@muhgholy/next-drive 4.23.24 → 4.23.26

package/dist/{chunk-IVSBLEMY.cjs → chunk-DUTHZ5HA.cjs}

@@ -1,28 +1,28 @@
 'use strict';
 
-var mongoose = require('mongoose');
+var fs = require('fs');
 var path = require('path');
+var stream = require('stream');
+var mongoose = require('mongoose');
+var server = require('@tus/server');
+var fileStore = require('@tus/file-store');
 var os2 = require('os');
-var fs = require('fs');
-var crypto3 = require('crypto');
+var crypto2 = require('crypto');
 var sharp2 = require('sharp');
 var ffmpeg = require('fluent-ffmpeg');
 var googleapis = require('googleapis');
-var formidable = require('formidable');
-var zod = require('zod');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var mongoose__default = /*#__PURE__*/_interopDefault(mongoose);
+var fs__default = /*#__PURE__*/_interopDefault(fs);
 var path__default = /*#__PURE__*/_interopDefault(path);
+var mongoose__default = /*#__PURE__*/_interopDefault(mongoose);
 var os2__default = /*#__PURE__*/_interopDefault(os2);
-var fs__default = /*#__PURE__*/_interopDefault(fs);
-var crypto3__default = /*#__PURE__*/_interopDefault(crypto3);
+var crypto2__default = /*#__PURE__*/_interopDefault(crypto2);
 var sharp2__default = /*#__PURE__*/_interopDefault(sharp2);
 var ffmpeg__default = /*#__PURE__*/_interopDefault(ffmpeg);
-var formidable__default = /*#__PURE__*/_interopDefault(formidable);
 
-// src/server/config.ts
+// src/server/tus.ts
 var informationSchema = new mongoose.Schema({
   type: { type: String, enum: ["FILE", "FOLDER"], required: true },
   sizeInBytes: { type: Number, default: 0 },
@@ -263,7 +263,7 @@ var getGlobal = () => {
       config: null,
       migrationPromise: null,
       initialized: false,
-      abuse: { ipHits: /* @__PURE__ */ new Map(), concurrent: 0 }
+      abuse: { ipHits: /* @__PURE__ */ new Map(), active: /* @__PURE__ */ new Map(), lastSweep: 0 }
     };
   }
   return globalThis[GLOBAL_KEY];
@@ -343,53 +343,6 @@ var getDriveInformation = async (input) => {
   }
   return config.information(input);
 };
-
-// src/server/actions/cors.ts
-var applyCorsHeaders = (req, res, config) => {
-  const cors = config.cors;
-  if (!cors?.enabled) return false;
-  const origin = req.headers.origin;
-  const allowedOrigins = cors.origins ?? "*";
-  const methods = cors.methods ?? ["GET", "POST", "PUT", "DELETE", "OPTIONS"];
-  const allowedHeaders = cors.allowedHeaders ?? ["Content-Type", "Authorization", "X-Drive-Account"];
-  const exposedHeaders = cors.exposedHeaders ?? ["Content-Length", "Content-Type", "Content-Disposition"];
-  const credentials = cors.credentials ?? false;
-  const maxAge = cors.maxAge ?? 86400;
-  let allowOrigin = null;
-  if (origin) {
-    if (allowedOrigins === "*") {
-      allowOrigin = origin;
-    } else if (Array.isArray(allowedOrigins)) {
-      if (allowedOrigins.includes(origin)) {
-        allowOrigin = origin;
-      }
-    } else if (allowedOrigins === origin) {
-      allowOrigin = origin;
-    }
-  } else if (allowedOrigins === "*") {
-    allowOrigin = "*";
-  }
-  if (!allowOrigin) {
-    if (req.method === "OPTIONS") {
-      res.status(403).end();
-      return true;
-    }
-    return false;
-  }
-  res.setHeader("Access-Control-Allow-Origin", allowOrigin);
-  res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
-  res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
-  res.setHeader("Access-Control-Expose-Headers", exposedHeaders.join(", "));
-  res.setHeader("Access-Control-Max-Age", maxAge.toString());
-  if (credentials) {
-    res.setHeader("Access-Control-Allow-Credentials", "true");
-  }
-  if (req.method === "OPTIONS") {
-    res.status(204).end();
-    return true;
-  }
-  return false;
-};
 var validateMimeType = (mime, allowedTypes) => {
   if (allowedTypes.includes("*/*")) return true;
   return allowedTypes.some((pattern) => {
@@ -402,7 +355,7 @@ var validateMimeType = (mime, allowedTypes) => {
   });
 };
 var computeFileHash = (filePath) => new Promise((resolve, reject) => {
-  const hash = crypto3__default.default.createHash("sha256");
+  const hash = crypto2__default.default.createHash("sha256");
   const stream = fs__default.default.createReadStream(filePath);
   stream.on("data", (data) => hash.update(data));
   stream.on("end", () => resolve(hash.digest("hex")));
@@ -553,12 +506,6 @@ var getImageSettings = (fileSizeInBytes, qualityPreset, display, size, fit, posi
     ...resolvedPosition && { position: resolvedPosition }
   };
 };
-
-// src/server/security/crypto-utils.ts
-function sanitizeContentDispositionFilename(filename) {
-  const basename = filename.replace(/^.*[\\\/]/, "");
-  return basename.replace(/["\r\n]/g, "").replace(/[^\x20-\x7E]/g, "").slice(0, 255);
-}
 var generatePlaceholderThumbnail = async (outputPath, mimeType) => {
   const typeParts = mimeType.split("/");
   const subtype = typeParts[1] || "file";
@@ -1253,368 +1200,7 @@ var GoogleDriveProvider = {
   }
 };
 
-// src/server/actions/public.ts
-var handlePublicAction = async (req, res, action, config) => {
-  if (action !== "serve" && action !== "thumbnail") {
-    return false;
-  }
-  try {
-    const { id, token } = req.query;
-    if (!id || typeof id !== "string") {
-      res.status(400).json({ status: 400, message: "Could not open file: missing or invalid file ID" });
-      return true;
-    }
-    const drive = await drive_default.findById(id);
-    if (!drive) {
-      res.status(404).json({ status: 404, message: "File not found or no longer available" });
-      return true;
-    }
-    if (config.security?.signedUrls?.enabled) {
-      if (!token || typeof token !== "string") {
-        res.status(401).json({ status: 401, message: "Access denied: this link is missing its access token" });
-        return true;
-      }
-      try {
-        const decoded = Buffer.from(token, "base64url").toString();
-        const [expiryStr, signature] = decoded.split(":");
-        const expiry = parseInt(expiryStr, 10);
-        if (Date.now() / 1e3 > expiry) {
-          res.status(401).json({ status: 401, message: "Access denied: this link has expired" });
-          return true;
-        }
-        const { secret } = config.security.signedUrls;
-        const expectedSignature = crypto3__default.default.createHmac("sha256", secret).update(`${id}:${expiry}`).digest("hex");
-        if (signature !== expectedSignature) {
-          res.status(401).json({ status: 401, message: "Access denied: this link's access token is invalid" });
-          return true;
-        }
-      } catch {
-        res.status(401).json({ status: 401, message: "Access denied: this link's access token is malformed" });
-        return true;
-      }
-    }
-    const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-    const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
-    if (action === "thumbnail") {
-      const stream2 = await itemProvider.getThumbnail(drive, itemAccountId);
-      res.setHeader("Content-Type", "image/webp");
-      if (config.cors?.enabled) {
-        res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-      }
-      stream2.pipe(res);
-      return true;
-    }
-    const { stream, mime, size: fileSize } = await itemProvider.openStream(drive, itemAccountId);
-    const safeFilename = sanitizeContentDispositionFilename(drive.name);
-    const format = req.query.format;
-    const quality = req.query.quality;
-    const display = req.query.display;
-    const sizePreset = req.query.size;
-    const fit = req.query.fit;
-    const position = req.query.position;
-    const isImage = mime.startsWith("image/");
-    const shouldTransform = isImage && (format || quality || display || sizePreset || fit);
-    res.setHeader("Content-Disposition", `inline; filename="${safeFilename}"`);
-    if (config.cors?.enabled) {
-      res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-    }
-    if (shouldTransform) {
-      try {
-        const settings = getImageSettings(fileSize, quality, display, sizePreset, fit, position);
-        let targetFormat = format || mime.split("/")[1];
-        if (targetFormat === "jpg") targetFormat = "jpeg";
-        if (!["jpeg", "png", "webp", "avif"].includes(targetFormat)) {
-          targetFormat = format || "webp";
-        }
-        const cacheDir = path__default.default.join(config.storage.path, "file", drive._id.toString(), "cache");
-        const cacheKey = [
-          "opt",
-          `q${settings.quality}`,
-          `e${settings.effort}`,
-          settings.width ? `${settings.width}x${settings.height}` : "orig",
-          settings.fit || "none",
-          settings.position || "c",
-          targetFormat
-        ].join("_");
-        const cachePath = path__default.default.join(cacheDir, `${cacheKey}.bin`);
-        if (fs__default.default.existsSync(cachePath)) {
-          const cacheStat = fs__default.default.statSync(cachePath);
-          res.setHeader("Content-Type", `image/${targetFormat}`);
-          res.setHeader("Content-Length", cacheStat.size);
-          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-          if (config.cors?.enabled) {
-            res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-          }
-          if ("destroy" in stream) {
-            stream.destroy();
-          }
-          fs__default.default.createReadStream(cachePath).pipe(res);
-          return true;
-        }
-        if (!fs__default.default.existsSync(cacheDir)) fs__default.default.mkdirSync(cacheDir, { recursive: true });
-        let pipeline = sharp2__default.default();
-        if (settings.width && settings.height) {
-          pipeline = pipeline.resize(settings.width, settings.height, {
-            fit: settings.fit || "inside",
-            position: settings.position || "center",
-            withoutEnlargement: true,
-            background: { r: 0, g: 0, b: 0, alpha: 0 }
-          });
-        }
-        if (targetFormat === "jpeg") {
-          pipeline = pipeline.jpeg({ quality: settings.quality, mozjpeg: true });
-          res.setHeader("Content-Type", "image/jpeg");
-        } else if (targetFormat === "png") {
-          pipeline = pipeline.png({ compressionLevel: settings.pngCompression, adaptiveFiltering: true });
-          res.setHeader("Content-Type", "image/png");
-        } else if (targetFormat === "webp") {
-          const webpEffort = Math.min(settings.effort, 6);
-          pipeline = pipeline.webp({ quality: settings.quality, effort: webpEffort });
-          res.setHeader("Content-Type", "image/webp");
-        } else if (targetFormat === "avif") {
-          pipeline = pipeline.avif({ quality: settings.quality, effort: settings.effort });
-          res.setHeader("Content-Type", "image/avif");
-        }
-        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-        pipeline.on("error", (err) => {
-          console.error("[next-drive] Pipeline error:", err);
-        });
-        stream.pipe(pipeline);
-        pipeline.clone().toFile(cachePath).catch((e) => console.error("[next-drive] Cache write failed:", e));
-        pipeline.clone().pipe(res);
-        return true;
-      } catch (e) {
-        console.error("[next-drive] Image transformation failed:", e);
-      }
-    }
-    res.setHeader("Content-Type", mime);
-    if (fileSize) res.setHeader("Content-Length", fileSize);
-    stream.pipe(res);
-    return true;
-  } catch (error) {
-    console.error(`[next-drive] Error in ${action}:`, error);
-    const detail = error instanceof Error ? error.message : "Something went wrong while serving the file";
-    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
-    return true;
-  }
-};
-var handleAuthAction = async (req, res, action, config, owner) => {
-  if (!["getAuthUrl", "callback", "listAccounts", "removeAccount"].includes(action)) {
-    return false;
-  }
-  switch (action) {
-    case "getAuthUrl": {
-      const { provider } = req.query;
-      if (provider === "GOOGLE") {
-        const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-        if (!clientId || !clientSecret || !redirectUri) {
-          res.status(500).json({ status: 500, message: "Google Drive is not configured on the server" });
-          return true;
-        }
-        const callbackUri = new URL(redirectUri);
-        callbackUri.searchParams.set("action", "callback");
-        const oAuth2Client = new googleapis.google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
-        const state = Buffer.from(JSON.stringify({ owner })).toString("base64");
-        const url = oAuth2Client.generateAuthUrl({
-          access_type: "offline",
-          scope: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/userinfo.email"],
-          state,
-          prompt: "consent"
-        });
-        res.status(200).json({ status: 200, message: "Auth URL generated", data: { url } });
-        return true;
-      }
-      res.status(400).json({ status: 400, message: "Unknown storage provider requested" });
-      return true;
-    }
-    case "callback": {
-      const { code } = req.query;
-      if (!code) {
-        res.status(400).json({ status: 400, message: "Google sign-in failed: authorization code missing" });
-        return true;
-      }
-      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-      if (!clientId || !clientSecret || !redirectUri) {
-        res.status(500).json({ status: 500, message: "Google Drive sign-in is not configured on the server" });
-        return true;
-      }
-      const callbackUri = new URL(redirectUri);
-      callbackUri.searchParams.set("action", "callback");
-      const oAuth2Client = new googleapis.google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
-      const { tokens } = await oAuth2Client.getToken(code);
-      oAuth2Client.setCredentials(tokens);
-      const oauth2 = googleapis.google.oauth2({ version: "v2", auth: oAuth2Client });
-      const userInfo = await oauth2.userinfo.get();
-      const existing = await account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
-      if (existing) {
-        existing.metadata.google.credentials = tokens;
-        existing.markModified("metadata");
-        await existing.save();
-      } else {
-        const newAccount = new account_default({
-          owner,
-          name: userInfo.data.name || "Google Drive",
-          metadata: {
-            provider: "GOOGLE",
-            google: {
-              email: userInfo.data.email,
-              credentials: tokens
-            }
-          }
-        });
-        await newAccount.save();
-      }
-      res.setHeader("Content-Type", "text/html");
-      res.send(`<!DOCTYPE html>
-<html>
-<head><title>Authentication Complete</title></head>
-<body>
-<p>Authentication successful! This window will close automatically.</p>
-<script>
-(function() {
-	if (window.opener) {
-		try {
-			window.opener.postMessage('oauth-success', '*');
-		} catch (e) {}
-	}
-	try {
-		localStorage.setItem('next-drive-oauth-success', Date.now().toString());
-		localStorage.removeItem('next-drive-oauth-success');
-	} catch (e) {}
-	window.close();
-	setTimeout(function() {
-		document.body.innerHTML = '<p style="font-family: system-ui; text-align: center; margin-top: 50px;">Authentication successful!<br>You can close this tab now.</p>';
-	}, 500);
-})();
-</script>
-</body>
-</html>`);
-      return true;
-    }
-    case "listAccounts": {
-      const accounts = await account_default.find({ owner });
-      res.status(200).json({
-        status: 200,
-        data: {
-          accounts: accounts.map((a) => ({
-            id: a._id.toString(),
-            name: a.name,
-            email: a.metadata.google?.email || "",
-            provider: a.metadata.provider
-          }))
-        }
-      });
-      return true;
-    }
-    case "removeAccount": {
-      const { id } = req.query;
-      const account = await account_default.findOne({ _id: id, owner });
-      if (!account) {
-        res.status(404).json({ status: 404, message: "Could not disconnect: account not found" });
-        return true;
-      }
-      if (account.metadata.provider === "GOOGLE") {
-        try {
-          await GoogleDriveProvider.revokeToken(owner, account._id.toString());
-        } catch (e) {
-          console.error("Failed to revoke Google token:", e);
-        }
-      }
-      await account_default.deleteOne({ _id: id, owner });
-      await drive_default.deleteMany({ owner, storageAccountId: id });
-      res.status(200).json({ status: 200, message: "Account removed" });
-      return true;
-    }
-    default:
-      return false;
-  }
-};
-var objectIdSchema = zod.z.string().refine((val) => mongoose.isValidObjectId(val), {
-  message: "Invalid ObjectId format"
-});
-var sanitizeFilename = (name) => {
-  return name.replace(/[<>:"|?*\x00-\x1F]/g, "").replace(/^\.+/, "").replace(/\.+$/, "").replace(/\\/g, "/").replace(/\/+/g, "/").replace(/\.\.\//g, "").replace(/\.\.+/g, "").split("/").pop() || "".trim().slice(0, 255);
-};
-var sanitizeRegexInput = (input) => {
-  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").slice(0, 100);
-};
-var nameSchema = zod.z.string().min(1, "Name is required").max(255, "Name too long").transform(sanitizeFilename).refine((val) => val.length > 0, { message: "Invalid name after sanitization" });
-var uploadChunkSchema = zod.z.object({
-  chunkIndex: zod.z.number().int().min(0).max(1e4),
-  totalChunks: zod.z.number().int().min(1).max(1e4),
-  driveId: zod.z.string().optional(),
-  fileName: nameSchema,
-  fileSize: zod.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  fileType: zod.z.string().min(1).max(255),
-  folderId: zod.z.string().optional(),
-  conflictAction: zod.z.enum(["rename", "replace"]).optional()
-}).refine((data) => data.chunkIndex < data.totalChunks, {
-  message: "Chunk index must be less than total chunks"
-});
-var listQuerySchema = zod.z.object({
-  folderId: zod.z.union([zod.z.literal("root"), objectIdSchema, zod.z.undefined()]),
-  limit: zod.z.string().optional().transform((val) => {
-    const num = parseInt(val || "50", 10);
-    return Math.min(Math.max(1, num), 100);
-  }),
-  afterId: objectIdSchema.optional()
-});
-zod.z.object({
-  id: objectIdSchema,
-  token: zod.z.string().optional()
-});
-zod.z.object({
-  id: objectIdSchema,
-  size: zod.z.enum(["small", "medium", "large"]).optional().default("medium"),
-  token: zod.z.string().optional()
-});
-var renameBodySchema = zod.z.object({
-  id: objectIdSchema,
-  newName: nameSchema
-});
-var deleteQuerySchema = zod.z.object({
-  id: objectIdSchema
-});
-zod.z.object({
-  ids: zod.z.array(objectIdSchema).min(1).max(1e3)
-});
-var createFolderBodySchema = zod.z.object({
-  name: nameSchema,
-  parentId: zod.z.union([zod.z.literal("root"), objectIdSchema, zod.z.string().length(0), zod.z.undefined()]).optional()
-});
-var moveBodySchema = zod.z.object({
-  ids: zod.z.array(objectIdSchema).min(1).max(1e3),
-  targetFolderId: zod.z.union([zod.z.literal("root"), objectIdSchema, zod.z.undefined()]).optional()
-});
-var reorderBodySchema = zod.z.object({
-  ids: zod.z.array(objectIdSchema).min(1).max(1e3)
-});
-var searchQuerySchema = zod.z.object({
-  q: zod.z.string().min(1).max(100).transform(sanitizeRegexInput),
-  folderId: zod.z.union([zod.z.literal("root"), objectIdSchema, zod.z.undefined()]).optional(),
-  limit: zod.z.string().optional().transform((val) => {
-    const num = parseInt(val || "50", 10);
-    return Math.min(Math.max(1, num), 100);
-  }),
-  trashed: zod.z.string().optional().transform((val) => val === "true")
-});
-zod.z.object({
-  id: objectIdSchema
-});
-var cancelQuerySchema = zod.z.object({
-  id: zod.z.string().uuid()
-});
-zod.z.object({
-  days: zod.z.number().int().min(1).max(365).optional()
-});
-var driveFileSchemaZod = zod.z.object({
-  id: zod.z.string(),
-  file: zod.z.object({
-    name: zod.z.string(),
-    mime: zod.z.string(),
-    size: zod.z.number()
-  })
-});
+// src/server/controllers/drive.ts
 var getNextOrderValue = async (owner) => {
   const lastItem = await drive_default.findOne({ owner }, {}, { sort: { order: -1 } });
   return lastItem ? lastItem.order + 1 : 0;
@@ -1633,7 +1219,7 @@ var driveGetUrl = (fileId, options) => {
   } else {
     expiryTimestamp = Math.floor(Date.now() / 1e3) + expiresIn;
   }
-  const signature = crypto3__default.default.createHmac("sha256", secret).update(`${fileId}:${expiryTimestamp}`).digest("hex");
+  const signature = crypto2__default.default.createHmac("sha256", secret).update(`${fileId}:${expiryTimestamp}`).digest("hex");
   const token = Buffer.from(`${expiryTimestamp}:${signature}`).toString("base64url");
   return `${config.apiUrl || "/api/drive"}?action=serve&id=${fileId}&token=${token}`;
 };
@@ -1642,7 +1228,7 @@ var driveAddSignedUrlToken = (item, config) => {
   if (config.security?.signedUrls?.enabled && config.security.signedUrls.secret) {
     const { secret, expiresIn } = config.security.signedUrls;
     const expiryTimestamp = Math.floor(Date.now() / 1e3) + expiresIn;
-    const signature = crypto3__default.default.createHmac("sha256", secret).update(`${item.id}:${expiryTimestamp}`).digest("hex");
+    const signature = crypto2__default.default.createHmac("sha256", secret).update(`${item.id}:${expiryTimestamp}`).digest("hex");
     token = Buffer.from(`${expiryTimestamp}:${signature}`).toString("base64url");
   }
   const apiUrl = config.apiUrl || "/api/drive";
@@ -1961,7 +1547,7 @@ var driveUpload = async (source, key, options) => {
     if (!fs__default.default.existsSync(tempDir)) {
       fs__default.default.mkdirSync(tempDir, { recursive: true });
     }
-    tempFilePath = path__default.default.join(tempDir, `upload-${crypto3__default.default.randomUUID()}.tmp`);
+    tempFilePath = path__default.default.join(tempDir, `upload-${crypto2__default.default.randomUUID()}.tmp`);
     fs__default.default.writeFileSync(tempFilePath, source);
     sourceFilePath = tempFilePath;
     fileSize = source.length;
@@ -1970,7 +1556,7 @@ var driveUpload = async (source, key, options) => {
     if (!fs__default.default.existsSync(tempDir)) {
       fs__default.default.mkdirSync(tempDir, { recursive: true });
     }
-    tempFilePath = path__default.default.join(tempDir, `upload-${crypto3__default.default.randomUUID()}.tmp`);
+    tempFilePath = path__default.default.join(tempDir, `upload-${crypto2__default.default.randomUUID()}.tmp`);
     const writeStream = fs__default.default.createWriteStream(tempFilePath);
     await new Promise((resolve, reject) => {
       source.pipe(writeStream);
@@ -2130,14 +1716,11 @@ var driveCleanup = async () => {
       console.error("[next-drive] Failed to remove temp directory:", e);
     }
   }
-  const systemTmpDir = path__default.default.join(os2__default.default.tmpdir(), "next-drive-uploads");
-  if (fs__default.default.existsSync(systemTmpDir)) {
-    try {
-      totalFreedInBytes += getDirSize(systemTmpDir);
-      fs__default.default.rmSync(systemTmpDir, { recursive: true, force: true });
-    } catch (e) {
-      console.error("[next-drive] Failed to remove system temp directory:", e);
-    }
+  try {
+    const { getTusServer: getTusServer2 } = await import('./tus-JZQ3PKBS.cjs');
+    await getTusServer2().cleanUpExpiredUploads();
+  } catch (e) {
+    console.error("[next-drive] Failed to clean up expired tus uploads:", e);
   }
   return { removed, totalFreedInBytes };
 };
@@ -2184,615 +1767,200 @@ var withSignedUrls = (items, config) => {
   return driveAddSignedUrlTokens(items, config);
 };
 
-// src/server/actions/drive.ts
-var handleDriveAction = async (ctx) => {
-  const { req, res, action, config, owner, isRootMode, authenticated, information, provider, accountId } = ctx;
-  switch (action) {
-    case "list": {
-      if (req.method !== "GET") return void res.status(405).json({ status: 405, message: "Listing files requires a GET request" });
-      const listQuery = listQuerySchema.safeParse(req.query);
-      if (!listQuery.success) return void res.status(400).json({ status: 400, message: "Could not list files: invalid request parameters" });
-      const { folderId, limit, afterId } = listQuery.data;
-      try {
-        await provider.sync(folderId || "root", owner, accountId);
-      } catch (e) {
-        console.error("Sync failed", e);
-      }
-      const query = {
-        "provider.type": provider.name,
-        storageAccountId: accountId || null,
-        parentId: folderId === "root" || !folderId ? null : folderId,
-        trashedAt: null
-      };
-      if (!isRootMode) {
-        query.owner = owner;
-      }
-      if (afterId) query._id = { $lt: afterId };
-      const items = await drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
-      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
-      res.status(200).json({ status: 200, message: "Items retrieved", data: { items: plainItems, hasMore: items.length === limit } });
-      return;
-    }
-    case "search": {
-      const searchData = searchQuerySchema.safeParse(req.query);
-      if (!searchData.success) return void res.status(400).json({ status: 400, message: "Could not search: invalid request parameters" });
-      const { q, folderId, limit, trashed } = searchData.data;
-      if (!trashed) {
-        try {
-          await provider.search(q, owner, accountId);
-        } catch (e) {
-          console.error("Search sync failed", e);
-        }
-      }
-      const query = {
-        "provider.type": provider.name,
-        storageAccountId: accountId || null,
-        trashedAt: trashed ? { $ne: null } : null,
-        name: { $regex: q, $options: "i" }
-      };
-      if (!isRootMode) {
-        query.owner = owner;
-      }
-      if (folderId && folderId !== "root") query.parentId = folderId;
-      const items = await drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
-      const plainItems = withSignedUrls(await Promise.all(items.map((i) => i.toClient())), config);
-      res.status(200).json({ status: 200, message: "Results", data: { items: plainItems } });
-      return;
-    }
-    case "upload": {
-      if (req.method !== "POST") return void res.status(405).json({ status: 405, message: "Uploading requires a POST request" });
-      const systemTmpDir = path__default.default.join(os2__default.default.tmpdir(), "next-drive-uploads");
-      if (!fs__default.default.existsSync(systemTmpDir)) fs__default.default.mkdirSync(systemTmpDir, { recursive: true });
-      const form = formidable__default.default({
-        multiples: false,
-        maxFileSize: (config.security?.maxUploadSizeInBytes ?? 1024 * 1024 * 1024) * 2,
-        uploadDir: systemTmpDir,
-        keepExtensions: true
-      });
-      const [fields, files] = await new Promise((resolve, reject) => {
-        form.parse(req, (err, parsedFields, parsedFiles) => {
-          if (err) reject(err);
-          else resolve([parsedFields, parsedFiles]);
-        });
-      });
-      const cleanupTempFiles = (allFiles) => {
-        Object.values(allFiles).flat().forEach((file) => {
-          if (file && fs__default.default.existsSync(file.filepath)) fs__default.default.rmSync(file.filepath, { force: true });
-        });
-      };
-      const getString = (f) => Array.isArray(f) ? f[0] : f || "";
-      const getInt = (f) => parseInt(getString(f) || "0", 10);
-      const uploadData = uploadChunkSchema.safeParse({
-        chunkIndex: getInt(fields.chunkIndex),
-        totalChunks: getInt(fields.totalChunks),
-        driveId: getString(fields.driveId) || void 0,
-        fileName: getString(fields.fileName),
-        fileSize: getInt(fields.fileSize),
-        fileType: getString(fields.fileType),
-        folderId: getString(fields.folderId) || void 0,
-        conflictAction: getString(fields.conflictAction) || void 0
-      });
-      if (!uploadData.success) {
-        cleanupTempFiles(files);
-        return void res.status(400).json({ status: 400, message: uploadData.error.errors[0].message });
-      }
-      const { chunkIndex, totalChunks, driveId, fileName, fileSize: fileSizeInBytes, fileType, folderId, conflictAction } = uploadData.data;
-      let currentUploadId = driveId;
-      const tempBaseDir = path__default.default.join(os2__default.default.tmpdir(), "next-drive-uploads");
-      if (!currentUploadId) {
-        if (chunkIndex !== 0) return void res.status(400).json({ message: "Could not upload: missing upload session for this chunk" });
-        if (!authenticated) {
-          const unauth = config.security?.unauthenticated;
-          if (!unauth?.enabled) {
-            cleanupTempFiles(files);
-            return void res.status(401).json({ status: 401, message: "Authentication required to upload" });
-          }
-          if (fileSizeInBytes > unauth.maxUploadSizeInBytes) {
-            cleanupTempFiles(files);
-            return void res.status(413).json({ status: 413, message: "Could not upload: file exceeds the maximum allowed size" });
-          }
-          if (fileType && !validateMimeType(fileType, unauth.allowedMimeTypes)) {
-            cleanupTempFiles(files);
-            return void res.status(400).json({ status: 400, message: `Could not upload: file type "${fileType}" is not allowed` });
-          }
-          const abuse = unauth.abuse;
-          if (abuse) {
-            const store = globalThis.__nextDrive.abuse;
-            const now = Date.now();
-            const ip = abuse.clientId?.(req) ?? (abuse.trustedHeaders ?? ["cf-connecting-ip", "x-forwarded-for"]).map((h) => req.headers[h]).find(Boolean)?.split(",")[0].trim() ?? req.socket.remoteAddress ?? "unknown";
-            const hits = (store.ipHits.get(ip) ?? []).filter((t) => now - t < 36e5);
-            const perIp = abuse.perIp;
-            if (perIp && hits.filter((t) => now - t < perIp.windowMinutes * 6e4).length >= perIp.max) {
-              cleanupTempFiles(files);
-              return void res.status(429).json({ status: 429, message: "Too many uploads, please try again later" });
-            }
-            if (abuse.hourlyPerIp && hits.length >= abuse.hourlyPerIp) {
-              cleanupTempFiles(files);
-              return void res.status(429).json({ status: 429, message: "Hourly upload limit reached, please try again later" });
-            }
-            if (abuse.maxConcurrent && store.concurrent >= abuse.maxConcurrent) {
-              cleanupTempFiles(files);
-              return void res.status(429).json({ status: 429, message: "Server is busy with uploads, please try again later" });
-            }
-            if (abuse.maxLiveBytes) {
-              const [agg] = await drive_default.aggregate([{ $match: { expiresAt: { $ne: null } } }, { $group: { _id: null, total: { $sum: "$information.sizeInBytes" } } }]);
-              if ((agg?.total ?? 0) + fileSizeInBytes > abuse.maxLiveBytes) {
-                cleanupTempFiles(files);
-                return void res.status(429).json({ status: 429, message: "Temporary storage is full, please try again later" });
-              }
-            }
-            hits.push(now);
-            store.ipHits.set(ip, hits);
-            store.concurrent++;
-          }
-        } else {
-          if (fileType && config.security) {
-            if (!validateMimeType(fileType, config.security.allowedMimeTypes)) {
-              cleanupTempFiles(files);
-              return void res.status(400).json({ status: 400, message: `Could not upload: file type "${fileType}" is not allowed` });
-            }
-          }
-          if (!isRootMode) {
-            const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-            if (quota.usedInBytes + fileSizeInBytes > quota.quotaInBytes) {
-              cleanupTempFiles(files);
-              return void res.status(413).json({ status: 413, message: "Could not upload: you have run out of storage space" });
+// src/server/tus.ts
+var UPLOAD_EXPIRATION_MS = 24 * 60 * 60 * 1e3;
+var getCtx = (req) => req.__driveCtx;
+var abuseStore = () => globalThis.__nextDrive.abuse;
+var countActiveAnon = (store) => {
+  const cutoff = Date.now() - UPLOAD_EXPIRATION_MS;
+  for (const [id, ts] of store.active) if (ts < cutoff) store.active.delete(id);
+  return store.active.size;
+};
+var releaseSlot = (id) => abuseStore()?.active.delete(id);
+var getTusServer = () => {
+  const g = globalThis;
+  g.__nextDrive = g.__nextDrive ?? {};
+  if (g.__nextDrive.tus) return g.__nextDrive.tus;
+  const config = getDriveConfig();
+  const tusDir = path__default.default.join(config.storage.path, "tus");
+  fs__default.default.mkdirSync(tusDir, { recursive: true });
+  const apiPath = new URL(config.apiUrl || "/api/drive", "http://x").pathname;
+  const server$1 = new server.Server({
+    path: apiPath,
+    datastore: new fileStore.FileStore({ directory: tusDir, expirationPeriodInMilliseconds: UPLOAD_EXPIRATION_MS }),
+    // ** tus writes the response (and its CORS headers) last, so the custom account/item headers
+    // ** must be declared here to survive cross-origin requests.
+    allowedHeaders: ["X-Drive-Account"],
+    exposedHeaders: ["X-Drive-Item"],
+    maxSize: (req) => {
+      const ctx = getCtx(req);
+      if (!ctx) return Number.MAX_SAFE_INTEGER;
+      return ctx.authenticated ? ctx.config.security?.maxUploadSizeInBytes ?? Number.MAX_SAFE_INTEGER : ctx.config.security?.unauthenticated?.maxUploadSizeInBytes ?? 0;
+    },
+    // ** Keep the upload id in the query string so every method stays on `?action=upload`.
+    generateUrl: (_req, { path: p, id }) => `${p}?action=upload&id=${id}`,
+    // ** SECURITY: the id becomes a filesystem path inside FileStore (fs.unlink/read/resolve), and it
+    // ** arrives from the client-controlled query string. Only accept the exact format our
+    // ** namingFunction produces (32 lowercase hex) so a crafted `?id=../../..` cannot traverse out
+    // ** of the upload dir (which would allow arbitrary file read/delete). Anything else -> 404.
+    getFileIdFromRequest: (req) => {
+      const id = new URL(req.url, "http://x").searchParams.get("id");
+      return id && /^[a-f0-9]{32}$/.test(id) ? id : void 0;
+    },
+    onUploadCreate: async (req, upload) => {
+      const ctx = getCtx(req);
+      if (!ctx) throw { status_code: 500, body: "Could not upload: request context is missing" };
+      const { config: config2, authenticated, owner, provider, accountId, information, isRootMode } = ctx;
+      const size = upload.size ?? 0;
+      const fileType = upload.metadata?.filetype || "";
+      if (!authenticated) {
+        const unauth = config2.security?.unauthenticated;
+        if (!unauth?.enabled) throw { status_code: 401, body: "Authentication required to upload" };
+        if (size > unauth.maxUploadSizeInBytes) throw { status_code: 413, body: "Could not upload: file exceeds the maximum allowed size" };
+        if (fileType && !validateMimeType(fileType, unauth.allowedMimeTypes)) throw { status_code: 400, body: `Could not upload: file type "${fileType}" is not allowed` };
+        const abuse = unauth.abuse;
+        if (abuse) {
+          const store = abuseStore();
+          const now = Date.now();
+          if (now - store.lastSweep > 6e4) {
+            store.lastSweep = now;
+            for (const [seenIp, seenHits] of store.ipHits) {
+              const fresh = seenHits.filter((t) => now - t < 36e5);
+              if (fresh.length) store.ipHits.set(seenIp, fresh);
+              else store.ipHits.delete(seenIp);
             }
           }
-        }
-        currentUploadId = crypto3__default.default.randomUUID();
-        const uploadDir2 = path__default.default.join(tempBaseDir, currentUploadId);
-        fs__default.default.mkdirSync(uploadDir2, { recursive: true });
-        const metadata = {
-          owner: authenticated ? owner : null,
-          accountId: authenticated ? accountId : null,
-          providerName: provider.name,
-          name: fileName,
-          parentId: !authenticated || folderId === "root" || !folderId ? null : folderId,
-          fileSize: fileSizeInBytes,
-          mimeType: fileType,
-          totalChunks,
-          conflictAction: conflictAction ?? null,
-          unauthenticated: !authenticated
-        };
-        fs__default.default.writeFileSync(path__default.default.join(uploadDir2, "metadata.json"), JSON.stringify(metadata));
-      }
-      if (!currentUploadId) {
-        cleanupTempFiles(files);
-        return void res.status(400).json({ status: 400, message: "Could not upload: invalid upload request" });
-      }
-      const uploadDir = path__default.default.join(tempBaseDir, currentUploadId);
-      if (!fs__default.default.existsSync(uploadDir)) {
-        cleanupTempFiles(files);
-        return void res.status(404).json({ status: 404, message: "Could not upload: this upload session was not found or has expired" });
-      }
-      try {
-        const chunkFile = Array.isArray(files.chunk) ? files.chunk[0] : files.chunk;
-        if (!chunkFile) throw new Error("Could not upload: no file chunk was received");
-        const partPath = path__default.default.join(uploadDir, `part_${chunkIndex}`);
-        try {
-          fs__default.default.renameSync(chunkFile.filepath, partPath);
-        } catch (err) {
-          if (err instanceof Error && "code" in err && err.code === "EXDEV") {
-            fs__default.default.copyFileSync(chunkFile.filepath, partPath);
-            fs__default.default.unlinkSync(chunkFile.filepath);
-          } else {
-            throw err;
+          const nreq = req.__nodeReq;
+          const ip = (nreq && abuse.clientId?.(nreq)) ?? (abuse.trustedHeaders ?? ["cf-connecting-ip", "x-forwarded-for"]).map((h) => req.headers.get(h)).find(Boolean)?.split(",")[0].trim() ?? nreq?.socket?.remoteAddress ?? "unknown";
+          const hits = (store.ipHits.get(ip) ?? []).filter((t) => now - t < 36e5);
+          const perIp = abuse.perIp;
+          if (perIp && hits.filter((t) => now - t < perIp.windowMinutes * 6e4).length >= perIp.max) throw { status_code: 429, body: "Too many uploads, please try again later" };
+          if (abuse.hourlyPerIp && hits.length >= abuse.hourlyPerIp) throw { status_code: 429, body: "Hourly upload limit reached, please try again later" };
+          if (abuse.maxConcurrent && countActiveAnon(store) >= abuse.maxConcurrent) throw { status_code: 429, body: "Server is busy with uploads, please try again later" };
+          if (abuse.maxLiveBytes) {
+            const [agg] = await drive_default.aggregate([{ $match: { expiresAt: { $ne: null } } }, { $group: { _id: null, total: { $sum: "$information.sizeInBytes" } } }]);
+            if ((agg?.total ?? 0) + size > abuse.maxLiveBytes) throw { status_code: 429, body: "Temporary storage is full, please try again later" };
           }
+          hits.push(now);
+          store.ipHits.set(ip, hits);
+          store.active.set(upload.id, now);
         }
-        const uploadedParts = fs__default.default.readdirSync(uploadDir).filter((f) => f.startsWith("part_"));
-        if (uploadedParts.length === totalChunks) {
-          const metaPath = path__default.default.join(uploadDir, "metadata.json");
-          const meta = JSON.parse(fs__default.default.readFileSync(metaPath, "utf-8"));
-          const finalTempPath = path__default.default.join(uploadDir, "final.bin");
-          const writeStream = fs__default.default.createWriteStream(finalTempPath);
-          let streamError = null;
-          writeStream.on("error", (err) => {
-            streamError = err;
-          });
-          await new Promise((resolve, reject) => {
-            writeStream.on("open", () => resolve());
-            writeStream.once("error", reject);
-          });
-          for (let i = 0; i < totalChunks; i++) {
-            if (streamError) {
-              writeStream.destroy();
-              throw streamError;
-            }
-            const pPath = path__default.default.join(uploadDir, `part_${i}`);
-            if (!fs__default.default.existsSync(pPath)) {
-              writeStream.destroy();
-              throw new Error(`Could not finish upload: chunk ${i} is missing`);
-            }
-            const data = fs__default.default.readFileSync(pPath);
-            const canContinue = writeStream.write(data);
-            if (!canContinue) {
-              await new Promise((resolve, reject) => {
-                writeStream.once("drain", resolve);
-                writeStream.once("error", reject);
-              });
-            }
-          }
-          await new Promise((resolve, reject) => {
-            if (streamError) {
-              reject(streamError);
-              return;
-            }
-            writeStream.end();
-            writeStream.on("finish", resolve);
-            writeStream.once("error", reject);
-          });
-          if (!fs__default.default.existsSync(finalTempPath)) {
-            throw new Error("Could not finish upload: failed to assemble the file");
-          }
-          const finalStats = fs__default.default.statSync(finalTempPath);
-          if (finalStats.size !== meta.fileSize) {
-            throw new Error("Could not finish upload: the assembled file is incomplete (size mismatch)");
-          }
-          let replaceTargetId = null;
-          if (meta.conflictAction === "replace") {
-            const existing = await drive_default.findOne({ owner: meta.owner, storageAccountId: meta.accountId || null, "provider.type": meta.providerName, parentId: meta.parentId, name: meta.name, "information.type": "FILE", trashedAt: null });
-            if (existing) replaceTargetId = String(existing._id);
-          } else {
-            const ext = path__default.default.extname(meta.name);
-            const base = meta.name.slice(0, meta.name.length - ext.length);
-            let n = 1;
-            while (await drive_default.exists({ owner: meta.owner, storageAccountId: meta.accountId || null, "provider.type": meta.providerName, parentId: meta.parentId, name: meta.name, "information.type": "FILE", trashedAt: null })) {
-              meta.name = `${base} (${n++})${ext}`;
-            }
-          }
-          const drive = new drive_default({
-            owner: meta.owner,
-            storageAccountId: meta.accountId || null,
-            provider: { type: meta.providerName },
-            name: meta.name,
-            parentId: meta.parentId,
-            order: 0,
-            information: { type: "FILE", sizeInBytes: meta.fileSize, mime: meta.mimeType, path: "" },
-            status: "UPLOADING",
-            currentChunk: totalChunks,
-            totalChunks,
-            expiresAt: meta.unauthenticated ? new Date(Date.now() + (config.security?.unauthenticated?.ttlMinutes ?? 60) * 6e4) : null
-          });
-          if (meta.providerName === "LOCAL" && drive.information.type === "FILE") {
-            drive.information.path = path__default.default.join("file", String(drive._id), "data.bin");
-          }
-          await drive.save();
-          try {
-            const item = await provider.uploadFile(drive, finalTempPath, meta.accountId);
-            if (replaceTargetId) await provider.delete([replaceTargetId], meta.owner, meta.accountId);
-            fs__default.default.rmSync(uploadDir, { recursive: true, force: true });
-            if (meta.unauthenticated) globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
-            const newQuota = await provider.getQuota(meta.owner, meta.accountId, information.storage.quotaInBytes);
-            res.status(200).json({ status: 200, message: "Upload complete", data: { type: "UPLOAD_COMPLETE", driveId: String(drive._id), item: withSignedUrl(item, config) }, statistic: { storage: newQuota } });
-          } catch (err) {
-            await drive_default.deleteOne({ _id: drive._id });
-            if (meta.unauthenticated) globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
-            throw err;
-          }
-        } else {
-          const newQuota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-          if (chunkIndex === 0) {
-            res.status(200).json({ status: 200, message: "Upload started", data: { type: "UPLOAD_STARTED", driveId: currentUploadId }, statistic: { storage: newQuota } });
-          } else {
-            res.status(200).json({ status: 200, message: "Chunk received", data: { type: "CHUNK_RECEIVED", driveId: currentUploadId, chunkIndex }, statistic: { storage: newQuota } });
-          }
+      } else {
+        if (fileType && config2.security && !validateMimeType(fileType, config2.security.allowedMimeTypes)) throw { status_code: 400, body: `Could not upload: file type "${fileType}" is not allowed` };
+        if (!isRootMode) {
+          const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+          if (quota.usedInBytes + size > quota.quotaInBytes) throw { status_code: 413, body: "Could not upload: you have run out of storage space" };
         }
-      } catch (e) {
-        cleanupTempFiles(files);
-        throw e;
       }
-      return;
-    }
-    case "cancel": {
-      const cancelData = cancelQuerySchema.safeParse(req.query);
-      if (!cancelData.success) return void res.status(400).json({ status: 400, message: "Could not cancel upload: invalid ID" });
-      const { id } = cancelData.data;
-      const tempUploadDir = path__default.default.join(os2__default.default.tmpdir(), "next-drive-uploads", id);
-      if (fs__default.default.existsSync(tempUploadDir)) {
-        try {
-          const metaPath = path__default.default.join(tempUploadDir, "metadata.json");
-          if (fs__default.default.existsSync(metaPath) && JSON.parse(fs__default.default.readFileSync(metaPath, "utf-8")).unauthenticated) {
-            globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
-          }
-          fs__default.default.rmSync(tempUploadDir, { recursive: true, force: true });
-        } catch (e) {
-          console.error("Failed to cleanup temp upload:", e);
+      return {};
+    },
+    onUploadFinish: async (req, upload) => {
+      const ctx = getCtx(req);
+      if (!ctx) throw { status_code: 500, body: "Could not finish upload: request context is missing" };
+      const { config: config2, authenticated, owner, provider, accountId, information, isRootMode } = ctx;
+      const meta = upload.metadata ?? {};
+      const size = upload.size ?? 0;
+      const filePath = upload.storage?.path ?? path__default.default.join(tusDir, upload.id);
+      const ownerValue = authenticated ? owner : null;
+      if (!authenticated) releaseSlot(upload.id);
+      const already = await drive_default.findOne({ "meta.tusId": upload.id });
+      if (already) return { headers: { "X-Drive-Item": encodeURIComponent(JSON.stringify(withSignedUrl(await already.toClient(), config2))) } };
+      if (!authenticated) {
+        const unauth = config2.security?.unauthenticated;
+        if (!unauth?.enabled) throw { status_code: 401, body: "Authentication required to upload" };
+        if (size > unauth.maxUploadSizeInBytes) throw { status_code: 413, body: "Could not upload: file exceeds the maximum allowed size" };
+        if (unauth.abuse?.maxLiveBytes) {
+          const [agg] = await drive_default.aggregate([{ $match: { expiresAt: { $ne: null } } }, { $group: { _id: null, total: { $sum: "$information.sizeInBytes" } } }]);
+          if ((agg?.total ?? 0) + size > unauth.abuse.maxLiveBytes) throw { status_code: 429, body: "Temporary storage is full, please try again later" };
         }
+      } else if (!isRootMode) {
+        if (config2.security && size > config2.security.maxUploadSizeInBytes) throw { status_code: 413, body: "Could not upload: file exceeds the maximum allowed size" };
+        const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+        if (quota.usedInBytes + size > quota.quotaInBytes) throw { status_code: 413, body: "Could not upload: you have run out of storage space" };
       }
-      res.status(200).json({ status: 200, message: "Upload cancelled", data: null });
-      return;
-    }
-    case "createFolder": {
-      const folderData = createFolderBodySchema.safeParse(req.body);
-      if (!folderData.success) return void res.status(400).json({ status: 400, message: folderData.error.errors[0].message });
-      const { name, parentId } = folderData.data;
-      const item = withSignedUrl(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
-      res.status(201).json({ status: 201, message: "Folder created", data: { item } });
-      return;
-    }
-    case "delete": {
-      const deleteData = deleteQuerySchema.safeParse(req.query);
-      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not move to trash: invalid ID" });
-      const { id } = deleteData.data;
-      const drive = await drive_default.findById(id);
-      if (!drive) return void res.status(404).json({ status: 404, message: "Could not move to trash: item not found" });
-      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
-      try {
-        await itemProvider.trash([id], owner, itemAccountId);
-      } catch (e) {
-        console.error("Provider trash failed:", e);
+      let parentId = null;
+      if (authenticated && meta.folderId && meta.folderId !== "root") {
+        if (!mongoose.isValidObjectId(meta.folderId)) throw { status_code: 400, body: "Could not upload: invalid target folder" };
+        const folder = await drive_default.findOne({ _id: meta.folderId, owner: ownerValue, storageAccountId: accountId || null, "information.type": "FOLDER", trashedAt: null });
+        if (!folder) throw { status_code: 404, body: "Could not upload: target folder was not found" };
+        parentId = meta.folderId;
       }
-      drive.trashedAt = /* @__PURE__ */ new Date();
-      await drive.save();
-      res.status(200).json({ status: 200, message: "Moved to trash", data: null });
-      return;
-    }
-    case "deletePermanent": {
-      const deleteData = deleteQuerySchema.safeParse(req.query);
-      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not delete: invalid ID" });
-      const { id } = deleteData.data;
-      await provider.delete([id], owner, accountId);
-      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-      res.status(200).json({ status: 200, message: "Deleted", statistic: { storage: quota } });
-      return;
-    }
-    case "quota": {
-      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-      res.status(200).json({
-        status: 200,
-        message: "Quota retrieved",
-        data: {
-          usedInBytes: quota.usedInBytes,
-          totalInBytes: quota.quotaInBytes,
-          availableInBytes: Math.max(0, quota.quotaInBytes - quota.usedInBytes),
-          percentage: quota.quotaInBytes > 0 ? Math.round(quota.usedInBytes / quota.quotaInBytes * 100) : 0
-        },
-        statistic: { storage: quota }
-      });
-      return;
-    }
-    case "trash": {
-      try {
-        const { provider: trashProvider, accountId: trashAccountId } = await resolveProvider(req, owner);
-        await trashProvider.syncTrash(owner, trashAccountId);
-      } catch (e) {
-        console.error("Trash sync failed", e);
+      let name = (meta.filename || "file").replace(/[/\\]/g, "_").replace(/[\x00-\x1f<>:"|?*]/g, "").replace(/^\.+/, "").trim().slice(0, 255) || "file";
+      let replaceTargetId = null;
+      const dupeQuery = { owner: ownerValue, storageAccountId: accountId || null, "provider.type": provider.name, parentId, "information.type": "FILE", trashedAt: null };
+      if (authenticated && meta.conflictAction === "replace") {
+        const existing = await drive_default.findOne({ ...dupeQuery, name });
+        if (existing) replaceTargetId = String(existing._id);
+      } else {
+        const ext = path__default.default.extname(name);
+        const base = name.slice(0, name.length - ext.length);
+        let n = 1;
+        while (await drive_default.exists({ ...dupeQuery, name })) name = `${base} (${n++})${ext}`;
       }
-      const query = {
-        owner,
-        "provider.type": provider.name,
+      const drive = new drive_default({
+        owner: ownerValue,
         storageAccountId: accountId || null,
-        trashedAt: { $ne: null }
-      };
-      const items = await drive_default.find(query, {}, { sort: { trashedAt: -1 } });
-      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
-      res.status(200).json({ status: 200, message: "Trash items", data: { items: plainItems, hasMore: false } });
-      return;
-    }
-    case "restore": {
-      const restoreData = deleteQuerySchema.safeParse(req.query);
-      if (!restoreData.success) return void res.status(400).json({ status: 400, message: "Could not restore: invalid ID" });
-      const { id } = restoreData.data;
-      const drive = await drive_default.findById(id);
-      if (!drive) return void res.status(404).json({ status: 404, message: "Could not restore: item not found" });
-      let targetParentId = drive.parentId;
-      if (targetParentId) {
-        const parent = await drive_default.findById(targetParentId);
-        if (parent?.trashedAt) {
-          targetParentId = null;
-        }
-      }
-      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
-      try {
-        await itemProvider.untrash([id], owner, itemAccountId);
-        if (targetParentId !== drive.parentId) {
-          await itemProvider.move(id, targetParentId?.toString() ?? null, owner, itemAccountId);
-        }
-      } catch (e) {
-        console.error("Provider restore failed:", e);
-      }
-      drive.trashedAt = null;
-      drive.parentId = targetParentId;
-      await drive.save();
-      res.status(200).json({
-        status: 200,
-        message: targetParentId === null && drive.parentId !== null ? "Restored to root (parent folder was trashed)" : "Restored",
-        data: null
+        provider: { type: provider.name },
+        name,
+        parentId,
+        order: 0,
+        information: { type: "FILE", sizeInBytes: size, mime: meta.filetype || "application/octet-stream", path: "" },
+        status: "UPLOADING",
+        expiresAt: authenticated ? null : new Date(Date.now() + (config2.security?.unauthenticated?.ttlMinutes ?? 60) * 6e4),
+        meta: { tusId: upload.id }
       });
-      return;
-    }
-    case "move": {
-      const moveData = moveBodySchema.safeParse(req.body);
-      if (!moveData.success) return void res.status(400).json({ status: 400, message: "Could not move: invalid request data" });
-      const { ids, targetFolderId } = moveData.data;
-      const items = [];
-      const effectiveTargetId = targetFolderId === "root" || !targetFolderId ? null : targetFolderId;
-      for (const id of ids) {
-        try {
-          const item = await provider.move(id, effectiveTargetId, owner, accountId);
-          items.push(item);
-        } catch (e) {
-          console.error(`Failed to move item ${id}`, e);
-        }
-      }
-      res.status(200).json({ status: 200, message: "Moved", data: { items: withSignedUrls(items, config) } });
-      return;
-    }
-    case "reorder": {
-      if (req.method !== "POST") {
-        return void res.status(405).json({ status: 405, message: "Reordering requires a POST request" });
-      }
-      const reorderData = reorderBodySchema.safeParse(req.body);
-      if (!reorderData.success) {
-        return void res.status(400).json({ status: 400, message: "Could not reorder: invalid request data" });
-      }
-      const { ids } = reorderData.data;
-      const query = {
-        _id: { $in: ids },
-        "provider.type": provider.name,
-        storageAccountId: accountId || null,
-        trashedAt: null
-      };
-      if (!isRootMode) {
-        query.owner = owner;
-      }
-      const existingItems = await drive_default.find(query, { _id: 1, parentId: 1 });
-      if (existingItems.length !== ids.length) {
-        return void res.status(404).json({ status: 404, message: "Could not reorder: one or more items were not found" });
-      }
-      const parentIds = new Set(existingItems.map((item) => item.parentId ? item.parentId.toString() : "root"));
-      if (parentIds.size > 1) {
-        return void res.status(400).json({ status: 400, message: "Could not reorder: all items must be in the same folder" });
+      if (provider.name === "LOCAL" && drive.information.type === "FILE") drive.information.path = path__default.default.join("file", String(drive._id), "data.bin");
+      await drive.save();
+      try {
+        const item = await provider.uploadFile(drive, filePath, accountId);
+        if (replaceTargetId) await provider.delete([replaceTargetId], ownerValue, accountId);
+        fs__default.default.rmSync(filePath, { force: true });
+        fs__default.default.rmSync(`${filePath}.json`, { force: true });
+        return { headers: { "X-Drive-Item": encodeURIComponent(JSON.stringify(withSignedUrl(item, config2))) } };
+      } catch (err) {
+        await drive_default.deleteOne({ _id: drive._id });
+        console.error("[next-drive] Upload finalize failed:", err);
+        throw { status_code: 500, body: "Could not finish upload" };
       }
-      const operations = ids.map((id, order) => ({
-        updateOne: {
-          filter: {
-            _id: id,
-            "provider.type": provider.name,
-            storageAccountId: accountId || null,
-            trashedAt: null,
-            ...isRootMode ? {} : { owner }
-          },
-          update: { $set: { order } }
-        }
-      }));
-      await drive_default.bulkWrite(operations);
-      const updatedItems = await drive_default.find(query, {}, { sort: { order: 1 } });
-      const plainItems = withSignedUrls(await Promise.all(updatedItems.map((item) => item.toClient())), config);
-      res.status(200).json({ status: 200, message: "Reordered", data: { items: plainItems } });
-      return;
-    }
-    case "rename": {
-      const renameData = renameBodySchema.safeParse({ id: req.query.id, ...req.body });
-      if (!renameData.success) return void res.status(400).json({ status: 400, message: "Could not rename: invalid request data" });
-      const { id, newName } = renameData.data;
-      const item = withSignedUrl(await provider.rename(id, newName, owner, accountId), config);
-      res.status(200).json({ status: 200, message: "Renamed", data: { item } });
-      return;
-    }
-    default: {
-      res.status(400).json({ status: 400, message: `Unknown action requested: "${action}"` });
-      return;
-    }
-  }
-};
-
-// src/server/index.ts
-var parseJsonBody = (req) => {
-  return new Promise((resolve) => {
-    try {
-      const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
-      req.on("end", () => {
-        const raw = Buffer.concat(chunks).toString();
-        if (!raw) return resolve({});
-        try {
-          resolve(JSON.parse(raw));
-        } catch {
-          resolve({});
-        }
-      });
-      req.on("error", () => resolve({}));
-    } catch {
-      resolve({});
     }
   });
+  server$1.on(server.EVENTS.POST_TERMINATE, (_req, _res, id) => releaseSlot(id));
+  g.__nextDrive.tus = server$1;
+  return server$1;
 };
-var driveAPIHandler = async (req, res) => {
-  if (req.body === void 0 && typeof req.on === "function" && (req.headers["content-type"] || "").includes("application/json")) {
-    req.body = await parseJsonBody(req);
-  } else if (req.body === void 0) {
-    req.body = {};
-  }
-  const action = req.query.action || (req.query.code && req.query.state ? "callback" : void 0);
-  let config;
-  try {
-    config = getDriveConfig();
-  } catch (error) {
-    console.error("[next-drive] Configuration error:", error);
-    res.status(500).json({ status: 500, message: "Drive is not ready: failed to initialize configuration" });
-    return;
-  }
-  const isPreflightHandled = applyCorsHeaders(req, res, config);
-  if (isPreflightHandled) return;
-  if (!action) {
-    res.status(400).json({ status: 400, message: 'Missing "action" parameter in request' });
-    return;
-  }
-  const wasPublicHandled = await handlePublicAction(req, res, action, config);
-  if (wasPublicHandled) return;
-  try {
-    const mode = config.mode || "NORMAL";
-    if (action === "information") {
-      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-      const googleConfigured = !!(clientId && clientSecret && redirectUri);
-      let authenticated2 = false;
-      try {
-        await getDriveInformation({ method: "REQUEST", req });
-        authenticated2 = true;
-      } catch {
-        authenticated2 = false;
-      }
-      res.status(200).json({
-        status: 200,
-        message: "Information retrieved",
-        data: {
-          providers: {
-            google: googleConfigured
-          },
-          mode,
-          authenticated: authenticated2,
-          unauthenticatedUploads: !!config.security?.unauthenticated?.enabled
-        }
-      });
-      return;
-    }
-    const isRootMode = mode === "ROOT";
-    let information;
-    let authenticated = true;
-    try {
-      information = await getDriveInformation({ method: "REQUEST", req });
-    } catch (err) {
-      if ((action === "upload" || action === "cancel") && config.security?.unauthenticated?.enabled) {
-        information = { key: null, storage: { quotaInBytes: 0 } };
-        authenticated = false;
-      } else {
-        throw err;
-      }
-    }
-    const { key: owner } = information;
-    const wasAuthHandled = await handleAuthAction(req, res, action, config, owner);
-    if (wasAuthHandled) return;
-    const { provider, accountId } = await resolveProvider(req, owner);
-    await handleDriveAction({
-      req,
-      res,
-      action,
-      config,
-      owner,
-      isRootMode,
-      authenticated,
-      information,
-      provider,
-      accountId
-    });
-  } catch (error) {
-    console.error(`[next-drive] Error handling action ${action}:`, error);
-    const detail = error instanceof Error ? error.message : "Something went wrong while processing your request";
-    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
-  }
+var handleUpload = async (req, res, ctx) => {
+  const host = req.headers.host || "localhost";
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) headers.set(key, value.join(", "));
+    else if (typeof value === "string") headers.set(key, value);
+  }
+  const hasBody = req.method === "POST" || req.method === "PATCH" || req.method === "PUT";
+  const request = new Request(`http://${host}${req.url}`, {
+    method: req.method,
+    headers,
+    body: hasBody ? stream.Readable.toWeb(req) : void 0,
+    // ** Required by Node/undici when streaming a request body.
+    duplex: "half"
+  });
+  request.__driveCtx = ctx;
+  request.__nodeReq = req;
+  const response = await getTusServer().handleWeb(request);
+  res.statusCode = response.status;
+  response.headers.forEach((value, key) => {
+    if (value !== void 0 && value !== null) res.setHeader(key, value);
+  });
+  res.end(response.body ? Buffer.from(await response.arrayBuffer()) : void 0);
 };
 
-exports.driveAPIHandler = driveAPIHandler;
+exports.GoogleDriveProvider = GoogleDriveProvider;
+exports.LocalStorageProvider = LocalStorageProvider;
+exports.account_default = account_default;
 exports.driveCleanup = driveCleanup;
 exports.driveConfiguration = driveConfiguration;
 exports.driveConfirm = driveConfirm;
 exports.driveDelete = driveDelete;
 exports.driveFilePath = driveFilePath;
-exports.driveFileSchemaZod = driveFileSchemaZod;
 exports.driveGetUrl = driveGetUrl;
 exports.driveInfo = driveInfo;
 exports.driveList = driveList;
@@ -2803,5 +1971,11 @@ exports.driveUpload = driveUpload;
 exports.drive_default = drive_default;
 exports.getDriveConfig = getDriveConfig;
 exports.getDriveInformation = getDriveInformation;
-//# sourceMappingURL=chunk-IVSBLEMY.cjs.map
-//# sourceMappingURL=chunk-IVSBLEMY.cjs.map
+exports.getImageSettings = getImageSettings;
+exports.getTusServer = getTusServer;
+exports.handleUpload = handleUpload;
+exports.resolveProvider = resolveProvider;
+exports.withSignedUrl = withSignedUrl;
+exports.withSignedUrls = withSignedUrls;
+//# sourceMappingURL=chunk-DUTHZ5HA.cjs.map
+//# sourceMappingURL=chunk-DUTHZ5HA.cjs.map