files, repos.folders, engineFor),
+    recent: new RecentService(repos.activity, repos.files),
+    activity,
+    integrity: new IntegrityService(repos.files, engineFor),
+    reconciliation: new ReconciliationService(repos, engineFor),
+    reconciliationFlow: new ReconciliationFlow(repos, engineFor),
+    authSessions: new AuthSessionService(repos.browserSessions),
+    engineFor,
+    shutdown: async () => {
+      await clientManager.disconnectAll();
+      await overrides.dispose?.();
+    }
+  };
+}
+
+// ../../apps/api/src/app.ts
+import { readFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+
+// ../../apps/api/src/csp.ts
+import { createHash as createHash5 } from "node:crypto";
+function sha256Source(content) {
+  return `'sha256-${createHash5("sha256").update(content, "utf8").digest("base64")}'`;
+}
+function buildContentSecurityPolicy(inlineScripts, inlineStyles) {
+  const scriptSources = ["'self'", ...inlineScripts.map(sha256Source)];
+  const styleSources = ["'self'", ...inlineStyles.map(sha256Source)];
+  return [
+    "default-src 'self'",
+    `script-src ${scriptSources.join(" ")}`,
+    `style-src ${styleSources.join(" ")}`,
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "object-src 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'"
+  ].join("; ");
+}
+function inlineBlocks(html) {
+  const scripts = [];
+  const styles = [];
+  for (const match of html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/g)) {
+    scripts.push(match[1]);
+  }
+  for (const match of html.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/g)) {
+    styles.push(match[1]);
+  }
+  return { scripts, styles };
+}
+
+// ../../apps/api/src/app.ts
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import Fastify from "fastify";
+import cookie from "@fastify/cookie";
+import multipart from "@fastify/multipart";
+import fastifyStatic from "@fastify/static";
+
+// ../../apps/api/src/auth.ts
+function registerAuthHook(app2, repos, authSessions) {
+  app2.addHook("preHandler", async (request) => {
+    const url = request.routeOptions?.url ?? "";
+    if (!url.startsWith("/api/") || url.startsWith("/api/auth/") || url.startsWith("/api/health")) {
+      return;
+    }
+    const session = await authSessions.resolve(request.cookies[SESSION_COOKIE]);
+    if (!session) throw new UnauthorizedError();
+    const user = await repos.users.findById(session.userId);
+    if (!user) throw new AuthInvalidError("Account no longer exists");
+    request.user = { id: user.id };
+    request.authSessionId = session.id;
+  });
+}
+async function issueSessionCookie(authSessions, request, reply, userId, cookieSecure) {
+  const { token } = await authSessions.issue(userId, {
+    userAgent: request.headers["user-agent"] ?? null,
+    ip: request.ip
+  });
+  reply.setCookie(SESSION_COOKIE, token, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: cookieSecure,
+    path: "/",
+    maxAge: DEFAULT_SESSION_TTL_DAYS * 24 * 60 * 60
+  });
+}
+async function currentUser(repos, authSessions, cookies) {
+  const session = await authSessions.resolve(cookies[SESSION_COOKIE]);
+  if (!session) return null;
+  return repos.users.findById(session.userId);
+}
+
+// ../../apps/api/src/logging.ts
+var SECRET_KEYS = [
+  "stringSession",
+  "session",
+  "cookie",
+  "password",
+  "code",
+  "token",
+  "tokenHash",
+  "encryptionKey",
+  "sessionSecret",
+  "OMNICLOUD_ENCRYPTION_KEY",
+  "SESSION_SECRET",
+  "TELEGRAM_API_HASH"
+];
+var REDACT_PATHS = [
+  "req.headers.cookie",
+  "req.headers.authorization",
+  "res.headers['set-cookie']",
+  ...SECRET_KEYS,
+  ...SECRET_KEYS.map((key) => `*.${key}`)
+];
+var LOGGER_OPTIONS = (level) => ({
+  level,
+  redact: { paths: REDACT_PATHS, censor: "[Redacted]" }
+});
+
+// ../../apps/api/src/http.ts
+import { randomUUID } from "node:crypto";
+function resolveRequestId(headers) {
+  const inbound = headers[REQUEST_ID_HEADER];
+  const candidate = Array.isArray(inbound) ? inbound[0] : inbound;
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= 128 ? candidate : randomUUID();
+}
+function attachRequestId(request, reply) {
+  reply.header(REQUEST_ID_HEADER, request.id);
+  return request.id;
+}
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "no-referrer",
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "Permissions-Policy": "geolocation=(), microphone=(), camera=()",
+  "X-Permitted-Cross-Domain-Policies": "none"
+};
+function applySecurityHeaders(reply) {
+  for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+    reply.header(name, value);
+  }
+}
+function isAllowedOrigin(origin, host, allowed) {
+  if (!origin) return true;
+  if (allowed.length > 0) return allowed.includes(origin);
+  if (!host) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+// ../../apps/api/src/rate-limit.ts
+function createRateLimiter({ windowMs, max }) {
+  const hits = /* @__PURE__ */ new Map();
+  return function check(key) {
+    const now = Date.now();
+    const recent = (hits.get(key) ?? []).filter((t) => now - t < windowMs);
+    if (recent.length >= max) {
+      throw new RateLimitedError(
+        `Too many attempts \u2014 try again in ${Math.ceil(windowMs / 1e3)} seconds`
+      );
+    }
+    recent.push(now);
+    hits.set(key, recent);
+    if (hits.size > 1e4) {
+      for (const [k, times] of hits) {
+        if (times.every((t) => now - t >= windowMs)) hits.delete(k);
+      }
+    }
+  };
+}
+
+// ../../apps/api/src/validation.ts
+function requireString(body, field) {
+  const value = optionalString(body, field);
+  if (value === void 0) {
+    throw new ValidationError(`Field "${field}" is required`);
+  }
+  return value;
+}
+function optionalString(body, field) {
+  if (body === null || typeof body !== "object") return void 0;
+  const value = body[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string") {
+    throw new ValidationError(`Field "${field}" must be a string`);
+  }
+  return value;
+}
+function stringOrNull(body, field) {
+  if (body === null || typeof body !== "object") {
+    throw new ValidationError("A JSON object body is required");
+  }
+  const value = body[field];
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "string" || value === "") return null;
+  return value;
+}
+function requireBody(request) {
+  if (request.body === void 0 || request.body === null) {
+    throw new ValidationError("A JSON object body is required");
+  }
+  if (typeof request.body !== "object" || Array.isArray(request.body)) {
+    throw new ValidationError("Request body must be a JSON object");
+  }
+  return request.body;
+}
+function optionalBoolean(body, field) {
+  if (body === null || typeof body !== "object") return void 0;
+  const value = body[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new ValidationError(`Field "${field}" must be a boolean`);
+}
+function requireStringArray(body, field, max = 500) {
+  if (body === null || typeof body !== "object") {
+    throw new ValidationError("A JSON object body is required");
+  }
+  const value = body[field];
+  if (!Array.isArray(value)) {
+    throw new ValidationError(`Field "${field}" must be an array of ids`);
+  }
+  if (value.length === 0) throw new ValidationError(`Field "${field}" must not be empty`);
+  if (value.length > max) {
+    throw new ValidationError(`Field "${field}" accepts at most ${max} ids`);
+  }
+  const ids = [];
+  for (const item of value) {
+    if (typeof item !== "string" || item.trim() === "") {
+      throw new ValidationError(`Field "${field}" must contain non-empty string ids`);
+    }
+    ids.push(item);
+  }
+  return [...new Set(ids)];
+}
+function requireEnum(body, field, allowed) {
+  const value = requireString(body, field);
+  if (!allowed.includes(value)) {
+    throw new ValidationError(`Field "${field}" must be one of: ${allowed.join(", ")}`);
+  }
+  return value;
+}
+function optionalQueryInt(value) {
+  if (value === void 0 || value === "" || value === null) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : void 0;
+}
+function optionalQueryBool(value) {
+  if (value === void 0 || value === "" || value === null) return void 0;
+  if (value === "true" || value === "1") return true;
+  if (value === "false" || value === "0") return false;
+  return void 0;
+}
+function optionalQueryString(value) {
+  if (typeof value !== "string" || value.trim() === "") return void 0;
+  return value.trim();
+}
+function parseListQuery(raw) {
+  const status = optionalQueryString(raw.status);
+  const query = {
+    page: normalizePage(raw.page),
+    limit: normalizeLimit(raw.limit),
+    sort: normalizeSort(raw.sort),
+    order: normalizeOrder(raw.order),
+    q: optionalQueryString(raw.q),
+    type: optionalQueryString(raw.type),
+    ext: optionalQueryString(raw.ext),
+    starred: optionalQueryBool(raw.starred),
+    // Default to active items: normal views must never surface trashed
+    // content. Trash/starred/search endpoints opt into their own scope.
+    status: status && ITEM_STATUSES.includes(status) ? status : "active",
+    minSize: optionalQueryInt(raw.minSize),
+    maxSize: optionalQueryInt(raw.maxSize),
+    from: optionalQueryString(raw.from),
+    to: optionalQueryString(raw.to)
+  };
+  if ("folderId" in raw) {
+    const folderId = raw.folderId;
+    query.folderId = typeof folderId === "string" && folderId !== "" ? folderId : null;
+  }
+  return { query, page: query.page, limit: query.limit };
+}
+
+// ../../apps/api/src/mappers.ts
+function toUserDTO(user) {
+  return {
+    id: user.id,
+    username: user.username,
+    firstName: user.firstName,
+    lastName: user.lastName
+  };
+}
+function toStorageDTO(storage) {
+  return {
+    id: storage.id,
+    provider: storage.provider,
+    title: storage.title,
+    createdAt: storage.createdAt.toISOString()
+  };
+}
+function toFileDTO(file) {
+  return {
+    id: file.id,
+    name: file.name,
+    size: file.size,
+    mimeType: file.mimeType,
+    sha256: file.sha256,
+    folderId: file.folderId,
+    starred: file.starred,
+    trashed: file.deletedAt !== null,
+    deletedAt: file.deletedAt ? file.deletedAt.toISOString() : null,
+    versionCount: file.versionCount,
+    currentVersionId: file.currentVersionId,
+    createdAt: file.createdAt.toISOString(),
+    updatedAt: file.updatedAt.toISOString()
+  };
+}
+function toFolderDTO(folder) {
+  return {
+    id: folder.id,
+    name: folder.name,
+    parentId: folder.parentId,
+    starred: folder.starred,
+    trashed: folder.deletedAt !== null,
+    deletedAt: folder.deletedAt ? folder.deletedAt.toISOString() : null,
+    createdAt: folder.createdAt.toISOString(),
+    updatedAt: folder.updatedAt.toISOString()
+  };
+}
+function toVersionDTO(version, currentVersionId) {
+  return {
+    id: version.id,
+    fileId: version.fileId,
+    versionNumber: version.versionNumber,
+    size: version.size,
+    mimeType: version.mimeType,
+    sha256: version.sha256,
+    telegramMessageId: version.telegramMessageId,
+    isCurrent: version.id === currentVersionId,
+    createdAt: version.createdAt.toISOString()
+  };
+}
+function toActivityDTO(event) {
+  return {
+    id: event.id,
+    action: event.action,
+    resourceType: event.resourceType,
+    resourceId: event.resourceId,
+    resourceName: event.resourceName,
+    metadata: event.metadata,
+    createdAt: event.createdAt.toISOString()
+  };
+}
+function toStatsDTO(stats) {
+  return {
+    fileCount: stats.fileCount,
+    folderCount: stats.folderCount,
+    totalBytes: stats.totalBytes,
+    trashBytes: stats.trashBytes,
+    trashFileCount: stats.trashFileCount,
+    starredCount: stats.starredCount,
+    byType: stats.byType,
+    largestFiles: stats.largestFiles.map(toFileDTO),
+    quotaBytes: stats.quotaBytes
+  };
+}
+function toStorageHealthDTO(input) {
+  const status = input.healthy ? "healthy" : input.state === "ERROR" || input.state === "AUTH_REQUIRED" ? "unavailable" : "degraded";
+  return {
+    provider: input.provider,
+    state: input.state,
+    status,
+    latencyMs: input.latencyMs,
+    message: input.message,
+    channelTitle: input.targetTitle,
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// ../../apps/api/src/routes/auth.ts
+var PHONE_PATTERN = /^\+?[0-9]\d{4,14}$/;
+function registerAuthRoutes(app2, container2) {
+  const limiter = createRateLimiter({ windowMs: 6e4, max: 10 });
+  app2.post("/api/auth/telegram/start", async (request, reply) => {
+    limiter(request.ip);
+    const body = requireBody(request);
+    const phone = requireString(body, "phone");
+    if (!PHONE_PATTERN.test(phone)) {
+      throw new ValidationError("Please provide a valid phone number in international format");
+    }
+    await container2.connection.startLogin(phone);
+    return reply.send({ ok: true });
+  });
+  app2.post("/api/auth/telegram/verify", async (request, reply) => {
+    limiter(request.ip);
+    const body = requireBody(request);
+    const phone = requireString(body, "phone");
+    const code = requireString(body, "code");
+    if (!/^\d{3,10}$/.test(code)) {
+      throw new ValidationError("Please provide the numeric Telegram login code");
+    }
+    const result = await container2.connection.verifyCode(phone, code);
+    if (result.status === "password_required") {
+      const response2 = { status: "password_required" };
+      return reply.send(response2);
+    }
+    await issueSessionCookie(
+      container2.authSessions,
+      request,
+      reply,
+      result.user.id,
+      container2.config.cookieSecure
+    );
+    const response = { status: "ok", user: toUserDTO(result.user) };
+    return reply.send(response);
+  });
+  app2.post("/api/auth/telegram/password", async (request, reply) => {
+    limiter(request.ip);
+    const body = requireBody(request);
+    const phone = requireString(body, "phone");
+    const password = requireString(body, "password");
+    if (password.length < 1) {
+      throw new ValidationError("Please provide the two-factor password");
+    }
+    const result = await container2.connection.verifyPassword(phone, password);
+    if (result.status !== "ok") {
+      throw new ValidationError("Sign-in incomplete");
+    }
+    await issueSessionCookie(
+      container2.authSessions,
+      request,
+      reply,
+      result.user.id,
+      container2.config.cookieSecure
+    );
+    return reply.send({ status: "ok", user: toUserDTO(result.user) });
+  });
+  app2.get("/api/auth/me", async (request) => {
+    const user = await currentUser(container2.repos, container2.authSessions, request.cookies);
+    if (!user) return { user: null, storage: null, health: null };
+    const storage = await container2.repos.storages.findByUserAndProvider(user.id, "telegram");
+    if (!storage) return { user: toUserDTO(user), storage: null, health: null };
+    const status = await container2.storageHealth.health(user.id, false);
+    return {
+      user: toUserDTO(user),
+      storage: toStorageDTO(storage),
+      health: toStorageHealthDTO({
+        provider: "telegram",
+        state: status.state,
+        healthy: status.healthy,
+        latencyMs: status.latencyMs,
+        message: status.message,
+        targetTitle: status.targetTitle
+      })
+    };
+  });
+  app2.post("/api/auth/logout-all", async (request, reply) => {
+    const user = await currentUser(container2.repos, container2.authSessions, request.cookies);
+    if (!user)
+      return reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Sign in first" } });
+    const revoked = await container2.authSessions.revokeAll(user.id);
+    reply.clearCookie(SESSION_COOKIE, { path: "/" });
+    return { ok: true, revoked };
+  });
+  app2.post("/api/auth/logout", async (request, reply) => {
+    const user = await currentUser(container2.repos, container2.authSessions, request.cookies);
+    await container2.authSessions.revoke(request.cookies[SESSION_COOKIE]);
+    if (user) await container2.storageHealth.disconnect(user.id);
+    reply.clearCookie(SESSION_COOKIE, { path: "/" });
+    return { ok: true };
+  });
+}
+
+// ../../apps/api/src/routes/files.ts
+function operationIdFrom(headers, fields) {
+  const header = headers["idempotency-key"];
+  if (typeof header === "string" && header !== "") return header;
+  const field = fields["operationId"];
+  if (field && !Array.isArray(field) && field.type === "field" && typeof field.value === "string") {
+    return field.value || void 0;
+  }
+  return void 0;
+}
+function folderIdFromFields(fields) {
+  const field = fields["folderId"];
+  if (!field || Array.isArray(field) || field.type !== "field") return null;
+  const value = field.value;
+  return typeof value === "string" && value !== "" ? value : null;
+}
+async function withSpooledUpload(part, maxUploadBytes, use) {
+  const spool = await spoolToFile(part.file, maxUploadBytes);
+  try {
+    if (part.file.truncated) {
+      throw new PayloadTooLargeError(
+        `Files larger than ${Math.floor(maxUploadBytes / (1024 * 1024))} MB are not supported`
+      );
+    }
+    return await use({ path: spool.path, size: spool.size, sha256: spool.sha256 });
+  } finally {
+    await spool.discard();
+  }
+}
+function registerFileRoutes(app2, container2) {
+  const maxUploadBytes = container2.config.maxUploadBytes;
+  app2.post("/api/files", async (request, reply) => {
+    const part = await request.file();
+    if (!part) throw new ValidationError('A multipart body with a "file" field is required');
+    if (!part.filename) throw new ValidationError("The uploaded file has no filename");
+    const folderId = folderIdFromFields(part.fields);
+    const operationId = operationIdFrom(request.headers, part.fields);
+    const record = await withSpooledUpload(
+      part,
+      maxUploadBytes,
+      (spooled) => container2.files.upload(request.user.id, {
+        folderId,
+        name: part.filename,
+        spooled,
+        operationId
+      })
+    );
+    return reply.status(201).send({ file: toFileDTO(record) });
+  });
+  app2.get("/api/files", async (request) => {
+    const { query, page, limit } = parseListQuery(request.query);
+    const result = await container2.files.query(request.user.id, query, { page, limit });
+    return {
+      files: result.items.map(toFileDTO),
+      pagination: { page, limit, total: result.total, hasMore: page * limit < result.total }
+    };
+  });
+  app2.post("/api/files/batch", async (request) => {
+    const body = requireBody(request);
+    const operation = requireEnum(body, "operation", BATCH_FILE_OPERATIONS);
+    const ids = requireStringArray(body, "ids");
+    const folderId = operation === "move" ? stringOrNull(body, "folderId") : void 0;
+    const operationId = stringOrNull(body, "operationId") ?? void 0;
+    if (operationId !== void 0 && !isValidOperationId(operationId)) {
+      throw new ValidationError("Invalid batch operation id");
+    }
+    const result = await container2.files.batch(request.user.id, ids, operation, {
+      folderId: folderId ?? null,
+      operationId
+    });
+    return {
+      ...result.operationId ? { operationId: result.operationId } : {},
+      requested: result.requested,
+      succeeded: result.succeeded,
+      failed: result.failed,
+      errors: result.errors.map((error) => ({
+        id: error.id,
+        code: "INVALID_REQUEST",
+        message: error.message
+      }))
+    };
+  });
+  app2.get("/api/files/:id", async (request) => {
+    const { id } = request.params;
+    const record = await container2.files.get(request.user.id, id);
+    return { file: toFileDTO(record) };
+  });
+  app2.get("/api/files/:id/versions", async (request) => {
+    const { id } = request.params;
+    const record = await container2.files.get(request.user.id, id);
+    const versions = await container2.files.listVersions(request.user.id, id);
+    return { versions: versions.map((v) => toVersionDTO(v, record.currentVersionId)) };
+  });
+  app2.post("/api/files/:id/replace", async (request, reply) => {
+    const { id } = request.params;
+    const part = await request.file();
+    if (!part) throw new ValidationError('A multipart body with a "file" field is required');
+    if (!part.filename) throw new ValidationError("The uploaded file has no filename");
+    const record = await withSpooledUpload(
+      part,
+      maxUploadBytes,
+      (spooled) => container2.files.upload(request.user.id, {
+        folderId: null,
+        name: part.filename,
+        spooled,
+        replaceFileId: id
+      })
+    );
+    return reply.send({ file: toFileDTO(record) });
+  });
+  app2.get("/api/files/:id/download", async (request, reply) => {
+    const { id } = request.params;
+    const { record, stream } = await container2.files.downloadStreamed(request.user.id, id);
+    const asciiName = record.name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+    reply.header("Content-Type", record.mimeType).header("Content-Length", record.size).header("X-Content-SHA256", record.sha256).header(
+      "Content-Disposition",
+      `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(record.name)}`
+    );
+    stream.once("error", (error) => {
+      request.log.error({ fileId: record.id, err: error }, "download stream failed");
+    });
+    return reply.send(stream);
+  });
+  app2.patch("/api/files/:id", async (request) => {
+    const { id } = request.params;
+    const body = requireBody(request);
+    const name = optionalString(body, "name");
+    const starred = optionalBoolean(body, "starred");
+    if (name === void 0 && starred === void 0) {
+      throw new ValidationError('At least one of "name" or "starred" is required');
+    }
+    let record = await container2.files.get(request.user.id, id);
+    if (name !== void 0) record = await container2.files.rename(request.user.id, id, name);
+    if (starred !== void 0)
+      record = await container2.files.setStarred(request.user.id, id, starred);
+    return { file: toFileDTO(record) };
+  });
+  app2.post("/api/files/:id/move", async (request) => {
+    const { id } = request.params;
+    const body = requireBody(request);
+    const folderId = stringOrNull(body, "folderId");
+    const record = await container2.files.move(request.user.id, id, folderId);
+    return { file: toFileDTO(record) };
+  });
+  app2.post("/api/files/:id/trash", async (request) => {
+    const { id } = request.params;
+    const record = await container2.files.trash(request.user.id, id);
+    return { file: toFileDTO(record) };
+  });
+  app2.post("/api/files/:id/restore", async (request) => {
+    const { id } = request.params;
+    const record = await container2.files.restore(request.user.id, id);
+    return { file: toFileDTO(record) };
+  });
+  app2.delete("/api/files/:id", async (request, reply) => {
+    const { id } = request.params;
+    await container2.files.deletePermanently(request.user.id, id);
+    return reply.status(204).send();
+  });
+}
+
+// ../../apps/api/src/routes/folders.ts
+function registerFolderRoutes(app2, container2) {
+  app2.post("/api/folders", async (request, reply) => {
+    const body = requireBody(request);
+    const name = optionalString(body, "name");
+    if (name === void 0) throw new ValidationError('Field "name" is required');
+    const parentId = stringOrNull(body, "parentId");
+    const record = await container2.folders.create(request.user.id, { name, parentId });
+    return reply.status(201).send({ folder: toFolderDTO(record) });
+  });
+  app2.get("/api/folders", async (request) => {
+    const raw = request.query;
+    if (!("parentId" in raw) && !("status" in raw) && !("q" in raw) && !("starred" in raw)) {
+      const folders = await container2.folders.listChildren(request.user.id, null);
+      return {
+        folders: folders.map(toFolderDTO),
+        pagination: { page: 1, limit: folders.length, total: folders.length, hasMore: false }
+      };
+    }
+    const { query, page, limit } = parseListQuery(raw);
+    if ("parentId" in raw) {
+      query.folderId = typeof raw.parentId === "string" && raw.parentId !== "" ? raw.parentId : null;
+    }
+    const result = await container2.folders.query(request.user.id, query, { page, limit });
+    return {
+      folders: result.items.map(toFolderDTO),
+      pagination: { page, limit, total: result.total, hasMore: page * limit < result.total }
+    };
+  });
+  app2.get("/api/folders/tree", async (request) => {
+    const folders = await container2.folders.tree(request.user.id);
+    return { folders: folders.map(toFolderDTO) };
+  });
+  app2.post("/api/folders/batch", async (request) => {
+    const body = requireBody(request);
+    const operation = requireEnum(body, "operation", BATCH_FOLDER_OPERATIONS);
+    const ids = requireStringArray(body, "ids");
+    const parentId = operation === "move" ? stringOrNull(body, "parentId") : void 0;
+    let succeeded = 0;
+    const errors = [];
+    for (const id of ids) {
+      try {
+        switch (operation) {
+          case "trash":
+            await container2.folders.trash(request.user.id, id);
+            break;
+          case "restore":
+            await container2.folders.restore(request.user.id, id);
+            break;
+          case "delete":
+            await container2.folders.deletePermanently(request.user.id, id);
+            break;
+          case "star":
+            await container2.folders.setStarred(request.user.id, id, true);
+            break;
+          case "unstar":
+            await container2.folders.setStarred(request.user.id, id, false);
+            break;
+          case "move":
+            await container2.folders.move(request.user.id, id, parentId ?? null);
+            break;
+        }
+        succeeded += 1;
+      } catch (error) {
+        errors.push({
+          id,
+          code: "INVALID_REQUEST",
+          message: error instanceof Error ? error.message : "Operation failed"
+        });
+      }
+    }
+    return { requested: ids.length, succeeded, failed: errors.length, errors };
+  });
+  app2.patch("/api/folders/:id", async (request) => {
+    const { id } = request.params;
+    const body = requireBody(request);
+    const name = optionalString(body, "name");
+    const starred = optionalBoolean(body, "starred");
+    if (name === void 0 && starred === void 0) {
+      throw new ValidationError('At least one of "name" or "starred" is required');
+    }
+    let record = await container2.folders.get(request.user.id, id);
+    if (name !== void 0) record = await container2.folders.rename(request.user.id, id, name);
+    if (starred !== void 0) {
+      record = await container2.folders.setStarred(request.user.id, id, starred);
+    }
+    return { folder: toFolderDTO(record) };
+  });
+  app2.post("/api/folders/:id/move", async (request) => {
+    const { id } = request.params;
+    const body = requireBody(request);
+    const parentId = stringOrNull(body, "parentId");
+    const record = await container2.folders.move(request.user.id, id, parentId);
+    return { folder: toFolderDTO(record) };
+  });
+  app2.post("/api/folders/:id/trash", async (request) => {
+    const { id } = request.params;
+    const result = await container2.folders.trash(request.user.id, id);
+    return { affectedFolders: result.affectedFolders, affectedFiles: result.affectedFiles };
+  });
+  app2.post("/api/folders/:id/restore", async (request) => {
+    const { id } = request.params;
+    const result = await container2.folders.restore(request.user.id, id);
+    return { affectedFolders: result.affectedFolders, affectedFiles: result.affectedFiles };
+  });
+  app2.delete("/api/folders/:id", async (request) => {
+    const { id } = request.params;
+    const result = await container2.folders.deletePermanently(request.user.id, id);
+    return { affectedFolders: result.affectedFolders, affectedFiles: result.affectedFiles };
+  });
+}
+
+// ../../apps/api/src/routes/collections.ts
+function registerCollectionRoutes(app2, container2) {
+  app2.get("/api/trash", async (request) => {
+    const raw = request.query;
+    const { query, page, limit } = parseListQuery(raw);
+    const listing = await container2.trash.list(request.user.id, { page, limit }, query);
+    return {
+      files: listing.files.map(toFileDTO),
+      folders: listing.folders.map(toFolderDTO),
+      pagination: listing.pagination
+    };
+  });
+  app2.post("/api/trash/empty", async (request) => {
+    const result = await container2.trash.empty(request.user.id);
+    return {
+      deletedFiles: result.deletedFiles,
+      deletedFolders: result.deletedFolders,
+      failedFiles: result.failedFiles
+    };
+  });
+  app2.get("/api/starred", async (request) => {
+    const raw = request.query;
+    const { query, page, limit } = parseListQuery(raw);
+    const merged = { ...query, starred: true, folderId: void 0 };
+    const [fileResult, folderResult] = await Promise.all([
+      container2.files.query(request.user.id, merged, { page, limit }),
+      container2.folders.query(request.user.id, merged, { page, limit })
+    ]);
+    const total = fileResult.total + folderResult.total;
+    return {
+      files: fileResult.items.map(toFileDTO),
+      folders: folderResult.items.map(toFolderDTO),
+      pagination: { page, limit, total, hasMore: page * limit < total }
+    };
+  });
+  app2.get("/api/recent", async (request) => {
+    const { page, limit } = parseListQuery(request.query);
+    return container2.recent.list(request.user.id, { page, limit });
+  });
+  app2.get("/api/search", async (request) => {
+    const raw = request.query;
+    const query = typeof raw.q === "string" ? raw.q : "";
+    if (query.trim() === "") {
+      throw new ValidationError('Query parameter "q" is required');
+    }
+    const { page, limit } = parseListQuery(raw);
+    const result = await container2.search.search(request.user.id, query, { page, limit });
+    return {
+      files: result.files.map(toFileDTO),
+      folders: result.folders.map(toFolderDTO),
+      pagination: result.pagination
+    };
+  });
+  app2.get("/api/activity", async (request) => {
+    const { page, limit } = parseListQuery(request.query);
+    const result = await container2.activity.list(request.user.id, { page, limit });
+    return {
+      events: result.items.map(toActivityDTO),
+      pagination: { page, limit, total: result.total, hasMore: page * limit < result.total }
+    };
+  });
+}
+
+// ../../apps/api/src/health.ts
+function readiness(checks) {
+  const required = checks.filter((check) => check.name !== "storage");
+  const ready = required.every((check) => check.state === "healthy");
+  return { ready, checks };
+}
+function encryptionCheck(configured) {
+  return configured ? { name: "encryption", state: "healthy", detail: null } : {
+    name: "encryption",
+    state: "not_configured",
+    detail: "OMNICLOUD_ENCRYPTION_KEY is not set; Telegram sessions are stored unsealed"
+  };
+}
+
+// ../../apps/api/src/routes/storage.ts
+var VERSION = "0.2.4";
+function registerStorageRoutes(app2, container2) {
+  app2.get("/api/health", async () => {
+    const database = await probeDatabase(container2);
+    return {
+      status: database,
+      database,
+      storage: "unknown",
+      uptimeSeconds: Math.round(process.uptime()),
+      version: VERSION
+    };
+  });
+  app2.get("/api/health/live", async () => ({ status: "live" }));
+  app2.get("/api/health/ready", async (_request, reply) => {
+    const database = await probeDatabase(container2);
+    const report = readiness([
+      {
+        name: "database",
+        state: database === "healthy" ? "healthy" : "unhealthy",
+        detail: database === "healthy" ? null : "database did not answer"
+      },
+      encryptionCheck(container2.config.encryptionKey !== null)
+    ]);
+    if (!report.ready) reply.status(503);
+    return report;
+  });
+  app2.get("/api/health/database", async () => {
+    const database = await probeDatabase(container2);
+    return { status: database, database };
+  });
+  app2.post("/api/storage/ensure", async (request) => {
+    const storage = await container2.connection.ensureStorage(request.user.id);
+    return { storage: toStorageDTO(storage) };
+  });
+  app2.get("/api/storage/health", async (request) => {
+    const health = await container2.storageHealth.health(request.user.id);
+    const stats = await container2.stats.stats(request.user.id, container2.config.quotaBytes);
+    return {
+      health: toStorageHealthDTO({
+        provider: "telegram",
+        state: health.state,
+        healthy: health.healthy,
+        latencyMs: health.latencyMs,
+        message: health.message,
+        targetTitle: health.targetTitle
+      }),
+      stats: toStatsDTO(stats)
+    };
+  });
+  app2.post("/api/storage/health/check", async (request) => {
+    const body = request.body ?? {};
+    const deep = optionalBoolean(body, "deep") ?? false;
+    const health = await container2.storageHealth.health(request.user.id, deep);
+    return {
+      health: toStorageHealthDTO({
+        provider: "telegram",
+        state: health.state,
+        healthy: health.healthy,
+        latencyMs: health.latencyMs,
+        message: health.message,
+        targetTitle: health.targetTitle
+      })
+    };
+  });
+  app2.get("/api/storage/stats", async (request) => {
+    const stats = await container2.stats.stats(request.user.id, container2.config.quotaBytes);
+    return { stats: toStatsDTO(stats) };
+  });
+  app2.post("/api/storage/reconciliation/plan", async (request) => {
+    const plan = await container2.reconciliationFlow.plan(request.user.id);
+    return { plan };
+  });
+  app2.post("/api/storage/reconciliation/apply", async (request) => {
+    const body = requireBody(request);
+    const raw = body.approvedIds;
+    const approvedIds = Array.isArray(raw) && raw.length === 0 ? [] : requireStringArray(body, "approvedIds");
+    if (approvedIds.length > 200) throw new ValidationError("Approve at most 200 repairs at once");
+    const result = await container2.reconciliationFlow.apply(request.user.id, approvedIds);
+    return { result };
+  });
+  app2.post("/api/storage/reconciliation", async (request) => {
+    const report = await container2.reconciliation.run(request.user.id);
+    return { report };
+  });
+  app2.post("/api/storage/integrity/check", async (request) => {
+    const body = requireBody(request);
+    const deep = optionalBoolean(body, "deep") ?? false;
+    const report = await container2.integrity.check(request.user.id, { deep });
+    return { report };
+  });
+}
+async function probeDatabase(container2) {
+  try {
+    await container2.repos.users.findById("__health_probe__");
+    return "healthy";
+  } catch {
+    return "unavailable";
+  }
+}
+
+// ../../apps/api/src/app.ts
+function sendError(reply, status, code, message, requestId, details) {
+  void reply.status(status).send({ error: { code, message, requestId, ...details ? { details } : {} } });
+}
+async function createApp(container2) {
+  const app2 = Fastify({
+    logger: LOGGER_OPTIONS(container2.config.logLevel),
+    // JSON request bodies are tiny; uploads go through multipart, not bodyLimit.
+    bodyLimit: 2 * 1024 * 1024,
+    trustProxy: container2.config.trustProxy,
+    genReqId: (request) => resolveRequestId(request.headers)
+  });
+  await app2.register(cookie);
+  await app2.register(multipart, {
+    limits: { fileSize: container2.config.maxUploadBytes, files: 1, parts: 10 }
+  });
+  app2.addHook("onRequest", async (request, reply) => {
+    attachRequestId(request, reply);
+    applySecurityHeaders(reply);
+  });
+  app2.addHook("preHandler", async (request) => {
+    if (["POST", "PUT", "PATCH", "DELETE"].includes(request.method)) {
+      const origin = request.headers.origin;
+      const host = request.headers.host;
+      if (!isAllowedOrigin(origin, host, container2.config.allowedOrigins)) {
+        throw new ForbiddenError("Cross-origin request rejected");
+      }
+    }
+  });
+  registerAuthHook(app2, container2.repos, container2.authSessions);
+  app2.setErrorHandler((error, request, reply) => {
+    if (error instanceof DomainError) {
+      sendError(reply, error.status, error.code, error.message, request.id, error.details);
+      return reply;
+    }
+    const code = error.code ?? "";
+    if (code === "FST_PART_FILE_TOO_LARGE" || code === "FST_ERR_CTP_BODY_TOO_LARGE") {
+      sendError(reply, 413, "PAYLOAD_TOO_LARGE", "The uploaded file is too large", request.id);
+      return reply;
+    }
+    if (code === "FST_REQ_FILE_TOO_LARGE") {
+      sendError(reply, 413, "PAYLOAD_TOO_LARGE", "The uploaded file is too large", request.id);
+      return reply;
+    }
+    if (typeof error.statusCode === "number") {
+      sendError(reply, error.statusCode, "INVALID_REQUEST", error.message, request.id);
+      return reply;
+    }
+    request.log.error({ err: error, requestId: request.id }, "Unhandled error");
+    sendError(reply, 500, "INTERNAL_ERROR", "Internal server error", request.id);
+    return reply;
+  });
+  registerAuthRoutes(app2, container2);
+  registerFileRoutes(app2, container2);
+  registerFolderRoutes(app2, container2);
+  registerCollectionRoutes(app2, container2);
+  registerStorageRoutes(app2, container2);
+  const webDistDir = container2.config.webDistDir;
+  if (webDistDir && existsSync(webDistDir)) {
+    await app2.register(fastifyStatic, { root: resolve(webDistDir), wildcard: false });
+    const indexHtml = readFileSync(join2(resolve(webDistDir), "index.html"), "utf8");
+    const { scripts, styles } = inlineBlocks(indexHtml);
+    const contentSecurityPolicy = buildContentSecurityPolicy(scripts, styles);
+    app2.addHook("onSend", async (request, reply, payload) => {
+      if (request.method === "GET" && !request.url.startsWith("/api/")) {
+        reply.header("Content-Security-Policy", contentSecurityPolicy);
+      }
+      return payload;
+    });
+    app2.setNotFoundHandler((request, reply) => {
+      if (request.method === "GET" && !request.url.startsWith("/api/")) {
+        return reply.sendFile("index.html");
+      }
+      sendError(reply, 404, "NOT_FOUND", "Not found", request.id);
+      return reply;
+    });
+  } else {
+    app2.setNotFoundHandler((request, reply) => {
+      sendError(reply, 404, "NOT_FOUND", "Not found", request.id);
+      return reply;
+    });
+  }
+  return app2;
+}
+
+// ../../apps/api/src/index.ts
+var config = loadConfig();
+var operationLogTarget = { log: null };
+var container = buildContainer(config, {
+  operationLog: {
+    info: (record, message) => operationLogTarget.log?.info(record, message),
+    warn: (record, message) => operationLogTarget.log?.warn(record, message)
+  }
+});
+var app = await createApp(container);
+operationLogTarget.log = app.log;
+async function shutdown(signal) {
+  app.log.info({ signal }, "Shutting down");
+  await app.close();
+  await container.shutdown();
+  process.exit(0);
+}
+process.on("SIGINT", () => void shutdown("SIGINT"));
+process.on("SIGTERM", () => void shutdown("SIGTERM"));
+try {
+  const staleSpools = await sweepStaleSpools().catch((error) => {
+    app.log.warn({ err: error }, "Could not sweep stale upload spools");
+    return 0;
+  });
+  if (staleSpools > 0)
+    app.log.info({ staleSpools }, "Removed upload spools left by a stopped process");
+  await app.listen({ port: config.port, host: config.host });
+  const pruneSessions = () => container.authSessions.pruneExpired().then(
+    (removed) => {
+      if (removed > 0) app.log.info({ removed }, "Pruned expired browser sessions");
+    },
+    (error) => app.log.warn({ err: error }, "Could not prune expired sessions")
+  );
+  void pruneSessions();
+  setInterval(pruneSessions, 60 * 60 * 1e3).unref();
+} catch (error) {
+  app.log.error({ err: error }, "Failed to start");
+  await container.shutdown();
+  process.exit(1);
+}