@muhgholy/next-drive 4.23.7 → 4.23.10

package/dist/{chunk-MVYNW56R.js → chunk-XUPDNN2U.js}

@@ -1,15 +1,15 @@
-import formidable from 'formidable';
+import mongoose, { Schema, isValidObjectId } from 'mongoose';
 import path from 'path';
-import fs from 'fs';
 import os2 from 'os';
-import crypto2 from 'crypto';
-import mongoose, { Schema, isValidObjectId } from 'mongoose';
+import fs from 'fs';
+import crypto3 from 'crypto';
 import sharp2 from 'sharp';
 import ffmpeg from 'fluent-ffmpeg';
 import { google } from 'googleapis';
+import formidable from 'formidable';
 import { z } from 'zod';
 
-// src/server/index.ts
+// src/server/config.ts
 var informationSchema = new Schema({
   type: { type: String, enum: ["FILE", "FOLDER"], required: true },
   sizeInBytes: { type: Number, default: 0 },
@@ -36,6 +36,7 @@ var DriveSchema = new Schema(
     information: { type: informationSchema, required: true },
     status: { type: String, enum: ["READY", "PROCESSING", "UPLOADING", "FAILED"], default: "PROCESSING" },
     trashedAt: { type: Date, default: null },
+    expiresAt: { type: Date, default: null },
     meta: { type: Schema.Types.Mixed, default: {} },
     createdAt: { type: Date, default: Date.now }
   },
@@ -48,6 +49,7 @@ DriveSchema.index({ owner: 1, trashedAt: 1 });
 DriveSchema.index({ owner: 1, "information.hash": 1 });
 DriveSchema.index({ owner: 1, name: "text" });
 DriveSchema.index({ owner: 1, "provider.type": 1 });
+DriveSchema.index({ expiresAt: 1 });
 DriveSchema.method("toClient", async function() {
   const data = this.toJSON();
   return {
@@ -60,6 +62,7 @@ DriveSchema.method("toClient", async function() {
     information: data.information,
     status: data.status,
     trashedAt: data.trashedAt,
+    expiresAt: data.expiresAt,
     meta: data.meta,
     createdAt: data.createdAt
   };
@@ -246,7 +249,8 @@ var getGlobal = () => {
     globalThis[GLOBAL_KEY] = {
       config: null,
       migrationPromise: null,
-      initialized: false
+      initialized: false,
+      abuse: { ipHits: /* @__PURE__ */ new Map(), concurrent: 0 }
     };
   }
   return globalThis[GLOBAL_KEY];
@@ -275,7 +279,8 @@ var driveConfiguration = async (config) => {
         // 10GB default for ROOT
         allowedMimeTypes: config.security?.allowedMimeTypes ?? ["*/*"],
         signedUrls: config.security?.signedUrls,
-        trash: config.security?.trash
+        trash: config.security?.trash,
+        unauthenticated: config.security?.unauthenticated
       }
     };
   } else {
@@ -293,7 +298,8 @@ var driveConfiguration = async (config) => {
         maxUploadSizeInBytes: config.security?.maxUploadSizeInBytes ?? 10 * 1024 * 1024,
         allowedMimeTypes: config.security?.allowedMimeTypes ?? ["*/*"],
         signedUrls: config.security?.signedUrls,
-        trash: config.security?.trash
+        trash: config.security?.trash,
+        unauthenticated: config.security?.unauthenticated
       },
       information: config.information
     };
@@ -324,6 +330,53 @@ var getDriveInformation = async (input) => {
   }
   return config.information(input);
 };
+
+// src/server/actions/cors.ts
+var applyCorsHeaders = (req, res, config) => {
+  const cors = config.cors;
+  if (!cors?.enabled) return false;
+  const origin = req.headers.origin;
+  const allowedOrigins = cors.origins ?? "*";
+  const methods = cors.methods ?? ["GET", "POST", "PUT", "DELETE", "OPTIONS"];
+  const allowedHeaders = cors.allowedHeaders ?? ["Content-Type", "Authorization", "X-Drive-Account"];
+  const exposedHeaders = cors.exposedHeaders ?? ["Content-Length", "Content-Type", "Content-Disposition"];
+  const credentials = cors.credentials ?? false;
+  const maxAge = cors.maxAge ?? 86400;
+  let allowOrigin = null;
+  if (origin) {
+    if (allowedOrigins === "*") {
+      allowOrigin = origin;
+    } else if (Array.isArray(allowedOrigins)) {
+      if (allowedOrigins.includes(origin)) {
+        allowOrigin = origin;
+      }
+    } else if (allowedOrigins === origin) {
+      allowOrigin = origin;
+    }
+  } else if (allowedOrigins === "*") {
+    allowOrigin = "*";
+  }
+  if (!allowOrigin) {
+    if (req.method === "OPTIONS") {
+      res.status(403).end();
+      return true;
+    }
+    return false;
+  }
+  res.setHeader("Access-Control-Allow-Origin", allowOrigin);
+  res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
+  res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
+  res.setHeader("Access-Control-Expose-Headers", exposedHeaders.join(", "));
+  res.setHeader("Access-Control-Max-Age", maxAge.toString());
+  if (credentials) {
+    res.setHeader("Access-Control-Allow-Credentials", "true");
+  }
+  if (req.method === "OPTIONS") {
+    res.status(204).end();
+    return true;
+  }
+  return false;
+};
 var validateMimeType = (mime, allowedTypes) => {
   if (allowedTypes.includes("*/*")) return true;
   return allowedTypes.some((pattern) => {
@@ -336,7 +389,7 @@ var validateMimeType = (mime, allowedTypes) => {
   });
 };
 var computeFileHash = (filePath) => new Promise((resolve, reject) => {
-  const hash = crypto2.createHash("sha256");
+  const hash = crypto3.createHash("sha256");
   const stream = fs.createReadStream(filePath);
   stream.on("data", (data) => hash.update(data));
   stream.on("end", () => resolve(hash.digest("hex")));
@@ -487,6 +540,12 @@ var getImageSettings = (fileSizeInBytes, qualityPreset, display, size, fit, posi
     ...resolvedPosition && { position: resolvedPosition }
   };
 };
+
+// src/server/security/crypto-utils.ts
+function sanitizeContentDispositionFilename(filename) {
+  const basename = filename.replace(/^.*[\\\/]/, "");
+  return basename.replace(/["\r\n]/g, "").replace(/[^\x20-\x7E]/g, "").slice(0, 255);
+}
 var generatePlaceholderThumbnail = async (outputPath, mimeType) => {
   const typeParts = mimeType.split("/");
   const subtype = typeParts[1] || "file";
@@ -713,7 +772,7 @@ StorageAccountSchema.method("toClient", async function() {
 var StorageAccount = mongoose.models.StorageAccount || mongoose.model("StorageAccount", StorageAccountSchema);
 var account_default = StorageAccount;
 
-// src/server/providers/google.ts
+// src/server/storage-adapters/google.ts
 var createAuthClient = async (owner, accountId) => {
   const query = { owner, "metadata.provider": "GOOGLE" };
   if (accountId) query._id = accountId;
@@ -1181,7 +1240,368 @@ var GoogleDriveProvider = {
   }
 };
 
-// src/server/controllers/drive.ts
+// src/server/actions/public.ts
+var handlePublicAction = async (req, res, action, config) => {
+  if (action !== "serve" && action !== "thumbnail") {
+    return false;
+  }
+  try {
+    const { id, token } = req.query;
+    if (!id || typeof id !== "string") {
+      res.status(400).json({ status: 400, message: "Could not open file: missing or invalid file ID" });
+      return true;
+    }
+    const drive = await drive_default.findById(id);
+    if (!drive) {
+      res.status(404).json({ status: 404, message: "File not found or no longer available" });
+      return true;
+    }
+    if (config.security?.signedUrls?.enabled) {
+      if (!token || typeof token !== "string") {
+        res.status(401).json({ status: 401, message: "Access denied: this link is missing its access token" });
+        return true;
+      }
+      try {
+        const decoded = Buffer.from(token, "base64url").toString();
+        const [expiryStr, signature] = decoded.split(":");
+        const expiry = parseInt(expiryStr, 10);
+        if (Date.now() / 1e3 > expiry) {
+          res.status(401).json({ status: 401, message: "Access denied: this link has expired" });
+          return true;
+        }
+        const { secret } = config.security.signedUrls;
+        const expectedSignature = crypto3.createHmac("sha256", secret).update(`${id}:${expiry}`).digest("hex");
+        if (signature !== expectedSignature) {
+          res.status(401).json({ status: 401, message: "Access denied: this link's access token is invalid" });
+          return true;
+        }
+      } catch {
+        res.status(401).json({ status: 401, message: "Access denied: this link's access token is malformed" });
+        return true;
+      }
+    }
+    const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+    const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+    if (action === "thumbnail") {
+      const stream2 = await itemProvider.getThumbnail(drive, itemAccountId);
+      res.setHeader("Content-Type", "image/webp");
+      if (config.cors?.enabled) {
+        res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+      }
+      stream2.pipe(res);
+      return true;
+    }
+    const { stream, mime, size: fileSize } = await itemProvider.openStream(drive, itemAccountId);
+    const safeFilename = sanitizeContentDispositionFilename(drive.name);
+    const format = req.query.format;
+    const quality = req.query.quality;
+    const display = req.query.display;
+    const sizePreset = req.query.size;
+    const fit = req.query.fit;
+    const position = req.query.position;
+    const isImage = mime.startsWith("image/");
+    const shouldTransform = isImage && (format || quality || display || sizePreset || fit);
+    res.setHeader("Content-Disposition", `inline; filename="${safeFilename}"`);
+    if (config.cors?.enabled) {
+      res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+    }
+    if (shouldTransform) {
+      try {
+        const settings = getImageSettings(fileSize, quality, display, sizePreset, fit, position);
+        let targetFormat = format || mime.split("/")[1];
+        if (targetFormat === "jpg") targetFormat = "jpeg";
+        if (!["jpeg", "png", "webp", "avif"].includes(targetFormat)) {
+          targetFormat = format || "webp";
+        }
+        const cacheDir = path.join(config.storage.path, "file", drive._id.toString(), "cache");
+        const cacheKey = [
+          "opt",
+          `q${settings.quality}`,
+          `e${settings.effort}`,
+          settings.width ? `${settings.width}x${settings.height}` : "orig",
+          settings.fit || "none",
+          settings.position || "c",
+          targetFormat
+        ].join("_");
+        const cachePath = path.join(cacheDir, `${cacheKey}.bin`);
+        if (fs.existsSync(cachePath)) {
+          const cacheStat = fs.statSync(cachePath);
+          res.setHeader("Content-Type", `image/${targetFormat}`);
+          res.setHeader("Content-Length", cacheStat.size);
+          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+          if (config.cors?.enabled) {
+            res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+          }
+          if ("destroy" in stream) {
+            stream.destroy();
+          }
+          fs.createReadStream(cachePath).pipe(res);
+          return true;
+        }
+        if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
+        let pipeline = sharp2();
+        if (settings.width && settings.height) {
+          pipeline = pipeline.resize(settings.width, settings.height, {
+            fit: settings.fit || "inside",
+            position: settings.position || "center",
+            withoutEnlargement: true,
+            background: { r: 0, g: 0, b: 0, alpha: 0 }
+          });
+        }
+        if (targetFormat === "jpeg") {
+          pipeline = pipeline.jpeg({ quality: settings.quality, mozjpeg: true });
+          res.setHeader("Content-Type", "image/jpeg");
+        } else if (targetFormat === "png") {
+          pipeline = pipeline.png({ compressionLevel: settings.pngCompression, adaptiveFiltering: true });
+          res.setHeader("Content-Type", "image/png");
+        } else if (targetFormat === "webp") {
+          const webpEffort = Math.min(settings.effort, 6);
+          pipeline = pipeline.webp({ quality: settings.quality, effort: webpEffort });
+          res.setHeader("Content-Type", "image/webp");
+        } else if (targetFormat === "avif") {
+          pipeline = pipeline.avif({ quality: settings.quality, effort: settings.effort });
+          res.setHeader("Content-Type", "image/avif");
+        }
+        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+        pipeline.on("error", (err) => {
+          console.error("[next-drive] Pipeline error:", err);
+        });
+        stream.pipe(pipeline);
+        pipeline.clone().toFile(cachePath).catch((e) => console.error("[next-drive] Cache write failed:", e));
+        pipeline.clone().pipe(res);
+        return true;
+      } catch (e) {
+        console.error("[next-drive] Image transformation failed:", e);
+      }
+    }
+    res.setHeader("Content-Type", mime);
+    if (fileSize) res.setHeader("Content-Length", fileSize);
+    stream.pipe(res);
+    return true;
+  } catch (error) {
+    console.error(`[next-drive] Error in ${action}:`, error);
+    const detail = error instanceof Error ? error.message : "Something went wrong while serving the file";
+    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
+    return true;
+  }
+};
+var handleAuthAction = async (req, res, action, config, owner) => {
+  if (!["getAuthUrl", "callback", "listAccounts", "removeAccount"].includes(action)) {
+    return false;
+  }
+  switch (action) {
+    case "getAuthUrl": {
+      const { provider } = req.query;
+      if (provider === "GOOGLE") {
+        const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+        if (!clientId || !clientSecret || !redirectUri) {
+          res.status(500).json({ status: 500, message: "Google Drive is not configured on the server" });
+          return true;
+        }
+        const callbackUri = new URL(redirectUri);
+        callbackUri.searchParams.set("action", "callback");
+        const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
+        const state = Buffer.from(JSON.stringify({ owner })).toString("base64");
+        const url = oAuth2Client.generateAuthUrl({
+          access_type: "offline",
+          scope: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/userinfo.email"],
+          state,
+          prompt: "consent"
+        });
+        res.status(200).json({ status: 200, message: "Auth URL generated", data: { url } });
+        return true;
+      }
+      res.status(400).json({ status: 400, message: "Unknown storage provider requested" });
+      return true;
+    }
+    case "callback": {
+      const { code } = req.query;
+      if (!code) {
+        res.status(400).json({ status: 400, message: "Google sign-in failed: authorization code missing" });
+        return true;
+      }
+      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+      if (!clientId || !clientSecret || !redirectUri) {
+        res.status(500).json({ status: 500, message: "Google Drive sign-in is not configured on the server" });
+        return true;
+      }
+      const callbackUri = new URL(redirectUri);
+      callbackUri.searchParams.set("action", "callback");
+      const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
+      const { tokens } = await oAuth2Client.getToken(code);
+      oAuth2Client.setCredentials(tokens);
+      const oauth2 = google.oauth2({ version: "v2", auth: oAuth2Client });
+      const userInfo = await oauth2.userinfo.get();
+      const existing = await account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
+      if (existing) {
+        existing.metadata.google.credentials = tokens;
+        existing.markModified("metadata");
+        await existing.save();
+      } else {
+        const newAccount = new account_default({
+          owner,
+          name: userInfo.data.name || "Google Drive",
+          metadata: {
+            provider: "GOOGLE",
+            google: {
+              email: userInfo.data.email,
+              credentials: tokens
+            }
+          }
+        });
+        await newAccount.save();
+      }
+      res.setHeader("Content-Type", "text/html");
+      res.send(`<!DOCTYPE html>
+<html>
+<head><title>Authentication Complete</title></head>
+<body>
+<p>Authentication successful! This window will close automatically.</p>
+<script>
+(function() {
+	if (window.opener) {
+		try {
+			window.opener.postMessage('oauth-success', '*');
+		} catch (e) {}
+	}
+	try {
+		localStorage.setItem('next-drive-oauth-success', Date.now().toString());
+		localStorage.removeItem('next-drive-oauth-success');
+	} catch (e) {}
+	window.close();
+	setTimeout(function() {
+		document.body.innerHTML = '<p style="font-family: system-ui; text-align: center; margin-top: 50px;">Authentication successful!<br>You can close this tab now.</p>';
+	}, 500);
+})();
+</script>
+</body>
+</html>`);
+      return true;
+    }
+    case "listAccounts": {
+      const accounts = await account_default.find({ owner });
+      res.status(200).json({
+        status: 200,
+        data: {
+          accounts: accounts.map((a) => ({
+            id: a._id.toString(),
+            name: a.name,
+            email: a.metadata.google?.email || "",
+            provider: a.metadata.provider
+          }))
+        }
+      });
+      return true;
+    }
+    case "removeAccount": {
+      const { id } = req.query;
+      const account = await account_default.findOne({ _id: id, owner });
+      if (!account) {
+        res.status(404).json({ status: 404, message: "Could not disconnect: account not found" });
+        return true;
+      }
+      if (account.metadata.provider === "GOOGLE") {
+        try {
+          await GoogleDriveProvider.revokeToken(owner, account._id.toString());
+        } catch (e) {
+          console.error("Failed to revoke Google token:", e);
+        }
+      }
+      await account_default.deleteOne({ _id: id, owner });
+      await drive_default.deleteMany({ owner, storageAccountId: id });
+      res.status(200).json({ status: 200, message: "Account removed" });
+      return true;
+    }
+    default:
+      return false;
+  }
+};
+var objectIdSchema = z.string().refine((val) => isValidObjectId(val), {
+  message: "Invalid ObjectId format"
+});
+var sanitizeFilename = (name) => {
+  return name.replace(/[<>:"|?*\x00-\x1F]/g, "").replace(/^\.+/, "").replace(/\.+$/, "").replace(/\\/g, "/").replace(/\/+/g, "/").replace(/\.\.\//g, "").replace(/\.\.+/g, "").split("/").pop() || "".trim().slice(0, 255);
+};
+var sanitizeRegexInput = (input) => {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").slice(0, 100);
+};
+var nameSchema = z.string().min(1, "Name is required").max(255, "Name too long").transform(sanitizeFilename).refine((val) => val.length > 0, { message: "Invalid name after sanitization" });
+var uploadChunkSchema = z.object({
+  chunkIndex: z.number().int().min(0).max(1e4),
+  totalChunks: z.number().int().min(1).max(1e4),
+  driveId: z.string().optional(),
+  fileName: nameSchema,
+  fileSize: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  fileType: z.string().min(1).max(255),
+  folderId: z.string().optional(),
+  unauthenticated: z.coerce.boolean().optional()
+}).refine((data) => data.chunkIndex < data.totalChunks, {
+  message: "Chunk index must be less than total chunks"
+});
+var listQuerySchema = z.object({
+  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]),
+  limit: z.string().optional().transform((val) => {
+    const num = parseInt(val || "50", 10);
+    return Math.min(Math.max(1, num), 100);
+  }),
+  afterId: objectIdSchema.optional()
+});
+z.object({
+  id: objectIdSchema,
+  token: z.string().optional()
+});
+z.object({
+  id: objectIdSchema,
+  size: z.enum(["small", "medium", "large"]).optional().default("medium"),
+  token: z.string().optional()
+});
+var renameBodySchema = z.object({
+  id: objectIdSchema,
+  newName: nameSchema
+});
+var deleteQuerySchema = z.object({
+  id: objectIdSchema
+});
+z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3)
+});
+var createFolderBodySchema = z.object({
+  name: nameSchema,
+  parentId: z.union([z.literal("root"), objectIdSchema, z.string().length(0), z.undefined()]).optional()
+});
+var moveBodySchema = z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3),
+  targetFolderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional()
+});
+var reorderBodySchema = z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3)
+});
+var searchQuerySchema = z.object({
+  q: z.string().min(1).max(100).transform(sanitizeRegexInput),
+  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional(),
+  limit: z.string().optional().transform((val) => {
+    const num = parseInt(val || "50", 10);
+    return Math.min(Math.max(1, num), 100);
+  }),
+  trashed: z.string().optional().transform((val) => val === "true")
+});
+z.object({
+  id: objectIdSchema
+});
+var cancelQuerySchema = z.object({
+  id: z.string().uuid()
+});
+z.object({
+  days: z.number().int().min(1).max(365).optional()
+});
+var driveFileSchemaZod = z.object({
+  id: z.string(),
+  file: z.object({
+    name: z.string(),
+    mime: z.string(),
+    size: z.number()
+  })
+});
 var getNextOrderValue = async (owner) => {
   const lastItem = await drive_default.findOne({ owner }, {}, { sort: { order: -1 } });
   return lastItem ? lastItem.order + 1 : 0;
@@ -1200,7 +1620,7 @@ var driveGetUrl = (fileId, options) => {
   } else {
     expiryTimestamp = Math.floor(Date.now() / 1e3) + expiresIn;
   }
-  const signature = crypto2.createHmac("sha256", secret).update(`${fileId}:${expiryTimestamp}`).digest("hex");
+  const signature = crypto3.createHmac("sha256", secret).update(`${fileId}:${expiryTimestamp}`).digest("hex");
   const token = Buffer.from(`${expiryTimestamp}:${signature}`).toString("base64url");
   return `${config.apiUrl || "/api/drive"}?action=serve&id=${fileId}&token=${token}`;
 };
@@ -1209,7 +1629,7 @@ var driveAddSignedUrlToken = (item, config) => {
   if (config.security?.signedUrls?.enabled && config.security.signedUrls.secret) {
     const { secret, expiresIn } = config.security.signedUrls;
     const expiryTimestamp = Math.floor(Date.now() / 1e3) + expiresIn;
-    const signature = crypto2.createHmac("sha256", secret).update(`${item.id}:${expiryTimestamp}`).digest("hex");
+    const signature = crypto3.createHmac("sha256", secret).update(`${item.id}:${expiryTimestamp}`).digest("hex");
     token = Buffer.from(`${expiryTimestamp}:${signature}`).toString("base64url");
   }
   const apiUrl = config.apiUrl || "/api/drive";
@@ -1528,7 +1948,7 @@ var driveUpload = async (source, key, options) => {
     if (!fs.existsSync(tempDir)) {
       fs.mkdirSync(tempDir, { recursive: true });
     }
-    tempFilePath = path.join(tempDir, `upload-${crypto2.randomUUID()}.tmp`);
+    tempFilePath = path.join(tempDir, `upload-${crypto3.randomUUID()}.tmp`);
     fs.writeFileSync(tempFilePath, source);
     sourceFilePath = tempFilePath;
     fileSize = source.length;
@@ -1537,7 +1957,7 @@ var driveUpload = async (source, key, options) => {
     if (!fs.existsSync(tempDir)) {
       fs.mkdirSync(tempDir, { recursive: true });
     }
-    tempFilePath = path.join(tempDir, `upload-${crypto2.randomUUID()}.tmp`);
+    tempFilePath = path.join(tempDir, `upload-${crypto3.randomUUID()}.tmp`);
     const writeStream = fs.createWriteStream(tempFilePath);
     await new Promise((resolve, reject) => {
       source.pipe(writeStream);
@@ -1708,98 +2128,29 @@ var driveCleanup = async () => {
   }
   return { removed, totalFreedInBytes };
 };
-var objectIdSchema = z.string().refine((val) => isValidObjectId(val), {
-  message: "Invalid ObjectId format"
-});
-var sanitizeFilename = (name) => {
-  return name.replace(/[<>:"|?*\x00-\x1F]/g, "").replace(/^\.+/, "").replace(/\.+$/, "").replace(/\\/g, "/").replace(/\/+/g, "/").replace(/\.\.\//g, "").replace(/\.\.+/g, "").split("/").pop() || "".trim().slice(0, 255);
+var driveConfirm = async (id) => {
+  const result = await drive_default.updateOne({ _id: id }, { $set: { expiresAt: null } });
+  return result.matchedCount > 0;
 };
-var sanitizeRegexInput = (input) => {
-  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").slice(0, 100);
+var drivePurgeExpired = async () => {
+  const expired = await drive_default.find({ expiresAt: { $ne: null, $lt: /* @__PURE__ */ new Date() } });
+  const removed = [];
+  let totalFreedInBytes = 0;
+  for (const drive of expired) {
+    const id = String(drive._id);
+    try {
+      await driveDelete(drive);
+      totalFreedInBytes += drive.information.type === "FILE" ? drive.information.sizeInBytes : 0;
+      removed.push(id);
+    } catch (e) {
+      console.error(`[next-drive] Failed to purge expired file ${id}:`, e);
+    }
+  }
+  return { removed, totalFreedInBytes };
 };
-var nameSchema = z.string().min(1, "Name is required").max(255, "Name too long").transform(sanitizeFilename).refine((val) => val.length > 0, { message: "Invalid name after sanitization" });
-var uploadChunkSchema = z.object({
-  chunkIndex: z.number().int().min(0).max(1e4),
-  totalChunks: z.number().int().min(1).max(1e4),
-  driveId: z.string().optional(),
-  fileName: nameSchema,
-  fileSize: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  fileType: z.string().min(1).max(255),
-  folderId: z.string().optional()
-}).refine((data) => data.chunkIndex < data.totalChunks, {
-  message: "Chunk index must be less than total chunks"
-});
-var listQuerySchema = z.object({
-  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]),
-  limit: z.string().optional().transform((val) => {
-    const num = parseInt(val || "50", 10);
-    return Math.min(Math.max(1, num), 100);
-  }),
-  afterId: objectIdSchema.optional()
-});
-z.object({
-  id: objectIdSchema,
-  token: z.string().optional()
-});
-z.object({
-  id: objectIdSchema,
-  size: z.enum(["small", "medium", "large"]).optional().default("medium"),
-  token: z.string().optional()
-});
-var renameBodySchema = z.object({
-  id: objectIdSchema,
-  newName: nameSchema
-});
-var deleteQuerySchema = z.object({
-  id: objectIdSchema
-});
-z.object({
-  ids: z.array(objectIdSchema).min(1).max(1e3)
-});
-var createFolderBodySchema = z.object({
-  name: nameSchema,
-  parentId: z.union([z.literal("root"), objectIdSchema, z.string().length(0), z.undefined()]).optional()
-});
-var moveBodySchema = z.object({
-  ids: z.array(objectIdSchema).min(1).max(1e3),
-  targetFolderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional()
-});
-z.object({
-  ids: z.array(objectIdSchema).min(1).max(1e3)
-});
-var searchQuerySchema = z.object({
-  q: z.string().min(1).max(100).transform(sanitizeRegexInput),
-  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional(),
-  limit: z.string().optional().transform((val) => {
-    const num = parseInt(val || "50", 10);
-    return Math.min(Math.max(1, num), 100);
-  }),
-  trashed: z.string().optional().transform((val) => val === "true")
-});
-z.object({
-  id: objectIdSchema
-});
-var cancelQuerySchema = z.object({
-  id: z.string().uuid()
-});
-z.object({
-  days: z.number().int().min(1).max(365).optional()
-});
-var driveFileSchemaZod = z.object({
-  id: z.string(),
-  file: z.object({
-    name: z.string(),
-    mime: z.string(),
-    size: z.number()
-  })
-});
 
-// src/server/security/cryptoUtils.ts
-function sanitizeContentDispositionFilename(filename) {
-  const basename = filename.replace(/^.*[\\\/]/, "");
-  return basename.replace(/["\r\n]/g, "").replace(/[^\x20-\x7E]/g, "").slice(0, 255);
-}
-var getProvider = async (req, owner) => {
+// src/server/actions/shared.ts
+var resolveProvider = async (req, owner) => {
   const accountId = req.headers["x-drive-account"];
   if (!accountId || accountId === "LOCAL") {
     return { provider: LocalStorageProvider };
@@ -1808,732 +2159,568 @@ var getProvider = async (req, owner) => {
   if (!account) {
     throw new Error("Storage account not found or access denied");
   }
-  if (account.metadata.provider === "GOOGLE") return { provider: GoogleDriveProvider, accountId: account._id.toString() };
+  if (account.metadata.provider === "GOOGLE") {
+    return { provider: GoogleDriveProvider, accountId: account._id.toString() };
+  }
   return { provider: LocalStorageProvider };
 };
-var addSignedUrlToken = (item, config) => {
+var withSignedUrl = (item, config) => {
   return driveAddSignedUrlToken(item, config);
 };
-var addSignedUrlTokens = (items, config) => {
+var withSignedUrls = (items, config) => {
   return driveAddSignedUrlTokens(items, config);
 };
-var applyCorsHeaders = (req, res, config) => {
-  const cors = config.cors;
-  if (!cors?.enabled) return false;
-  const origin = req.headers.origin;
-  const allowedOrigins = cors.origins ?? "*";
-  const methods = cors.methods ?? ["GET", "POST", "PUT", "DELETE", "OPTIONS"];
-  const allowedHeaders = cors.allowedHeaders ?? ["Content-Type", "Authorization", "X-Drive-Account"];
-  const exposedHeaders = cors.exposedHeaders ?? ["Content-Length", "Content-Type", "Content-Disposition"];
-  const credentials = cors.credentials ?? false;
-  const maxAge = cors.maxAge ?? 86400;
-  let allowOrigin = null;
-  if (origin) {
-    if (allowedOrigins === "*") {
-      allowOrigin = origin;
-    } else if (Array.isArray(allowedOrigins)) {
-      if (allowedOrigins.includes(origin)) {
-        allowOrigin = origin;
+
+// src/server/actions/drive.ts
+var handleDriveAction = async (ctx) => {
+  const { req, res, action, config, owner, isRootMode, information, provider, accountId } = ctx;
+  switch (action) {
+    case "list": {
+      if (req.method !== "GET") return void res.status(405).json({ status: 405, message: "Listing files requires a GET request" });
+      const listQuery = listQuerySchema.safeParse(req.query);
+      if (!listQuery.success) return void res.status(400).json({ status: 400, message: "Could not list files: invalid request parameters" });
+      const { folderId, limit, afterId } = listQuery.data;
+      try {
+        await provider.sync(folderId || "root", owner, accountId);
+      } catch (e) {
+        console.error("Sync failed", e);
       }
-    } else if (allowedOrigins === origin) {
-      allowOrigin = origin;
-    }
-  } else if (allowedOrigins === "*") {
-    allowOrigin = "*";
-  }
-  if (!allowOrigin) {
-    if (req.method === "OPTIONS") {
-      res.status(403).end();
-      return true;
-    }
-    return false;
-  }
-  res.setHeader("Access-Control-Allow-Origin", allowOrigin);
-  res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
-  res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
-  res.setHeader("Access-Control-Expose-Headers", exposedHeaders.join(", "));
-  res.setHeader("Access-Control-Max-Age", maxAge.toString());
-  if (credentials) {
-    res.setHeader("Access-Control-Allow-Credentials", "true");
-  }
-  if (req.method === "OPTIONS") {
-    res.status(204).end();
-    return true;
-  }
-  return false;
-};
-var driveAPIHandler = async (req, res) => {
-  const action = req.query.action || (req.query.code && req.query.state ? "callback" : void 0);
-  let config;
-  try {
-    config = getDriveConfig();
-  } catch (error) {
-    console.error("[next-drive] Configuration error:", error);
-    res.status(500).json({ status: 500, message: "Drive is not ready: failed to initialize configuration" });
-    return;
-  }
-  const isPreflightHandled = applyCorsHeaders(req, res, config);
-  if (isPreflightHandled) return;
-  if (!action) {
-    res.status(400).json({ status: 400, message: 'Missing "action" parameter in request' });
-    return;
-  }
-  if (action === "serve" || action === "thumbnail") {
-    try {
-      const { id, token } = req.query;
-      if (!id || typeof id !== "string") {
-        return res.status(400).json({ status: 400, message: "Could not open file: missing or invalid file ID" });
+      const query = {
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        parentId: folderId === "root" || !folderId ? null : folderId,
+        trashedAt: null
+      };
+      if (!isRootMode) {
+        query.owner = owner;
       }
-      const drive = await drive_default.findById(id);
-      if (!drive) return res.status(404).json({ status: 404, message: "File not found or no longer available" });
-      if (config.security?.signedUrls?.enabled) {
-        if (!token || typeof token !== "string") {
-          return res.status(401).json({ status: 401, message: "Access denied: this link is missing its access token" });
-        }
+      if (afterId) query._id = { $lt: afterId };
+      const items = await drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
+      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Items retrieved", data: { items: plainItems, hasMore: items.length === limit } });
+      return;
+    }
+    case "search": {
+      const searchData = searchQuerySchema.safeParse(req.query);
+      if (!searchData.success) return void res.status(400).json({ status: 400, message: "Could not search: invalid request parameters" });
+      const { q, folderId, limit, trashed } = searchData.data;
+      if (!trashed) {
         try {
-          const decoded = Buffer.from(token, "base64url").toString();
-          const [expiryStr, signature] = decoded.split(":");
-          const expiry = parseInt(expiryStr, 10);
-          if (Date.now() / 1e3 > expiry) {
-            return res.status(401).json({ status: 401, message: "Access denied: this link has expired" });
-          }
-          const { secret } = config.security.signedUrls;
-          const expectedSignature = crypto2.createHmac("sha256", secret).update(`${id}:${expiry}`).digest("hex");
-          if (signature !== expectedSignature) {
-            return res.status(401).json({ status: 401, message: "Access denied: this link's access token is invalid" });
-          }
-        } catch (err) {
-          return res.status(401).json({ status: 401, message: "Access denied: this link's access token is malformed" });
-        }
-      }
-      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
-      if (action === "thumbnail") {
-        const stream = await itemProvider.getThumbnail(drive, itemAccountId);
-        res.setHeader("Content-Type", "image/webp");
-        if (config.cors?.enabled) {
-          res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+          await provider.search(q, owner, accountId);
+        } catch (e) {
+          console.error("Search sync failed", e);
         }
-        stream.pipe(res);
-        return;
       }
-      if (action === "serve") {
-        const { stream, mime, size: fileSize } = await itemProvider.openStream(drive, itemAccountId);
-        const safeFilename = sanitizeContentDispositionFilename(drive.name);
-        const format = req.query.format;
-        const quality = req.query.quality;
-        const display = req.query.display;
-        const sizePreset = req.query.size;
-        const fit = req.query.fit;
-        const position = req.query.position;
-        const isImage = mime.startsWith("image/");
-        const shouldTransform = isImage && (format || quality || display || sizePreset || fit);
-        res.setHeader("Content-Disposition", `inline; filename="${safeFilename}"`);
-        if (config.cors?.enabled) {
-          res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-        }
-        if (shouldTransform) {
-          try {
-            const settings = getImageSettings(fileSize, quality, display, sizePreset, fit, position);
-            let targetFormat = format || mime.split("/")[1];
-            if (targetFormat === "jpg") targetFormat = "jpeg";
-            if (!["jpeg", "png", "webp", "avif"].includes(targetFormat)) {
-              targetFormat = format || "webp";
-            }
-            const cacheDir = path.join(config.storage.path, "file", drive._id.toString(), "cache");
-            const cacheKey = [
-              "opt",
-              `q${settings.quality}`,
-              `e${settings.effort}`,
-              settings.width ? `${settings.width}x${settings.height}` : "orig",
-              settings.fit || "none",
-              settings.position || "c",
-              targetFormat
-            ].join("_");
-            const cachePath = path.join(cacheDir, `${cacheKey}.bin`);
-            if (fs.existsSync(cachePath)) {
-              const cacheStat = fs.statSync(cachePath);
-              res.setHeader("Content-Type", `image/${targetFormat}`);
-              res.setHeader("Content-Length", cacheStat.size);
-              res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-              if (config.cors?.enabled) {
-                res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-              }
-              if ("destroy" in stream) stream.destroy();
-              fs.createReadStream(cachePath).pipe(res);
-              return;
-            }
-            if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
-            let pipeline = sharp2();
-            if (settings.width && settings.height) {
-              pipeline = pipeline.resize(settings.width, settings.height, {
-                fit: settings.fit || "inside",
-                position: settings.position || "center",
-                withoutEnlargement: true,
-                // Use transparent background for 'contain' fit to preserve transparency
-                background: { r: 0, g: 0, b: 0, alpha: 0 }
-              });
-            }
-            if (targetFormat === "jpeg") {
-              pipeline = pipeline.jpeg({ quality: settings.quality, mozjpeg: true });
-              res.setHeader("Content-Type", "image/jpeg");
-            } else if (targetFormat === "png") {
-              pipeline = pipeline.png({ compressionLevel: settings.pngCompression, adaptiveFiltering: true });
-              res.setHeader("Content-Type", "image/png");
-            } else if (targetFormat === "webp") {
-              const webpEffort = Math.min(settings.effort, 6);
-              pipeline = pipeline.webp({ quality: settings.quality, effort: webpEffort });
-              res.setHeader("Content-Type", "image/webp");
-            } else if (targetFormat === "avif") {
-              pipeline = pipeline.avif({ quality: settings.quality, effort: settings.effort });
-              res.setHeader("Content-Type", "image/avif");
-            }
-            res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-            pipeline.on("error", (err) => {
-              console.error("[next-drive] Pipeline error:", err);
-            });
-            stream.pipe(pipeline);
-            pipeline.clone().toFile(cachePath).catch((e) => console.error("[next-drive] Cache write failed:", e));
-            pipeline.clone().pipe(res);
-            return;
-          } catch (e) {
-            console.error("[next-drive] Image transformation failed:", e);
-          }
-        }
-        res.setHeader("Content-Type", mime);
-        if (fileSize) res.setHeader("Content-Length", fileSize);
-        stream.pipe(res);
-        return;
+      const query = {
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: trashed ? { $ne: null } : null,
+        name: { $regex: q, $options: "i" }
+      };
+      if (!isRootMode) {
+        query.owner = owner;
       }
-    } catch (error) {
-      console.error(`[next-drive] Error in ${action}:`, error);
-      return res.status(500).json({
-        status: 500,
-        message: error instanceof Error ? error.message : "Something went wrong while serving the file"
+      if (folderId && folderId !== "root") query.parentId = folderId;
+      const items = await drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
+      const plainItems = withSignedUrls(await Promise.all(items.map((i) => i.toClient())), config);
+      res.status(200).json({ status: 200, message: "Results", data: { items: plainItems } });
+      return;
+    }
+    case "upload": {
+      if (req.method !== "POST") return void res.status(405).json({ status: 405, message: "Uploading requires a POST request" });
+      const systemTmpDir = path.join(os2.tmpdir(), "next-drive-uploads");
+      if (!fs.existsSync(systemTmpDir)) fs.mkdirSync(systemTmpDir, { recursive: true });
+      const form = formidable({
+        multiples: false,
+        maxFileSize: (config.security?.maxUploadSizeInBytes ?? 1024 * 1024 * 1024) * 2,
+        uploadDir: systemTmpDir,
+        keepExtensions: true
       });
-    }
-  }
-  try {
-    const mode = config.mode || "NORMAL";
-    const information = await getDriveInformation({ method: "REQUEST", req });
-    const { key: owner } = information;
-    const STORAGE_PATH = config.storage.path;
-    const isRootMode = mode === "ROOT";
-    if (action === "information") {
-      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-      const googleConfigured = !!(clientId && clientSecret && redirectUri);
-      return res.status(200).json({
-        status: 200,
-        message: "Information retrieved",
-        data: {
-          providers: {
-            google: googleConfigured
-          },
-          mode
-        }
+      const [fields, files] = await new Promise((resolve, reject) => {
+        form.parse(req, (err, parsedFields, parsedFiles) => {
+          if (err) reject(err);
+          else resolve([parsedFields, parsedFiles]);
+        });
       });
-    }
-    if (["getAuthUrl", "callback", "listAccounts", "removeAccount"].includes(action)) {
-      switch (action) {
-        case "getAuthUrl": {
-          const { provider: provider2 } = req.query;
-          if (provider2 === "GOOGLE") {
-            const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-            if (!clientId || !clientSecret || !redirectUri) return res.status(500).json({ status: 500, message: "Google Drive is not configured on the server" });
-            const callbackUri = new URL(redirectUri);
-            callbackUri.searchParams.set("action", "callback");
-            const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
-            const state = Buffer.from(JSON.stringify({ owner })).toString("base64");
-            const url = oAuth2Client.generateAuthUrl({
-              access_type: "offline",
-              scope: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/userinfo.email"],
-              state,
-              prompt: "consent"
-              // force refresh token
-            });
-            return res.status(200).json({ status: 200, message: "Auth URL generated", data: { url } });
+      const cleanupTempFiles = (allFiles) => {
+        Object.values(allFiles).flat().forEach((file) => {
+          if (file && fs.existsSync(file.filepath)) fs.rmSync(file.filepath, { force: true });
+        });
+      };
+      const getString = (f) => Array.isArray(f) ? f[0] : f || "";
+      const getInt = (f) => parseInt(getString(f) || "0", 10);
+      const uploadData = uploadChunkSchema.safeParse({
+        chunkIndex: getInt(fields.chunkIndex),
+        totalChunks: getInt(fields.totalChunks),
+        driveId: getString(fields.driveId) || void 0,
+        fileName: getString(fields.fileName),
+        fileSize: getInt(fields.fileSize),
+        fileType: getString(fields.fileType),
+        folderId: getString(fields.folderId) || void 0
+      });
+      if (!uploadData.success) {
+        cleanupTempFiles(files);
+        return void res.status(400).json({ status: 400, message: uploadData.error.errors[0].message });
+      }
+      const { chunkIndex, totalChunks, driveId, fileName, fileSize: fileSizeInBytes, fileType, folderId, unauthenticated } = uploadData.data;
+      let currentUploadId = driveId;
+      const tempBaseDir = path.join(os2.tmpdir(), "next-drive-uploads");
+      if (!currentUploadId) {
+        if (chunkIndex !== 0) return void res.status(400).json({ message: "Could not upload: missing upload session for this chunk" });
+        if (unauthenticated) {
+          const unauth = config.security?.unauthenticated;
+          if (!unauth?.enabled) {
+            cleanupTempFiles(files);
+            return void res.status(403).json({ status: 403, message: "Anonymous uploads are not enabled" });
           }
-          return res.status(400).json({ status: 400, message: "Unknown storage provider requested" });
-        }
-        case "callback": {
-          const { code, state } = req.query;
-          if (!code) return res.status(400).json({ status: 400, message: "Google sign-in failed: authorization code missing" });
-          const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
-          if (!clientId || !clientSecret || !redirectUri) return res.status(500).json({ status: 500, message: "Google Drive sign-in is not configured on the server" });
-          const callbackUri = new URL(redirectUri);
-          callbackUri.searchParams.set("action", "callback");
-          const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
-          const { tokens } = await oAuth2Client.getToken(code);
-          oAuth2Client.setCredentials(tokens);
-          const oauth2 = google.oauth2({ version: "v2", auth: oAuth2Client });
-          const userInfo = await oauth2.userinfo.get();
-          const existing = await account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
-          if (existing) {
-            existing.metadata.google.credentials = tokens;
-            existing.markModified("metadata");
-            await existing.save();
-          } else {
-            const newAccount = new account_default({
-              owner,
-              name: userInfo.data.name || "Google Drive",
-              metadata: {
-                provider: "GOOGLE",
-                google: {
-                  email: userInfo.data.email,
-                  credentials: tokens
-                }
-              }
-            });
-            await newAccount.save();
+          if (fileSizeInBytes > unauth.maxUploadSizeInBytes) {
+            cleanupTempFiles(files);
+            return void res.status(413).json({ status: 413, message: "Could not upload: file exceeds the maximum allowed size" });
           }
-          res.setHeader("Content-Type", "text/html");
-          return res.send(`<!DOCTYPE html>
-<html>
-<head><title>Authentication Complete</title></head>
-<body>
-<p>Authentication successful! This window will close automatically.</p>
-<script>
-(function() {
-	// Method 1: postMessage for popup windows
-	if (window.opener) {
-		try {
-			window.opener.postMessage('oauth-success', '*');
-		} catch (e) {}
-	}
-	// Method 2: localStorage event for new tabs (macOS fullscreen mode)
-	try {
-		localStorage.setItem('next-drive-oauth-success', Date.now().toString());
-		localStorage.removeItem('next-drive-oauth-success');
-	} catch (e) {}
-	// Close the window/tab
-	window.close();
-	// Fallback: If window.close() doesn't work (some browsers block it),
-	// show a message to manually close
-	setTimeout(function() {
-		document.body.innerHTML = '<p style="font-family: system-ui; text-align: center; margin-top: 50px;">Authentication successful!<br>You can close this tab now.</p>';
-	}, 500);
-})();
-</script>
-</body>
-</html>`);
-        }
-        case "listAccounts": {
-          const accounts = await account_default.find({ owner });
-          return res.status(200).json({
-            status: 200,
-            data: {
-              accounts: accounts.map((a) => ({
-                id: a._id.toString(),
-                name: a.name,
-                email: a.metadata.google?.email || "",
-                provider: a.metadata.provider
-              }))
+          if (fileType && !validateMimeType(fileType, unauth.allowedMimeTypes)) {
+            cleanupTempFiles(files);
+            return void res.status(400).json({ status: 400, message: `Could not upload: file type "${fileType}" is not allowed` });
+          }
+          const abuse = unauth.abuse;
+          if (abuse) {
+            const store = globalThis.__nextDrive.abuse;
+            const now = Date.now();
+            const ip = abuse.clientId?.(req) ?? (abuse.trustedHeaders ?? ["cf-connecting-ip", "x-forwarded-for"]).map((h) => req.headers[h]).find(Boolean)?.split(",")[0].trim() ?? req.socket.remoteAddress ?? "unknown";
+            const hits = (store.ipHits.get(ip) ?? []).filter((t) => now - t < 36e5);
+            const perIp = abuse.perIp;
+            if (perIp && hits.filter((t) => now - t < perIp.windowMinutes * 6e4).length >= perIp.max) {
+              cleanupTempFiles(files);
+              return void res.status(429).json({ status: 429, message: "Too many uploads, please try again later" });
             }
-          });
-        }
-        case "removeAccount": {
-          const { id } = req.query;
-          const account = await account_default.findOne({ _id: id, owner });
-          if (!account) return res.status(404).json({ status: 404, message: "Could not disconnect: account not found" });
-          if (account.metadata.provider === "GOOGLE") {
-            try {
-              await GoogleDriveProvider.revokeToken(owner, account._id.toString());
-            } catch (e) {
-              console.error("Failed to revoke Google token:", e);
+            if (abuse.hourlyPerIp && hits.length >= abuse.hourlyPerIp) {
+              cleanupTempFiles(files);
+              return void res.status(429).json({ status: 429, message: "Hourly upload limit reached, please try again later" });
             }
+            if (abuse.maxConcurrent && store.concurrent >= abuse.maxConcurrent) {
+              cleanupTempFiles(files);
+              return void res.status(429).json({ status: 429, message: "Server is busy with uploads, please try again later" });
+            }
+            if (abuse.maxLiveBytes) {
+              const [agg] = await drive_default.aggregate([{ $match: { expiresAt: { $ne: null } } }, { $group: { _id: null, total: { $sum: "$information.sizeInBytes" } } }]);
+              if ((agg?.total ?? 0) + fileSizeInBytes > abuse.maxLiveBytes) {
+                cleanupTempFiles(files);
+                return void res.status(429).json({ status: 429, message: "Temporary storage is full, please try again later" });
+              }
+            }
+            hits.push(now);
+            store.ipHits.set(ip, hits);
+            store.concurrent++;
           }
-          await account_default.deleteOne({ _id: id, owner });
-          await drive_default.deleteMany({ owner, storageAccountId: id });
-          return res.status(200).json({ status: 200, message: "Account removed" });
-        }
-      }
-    }
-    const { provider, accountId } = await getProvider(req, owner);
-    switch (action) {
-      // ** 1. LIST **
-      case "list": {
-        if (req.method !== "GET") return res.status(405).json({ status: 405, message: "Listing files requires a GET request" });
-        const listQuery = listQuerySchema.safeParse(req.query);
-        if (!listQuery.success) return res.status(400).json({ status: 400, message: "Could not list files: invalid request parameters" });
-        const { folderId, limit, afterId } = listQuery.data;
-        try {
-          await provider.sync(folderId || "root", owner, accountId);
-        } catch (e) {
-          console.error("Sync failed", e);
-        }
-        const query = {
-          "provider.type": provider.name,
-          storageAccountId: accountId || null,
-          parentId: folderId === "root" || !folderId ? null : folderId,
-          trashedAt: null
-        };
-        if (!isRootMode) {
-          query.owner = owner;
-        }
-        if (afterId) query._id = { $lt: afterId };
-        const items = await drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
-        const plainItems = addSignedUrlTokens(await Promise.all(items.map((item) => item.toClient())), config);
-        res.status(200).json({ status: 200, message: "Items retrieved", data: { items: plainItems, hasMore: items.length === limit } });
-        return;
-      }
-      // ** 2. SEARCH **
-      case "search": {
-        const searchData = searchQuerySchema.safeParse(req.query);
-        if (!searchData.success) return res.status(400).json({ status: 400, message: "Could not search: invalid request parameters" });
-        const { q, folderId, limit, trashed } = searchData.data;
-        if (!trashed) {
-          try {
-            await provider.search(q, owner, accountId);
-          } catch (e) {
-            console.error("Search sync failed", e);
-          }
-        }
-        const query = {
-          "provider.type": provider.name,
-          storageAccountId: accountId || null,
-          trashedAt: trashed ? { $ne: null } : null,
-          name: { $regex: q, $options: "i" }
-        };
-        if (!isRootMode) {
-          query.owner = owner;
-        }
-        if (folderId && folderId !== "root") query.parentId = folderId;
-        const items = await drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
-        const plainItems = addSignedUrlTokens(await Promise.all(items.map((i) => i.toClient())), config);
-        return res.status(200).json({ status: 200, message: "Results", data: { items: plainItems } });
-      }
-      // ** 3. UPLOAD **
-      case "upload": {
-        if (req.method !== "POST") return res.status(405).json({ status: 405, message: "Uploading requires a POST request" });
-        const systemTmpDir = path.join(os2.tmpdir(), "next-drive-uploads");
-        if (!fs.existsSync(systemTmpDir)) fs.mkdirSync(systemTmpDir, { recursive: true });
-        const form = formidable({
-          multiples: false,
-          maxFileSize: (config.security?.maxUploadSizeInBytes ?? 1024 * 1024 * 1024) * 2,
-          uploadDir: systemTmpDir,
-          keepExtensions: true
-        });
-        const [fields, files] = await new Promise((resolve, reject) => {
-          form.parse(req, (err, fields2, files2) => {
-            if (err) reject(err);
-            else resolve([fields2, files2]);
-          });
-        });
-        const cleanupTempFiles = (files2) => {
-          Object.values(files2).flat().forEach((file) => {
-            if (file && fs.existsSync(file.filepath)) fs.rmSync(file.filepath, { force: true });
-          });
-        };
-        const getString = (f) => Array.isArray(f) ? f[0] : f || "";
-        const getInt = (f) => parseInt(getString(f) || "0", 10);
-        const uploadData = uploadChunkSchema.safeParse({
-          chunkIndex: getInt(fields.chunkIndex),
-          totalChunks: getInt(fields.totalChunks),
-          driveId: getString(fields.driveId) || void 0,
-          fileName: getString(fields.fileName),
-          fileSize: getInt(fields.fileSize),
-          fileType: getString(fields.fileType),
-          folderId: getString(fields.folderId) || void 0
-        });
-        if (!uploadData.success) {
-          cleanupTempFiles(files);
-          return res.status(400).json({ status: 400, message: uploadData.error.errors[0].message });
-        }
-        const { chunkIndex, totalChunks, driveId, fileName, fileSize: fileSizeInBytes, fileType, folderId } = uploadData.data;
-        let currentUploadId = driveId;
-        const tempBaseDir = path.join(os2.tmpdir(), "next-drive-uploads");
-        if (!currentUploadId) {
-          if (chunkIndex !== 0) return res.status(400).json({ message: "Could not upload: missing upload session for this chunk" });
+        } else {
           if (fileType && config.security) {
             if (!validateMimeType(fileType, config.security.allowedMimeTypes)) {
               cleanupTempFiles(files);
-              return res.status(400).json({ status: 400, message: `Could not upload: file type "${fileType}" is not allowed` });
+              return void res.status(400).json({ status: 400, message: `Could not upload: file type "${fileType}" is not allowed` });
             }
           }
           if (!isRootMode) {
             const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
             if (quota.usedInBytes + fileSizeInBytes > quota.quotaInBytes) {
               cleanupTempFiles(files);
-              return res.status(413).json({ status: 413, message: "Could not upload: you have run out of storage space" });
+              return void res.status(413).json({ status: 413, message: "Could not upload: you have run out of storage space" });
             }
           }
-          currentUploadId = crypto2.randomUUID();
-          const uploadDir = path.join(tempBaseDir, currentUploadId);
-          fs.mkdirSync(uploadDir, { recursive: true });
-          const metadata = {
-            owner,
-            accountId,
-            providerName: provider.name,
-            name: fileName,
-            parentId: folderId === "root" || !folderId ? null : folderId,
-            fileSize: fileSizeInBytes,
-            mimeType: fileType,
-            totalChunks
-          };
-          fs.writeFileSync(path.join(uploadDir, "metadata.json"), JSON.stringify(metadata));
         }
-        if (currentUploadId) {
-          const uploadDir = path.join(tempBaseDir, currentUploadId);
-          if (!fs.existsSync(uploadDir)) {
-            cleanupTempFiles(files);
-            return res.status(404).json({ status: 404, message: "Could not upload: this upload session was not found or has expired" });
+        currentUploadId = crypto3.randomUUID();
+        const uploadDir2 = path.join(tempBaseDir, currentUploadId);
+        fs.mkdirSync(uploadDir2, { recursive: true });
+        const metadata = {
+          owner: unauthenticated ? null : owner,
+          accountId: unauthenticated ? null : accountId,
+          providerName: provider.name,
+          name: fileName,
+          parentId: unauthenticated || folderId === "root" || !folderId ? null : folderId,
+          fileSize: fileSizeInBytes,
+          mimeType: fileType,
+          totalChunks,
+          unauthenticated: !!unauthenticated
+        };
+        fs.writeFileSync(path.join(uploadDir2, "metadata.json"), JSON.stringify(metadata));
+      }
+      if (!currentUploadId) {
+        cleanupTempFiles(files);
+        return void res.status(400).json({ status: 400, message: "Could not upload: invalid upload request" });
+      }
+      const uploadDir = path.join(tempBaseDir, currentUploadId);
+      if (!fs.existsSync(uploadDir)) {
+        cleanupTempFiles(files);
+        return void res.status(404).json({ status: 404, message: "Could not upload: this upload session was not found or has expired" });
+      }
+      try {
+        const chunkFile = Array.isArray(files.chunk) ? files.chunk[0] : files.chunk;
+        if (!chunkFile) throw new Error("Could not upload: no file chunk was received");
+        const partPath = path.join(uploadDir, `part_${chunkIndex}`);
+        try {
+          fs.renameSync(chunkFile.filepath, partPath);
+        } catch (err) {
+          if (err instanceof Error && "code" in err && err.code === "EXDEV") {
+            fs.copyFileSync(chunkFile.filepath, partPath);
+            fs.unlinkSync(chunkFile.filepath);
+          } else {
+            throw err;
           }
-          try {
-            const chunkFile = Array.isArray(files.chunk) ? files.chunk[0] : files.chunk;
-            if (!chunkFile) throw new Error("Could not upload: no file chunk was received");
-            const partPath = path.join(uploadDir, `part_${chunkIndex}`);
-            try {
-              fs.renameSync(chunkFile.filepath, partPath);
-            } catch (err) {
-              if (err instanceof Error && "code" in err && err.code === "EXDEV") {
-                fs.copyFileSync(chunkFile.filepath, partPath);
-                fs.unlinkSync(chunkFile.filepath);
-              } else {
-                throw err;
-              }
+        }
+        const uploadedParts = fs.readdirSync(uploadDir).filter((f) => f.startsWith("part_"));
+        if (uploadedParts.length === totalChunks) {
+          const metaPath = path.join(uploadDir, "metadata.json");
+          const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+          const finalTempPath = path.join(uploadDir, "final.bin");
+          const writeStream = fs.createWriteStream(finalTempPath);
+          let streamError = null;
+          writeStream.on("error", (err) => {
+            streamError = err;
+          });
+          await new Promise((resolve, reject) => {
+            writeStream.on("open", () => resolve());
+            writeStream.once("error", reject);
+          });
+          for (let i = 0; i < totalChunks; i++) {
+            if (streamError) {
+              writeStream.destroy();
+              throw streamError;
             }
-            const uploadedParts = fs.readdirSync(uploadDir).filter((f) => f.startsWith("part_"));
-            if (uploadedParts.length === totalChunks) {
-              const metaPath = path.join(uploadDir, "metadata.json");
-              const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
-              const finalTempPath = path.join(uploadDir, "final.bin");
-              const writeStream = fs.createWriteStream(finalTempPath);
-              let streamError = null;
-              writeStream.on("error", (err) => {
-                streamError = err;
-              });
-              await new Promise((resolve, reject) => {
-                writeStream.on("open", () => resolve());
-                writeStream.once("error", reject);
-              });
-              for (let i = 0; i < totalChunks; i++) {
-                if (streamError) {
-                  writeStream.destroy();
-                  throw streamError;
-                }
-                const pPath = path.join(uploadDir, `part_${i}`);
-                if (!fs.existsSync(pPath)) {
-                  writeStream.destroy();
-                  throw new Error(`Could not finish upload: chunk ${i} is missing`);
-                }
-                const data = fs.readFileSync(pPath);
-                const canContinue = writeStream.write(data);
-                if (!canContinue) {
-                  await new Promise((resolve, reject) => {
-                    writeStream.once("drain", resolve);
-                    writeStream.once("error", reject);
-                  });
-                }
-              }
+            const pPath = path.join(uploadDir, `part_${i}`);
+            if (!fs.existsSync(pPath)) {
+              writeStream.destroy();
+              throw new Error(`Could not finish upload: chunk ${i} is missing`);
+            }
+            const data = fs.readFileSync(pPath);
+            const canContinue = writeStream.write(data);
+            if (!canContinue) {
               await new Promise((resolve, reject) => {
-                if (streamError) {
-                  reject(streamError);
-                  return;
-                }
-                writeStream.end();
-                writeStream.on("finish", resolve);
+                writeStream.once("drain", resolve);
                 writeStream.once("error", reject);
               });
-              if (!fs.existsSync(finalTempPath)) {
-                throw new Error("Could not finish upload: failed to assemble the file");
-              }
-              const finalStats = fs.statSync(finalTempPath);
-              if (finalStats.size !== meta.fileSize) {
-                throw new Error("Could not finish upload: the assembled file is incomplete (size mismatch)");
-              }
-              const drive = new drive_default({
-                owner: meta.owner,
-                storageAccountId: meta.accountId || null,
-                provider: { type: meta.providerName },
-                name: meta.name,
-                parentId: meta.parentId,
-                order: 0,
-                information: { type: "FILE", sizeInBytes: meta.fileSize, mime: meta.mimeType, path: "" },
-                // path set by provider
-                status: "UPLOADING",
-                currentChunk: totalChunks,
-                totalChunks
-              });
-              if (meta.providerName === "LOCAL" && drive.information.type === "FILE") {
-                drive.information.path = path.join("file", String(drive._id), "data.bin");
-              }
-              await drive.save();
-              try {
-                const item = await provider.uploadFile(drive, finalTempPath, meta.accountId);
-                fs.rmSync(uploadDir, { recursive: true, force: true });
-                const newQuota = await provider.getQuota(meta.owner, meta.accountId, information.storage.quotaInBytes);
-                res.status(200).json({ status: 200, message: "Upload complete", data: { type: "UPLOAD_COMPLETE", driveId: String(drive._id), item: addSignedUrlToken(item, config) }, statistic: { storage: newQuota } });
-              } catch (err) {
-                await drive_default.deleteOne({ _id: drive._id });
-                throw err;
-              }
-            } else {
-              const newQuota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-              if (chunkIndex === 0) {
-                res.status(200).json({ status: 200, message: "Upload started", data: { type: "UPLOAD_STARTED", driveId: currentUploadId }, statistic: { storage: newQuota } });
-              } else {
-                res.status(200).json({ status: 200, message: "Chunk received", data: { type: "CHUNK_RECEIVED", driveId: currentUploadId, chunkIndex }, statistic: { storage: newQuota } });
-              }
             }
-          } catch (e) {
-            cleanupTempFiles(files);
-            throw e;
           }
-          return;
-        }
-        cleanupTempFiles(files);
-        return res.status(400).json({ status: 400, message: "Could not upload: invalid upload request" });
-      }
-      // ** 4. CANCEL UPLOAD **
-      case "cancel": {
-        const cancelData = cancelQuerySchema.safeParse(req.query);
-        if (!cancelData.success) return res.status(400).json({ status: 400, message: "Could not cancel upload: invalid ID" });
-        const { id } = cancelData.data;
-        const tempUploadDir = path.join(os2.tmpdir(), "next-drive-uploads", id);
-        if (fs.existsSync(tempUploadDir)) {
+          await new Promise((resolve, reject) => {
+            if (streamError) {
+              reject(streamError);
+              return;
+            }
+            writeStream.end();
+            writeStream.on("finish", resolve);
+            writeStream.once("error", reject);
+          });
+          if (!fs.existsSync(finalTempPath)) {
+            throw new Error("Could not finish upload: failed to assemble the file");
+          }
+          const finalStats = fs.statSync(finalTempPath);
+          if (finalStats.size !== meta.fileSize) {
+            throw new Error("Could not finish upload: the assembled file is incomplete (size mismatch)");
+          }
+          const drive = new drive_default({
+            owner: meta.owner,
+            storageAccountId: meta.accountId || null,
+            provider: { type: meta.providerName },
+            name: meta.name,
+            parentId: meta.parentId,
+            order: 0,
+            information: { type: "FILE", sizeInBytes: meta.fileSize, mime: meta.mimeType, path: "" },
+            status: "UPLOADING",
+            currentChunk: totalChunks,
+            totalChunks,
+            expiresAt: meta.unauthenticated ? new Date(Date.now() + (config.security?.unauthenticated?.ttlMinutes ?? 60) * 6e4) : null
+          });
+          if (meta.providerName === "LOCAL" && drive.information.type === "FILE") {
+            drive.information.path = path.join("file", String(drive._id), "data.bin");
+          }
+          await drive.save();
           try {
-            fs.rmSync(tempUploadDir, { recursive: true, force: true });
-          } catch (e) {
-            console.error("Failed to cleanup temp upload:", e);
+            const item = await provider.uploadFile(drive, finalTempPath, meta.accountId);
+            fs.rmSync(uploadDir, { recursive: true, force: true });
+            if (meta.unauthenticated) globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
+            const newQuota = await provider.getQuota(meta.owner, meta.accountId, information.storage.quotaInBytes);
+            res.status(200).json({ status: 200, message: "Upload complete", data: { type: "UPLOAD_COMPLETE", driveId: String(drive._id), item: withSignedUrl(item, config) }, statistic: { storage: newQuota } });
+          } catch (err) {
+            await drive_default.deleteOne({ _id: drive._id });
+            if (meta.unauthenticated) globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
+            throw err;
+          }
+        } else {
+          const newQuota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+          if (chunkIndex === 0) {
+            res.status(200).json({ status: 200, message: "Upload started", data: { type: "UPLOAD_STARTED", driveId: currentUploadId }, statistic: { storage: newQuota } });
+          } else {
+            res.status(200).json({ status: 200, message: "Chunk received", data: { type: "CHUNK_RECEIVED", driveId: currentUploadId, chunkIndex }, statistic: { storage: newQuota } });
           }
         }
-        return res.status(200).json({ status: 200, message: "Upload cancelled", data: null });
-      }
-      // ** 5. CREATE FOLDER **
-      case "createFolder": {
-        const folderData = createFolderBodySchema.safeParse(req.body);
-        if (!folderData.success) return res.status(400).json({ status: 400, message: folderData.error.errors[0].message });
-        const { name, parentId } = folderData.data;
-        const item = addSignedUrlToken(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
-        return res.status(201).json({ status: 201, message: "Folder created", data: { item } });
+      } catch (e) {
+        cleanupTempFiles(files);
+        throw e;
       }
-      // ** 5. DELETE **
-      case "delete": {
-        const deleteData = deleteQuerySchema.safeParse(req.query);
-        if (!deleteData.success) return res.status(400).json({ status: 400, message: "Could not move to trash: invalid ID" });
-        const { id } = deleteData.data;
-        const drive = await drive_default.findById(id);
-        if (!drive) return res.status(404).json({ status: 404, message: "Could not move to trash: item not found" });
-        const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-        const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      return;
+    }
+    case "cancel": {
+      const cancelData = cancelQuerySchema.safeParse(req.query);
+      if (!cancelData.success) return void res.status(400).json({ status: 400, message: "Could not cancel upload: invalid ID" });
+      const { id } = cancelData.data;
+      const tempUploadDir = path.join(os2.tmpdir(), "next-drive-uploads", id);
+      if (fs.existsSync(tempUploadDir)) {
         try {
-          await itemProvider.trash([id], owner, itemAccountId);
+          const metaPath = path.join(tempUploadDir, "metadata.json");
+          if (fs.existsSync(metaPath) && JSON.parse(fs.readFileSync(metaPath, "utf-8")).unauthenticated) {
+            globalThis.__nextDrive.abuse.concurrent = Math.max(0, globalThis.__nextDrive.abuse.concurrent - 1);
+          }
+          fs.rmSync(tempUploadDir, { recursive: true, force: true });
         } catch (e) {
-          console.error("Provider trash failed:", e);
+          console.error("Failed to cleanup temp upload:", e);
         }
-        drive.trashedAt = /* @__PURE__ */ new Date();
-        await drive.save();
-        return res.status(200).json({ status: 200, message: "Moved to trash", data: null });
       }
-      // ** 6. HARD DELETE **
-      case "deletePermanent": {
-        const deleteData = deleteQuerySchema.safeParse(req.query);
-        if (!deleteData.success) return res.status(400).json({ status: 400, message: "Could not delete: invalid ID" });
-        const { id } = deleteData.data;
-        await provider.delete([id], owner, accountId);
-        const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-        return res.status(200).json({ status: 200, message: "Deleted", statistic: { storage: quota } });
+      res.status(200).json({ status: 200, message: "Upload cancelled", data: null });
+      return;
+    }
+    case "createFolder": {
+      const folderData = createFolderBodySchema.safeParse(req.body);
+      if (!folderData.success) return void res.status(400).json({ status: 400, message: folderData.error.errors[0].message });
+      const { name, parentId } = folderData.data;
+      const item = withSignedUrl(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
+      res.status(201).json({ status: 201, message: "Folder created", data: { item } });
+      return;
+    }
+    case "delete": {
+      const deleteData = deleteQuerySchema.safeParse(req.query);
+      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not move to trash: invalid ID" });
+      const { id } = deleteData.data;
+      const drive = await drive_default.findById(id);
+      if (!drive) return void res.status(404).json({ status: 404, message: "Could not move to trash: item not found" });
+      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      try {
+        await itemProvider.trash([id], owner, itemAccountId);
+      } catch (e) {
+        console.error("Provider trash failed:", e);
       }
-      // ** 7. QUOTA **
-      case "quota": {
-        const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
-        return res.status(200).json({
-          status: 200,
-          message: "Quota retrieved",
-          data: { usedInBytes: quota.usedInBytes, totalInBytes: quota.quotaInBytes, availableInBytes: Math.max(0, quota.quotaInBytes - quota.usedInBytes), percentage: quota.quotaInBytes > 0 ? Math.round(quota.usedInBytes / quota.quotaInBytes * 100) : 0 },
-          statistic: { storage: quota }
-        });
+      drive.trashedAt = /* @__PURE__ */ new Date();
+      await drive.save();
+      res.status(200).json({ status: 200, message: "Moved to trash", data: null });
+      return;
+    }
+    case "deletePermanent": {
+      const deleteData = deleteQuerySchema.safeParse(req.query);
+      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not delete: invalid ID" });
+      const { id } = deleteData.data;
+      await provider.delete([id], owner, accountId);
+      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+      res.status(200).json({ status: 200, message: "Deleted", statistic: { storage: quota } });
+      return;
+    }
+    case "quota": {
+      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+      res.status(200).json({
+        status: 200,
+        message: "Quota retrieved",
+        data: {
+          usedInBytes: quota.usedInBytes,
+          totalInBytes: quota.quotaInBytes,
+          availableInBytes: Math.max(0, quota.quotaInBytes - quota.usedInBytes),
+          percentage: quota.quotaInBytes > 0 ? Math.round(quota.usedInBytes / quota.quotaInBytes * 100) : 0
+        },
+        statistic: { storage: quota }
+      });
+      return;
+    }
+    case "trash": {
+      try {
+        const { provider: trashProvider, accountId: trashAccountId } = await resolveProvider(req, owner);
+        await trashProvider.syncTrash(owner, trashAccountId);
+      } catch (e) {
+        console.error("Trash sync failed", e);
       }
-      // ** 7B. TRASH **
-      case "trash": {
-        try {
-          const { provider: trashProvider, accountId: trashAccountId } = await getProvider(req, owner);
-          await trashProvider.syncTrash(owner, trashAccountId);
-        } catch (e) {
-          console.error("Trash sync failed", e);
+      const query = {
+        owner,
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: { $ne: null }
+      };
+      const items = await drive_default.find(query, {}, { sort: { trashedAt: -1 } });
+      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Trash items", data: { items: plainItems, hasMore: false } });
+      return;
+    }
+    case "restore": {
+      const restoreData = deleteQuerySchema.safeParse(req.query);
+      if (!restoreData.success) return void res.status(400).json({ status: 400, message: "Could not restore: invalid ID" });
+      const { id } = restoreData.data;
+      const drive = await drive_default.findById(id);
+      if (!drive) return void res.status(404).json({ status: 404, message: "Could not restore: item not found" });
+      let targetParentId = drive.parentId;
+      if (targetParentId) {
+        const parent = await drive_default.findById(targetParentId);
+        if (parent?.trashedAt) {
+          targetParentId = null;
         }
-        const query = {
-          owner,
-          "provider.type": provider.name,
-          storageAccountId: accountId || null,
-          trashedAt: { $ne: null }
-        };
-        const items = await drive_default.find(query, {}, { sort: { trashedAt: -1 } });
-        const plainItems = addSignedUrlTokens(await Promise.all(items.map((item) => item.toClient())), config);
-        return res.status(200).json({
-          status: 200,
-          message: "Trash items",
-          data: { items: plainItems, hasMore: false }
-        });
       }
-      // ** 7C. RESTORE **
-      case "restore": {
-        const restoreData = deleteQuerySchema.safeParse(req.query);
-        if (!restoreData.success) return res.status(400).json({ status: 400, message: "Could not restore: invalid ID" });
-        const { id } = restoreData.data;
-        const drive = await drive_default.findById(id);
-        if (!drive) return res.status(404).json({ status: 404, message: "Could not restore: item not found" });
-        let targetParentId = drive.parentId;
-        if (targetParentId) {
-          const parent = await drive_default.findById(targetParentId);
-          if (parent?.trashedAt) {
-            targetParentId = null;
-          }
+      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      try {
+        await itemProvider.untrash([id], owner, itemAccountId);
+        if (targetParentId !== drive.parentId) {
+          await itemProvider.move(id, targetParentId?.toString() ?? null, owner, itemAccountId);
         }
-        const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
-        const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      } catch (e) {
+        console.error("Provider restore failed:", e);
+      }
+      drive.trashedAt = null;
+      drive.parentId = targetParentId;
+      await drive.save();
+      res.status(200).json({
+        status: 200,
+        message: targetParentId === null && drive.parentId !== null ? "Restored to root (parent folder was trashed)" : "Restored",
+        data: null
+      });
+      return;
+    }
+    case "move": {
+      const moveData = moveBodySchema.safeParse(req.body);
+      if (!moveData.success) return void res.status(400).json({ status: 400, message: "Could not move: invalid request data" });
+      const { ids, targetFolderId } = moveData.data;
+      const items = [];
+      const effectiveTargetId = targetFolderId === "root" || !targetFolderId ? null : targetFolderId;
+      for (const id of ids) {
         try {
-          await itemProvider.untrash([id], owner, itemAccountId);
-          if (targetParentId !== drive.parentId) {
-            await itemProvider.move(id, targetParentId?.toString() ?? null, owner, itemAccountId);
-          }
+          const item = await provider.move(id, effectiveTargetId, owner, accountId);
+          items.push(item);
         } catch (e) {
-          console.error("Provider restore failed:", e);
+          console.error(`Failed to move item ${id}`, e);
         }
-        drive.trashedAt = null;
-        drive.parentId = targetParentId;
-        await drive.save();
-        return res.status(200).json({
-          status: 200,
-          message: targetParentId === null && drive.parentId !== null ? "Restored to root (parent folder was trashed)" : "Restored",
-          data: null
-        });
       }
-      // ** 7D. MOVE **
-      case "move": {
-        const moveData = moveBodySchema.safeParse(req.body);
-        if (!moveData.success) return res.status(400).json({ status: 400, message: "Could not move: invalid request data" });
-        const { ids, targetFolderId } = moveData.data;
-        const items = [];
-        const effectiveTargetId = targetFolderId === "root" || !targetFolderId ? null : targetFolderId;
-        for (const id of ids) {
-          try {
-            const item = await provider.move(id, effectiveTargetId, owner, accountId);
-            items.push(item);
-          } catch (e) {
-            console.error(`Failed to move item ${id}`, e);
-          }
-        }
-        return res.status(200).json({ status: 200, message: "Moved", data: { items: addSignedUrlTokens(items, config) } });
+      res.status(200).json({ status: 200, message: "Moved", data: { items: withSignedUrls(items, config) } });
+      return;
+    }
+    case "reorder": {
+      if (req.method !== "POST") {
+        return void res.status(405).json({ status: 405, message: "Reordering requires a POST request" });
       }
-      // ** 8. RENAME **
-      case "rename": {
-        const renameData = renameBodySchema.safeParse({ id: req.query.id, ...req.body });
-        if (!renameData.success) return res.status(400).json({ status: 400, message: "Could not rename: invalid request data" });
-        const { id, newName } = renameData.data;
-        const item = addSignedUrlToken(await provider.rename(id, newName, owner, accountId), config);
-        return res.status(200).json({ status: 200, message: "Renamed", data: { item } });
+      const reorderData = reorderBodySchema.safeParse(req.body);
+      if (!reorderData.success) {
+        return void res.status(400).json({ status: 400, message: "Could not reorder: invalid request data" });
       }
-      // ** 9. THUMBNAIL **
-      default:
-        res.status(400).json({ status: 400, message: `Unknown action requested: "${action}"` });
+      const { ids } = reorderData.data;
+      const query = {
+        _id: { $in: ids },
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: null
+      };
+      if (!isRootMode) {
+        query.owner = owner;
+      }
+      const existingItems = await drive_default.find(query, { _id: 1, parentId: 1 });
+      if (existingItems.length !== ids.length) {
+        return void res.status(404).json({ status: 404, message: "Could not reorder: one or more items were not found" });
+      }
+      const parentIds = new Set(existingItems.map((item) => item.parentId ? item.parentId.toString() : "root"));
+      if (parentIds.size > 1) {
+        return void res.status(400).json({ status: 400, message: "Could not reorder: all items must be in the same folder" });
+      }
+      const operations = ids.map((id, order) => ({
+        updateOne: {
+          filter: {
+            _id: id,
+            "provider.type": provider.name,
+            storageAccountId: accountId || null,
+            trashedAt: null,
+            ...isRootMode ? {} : { owner }
+          },
+          update: { $set: { order } }
+        }
+      }));
+      await drive_default.bulkWrite(operations);
+      const updatedItems = await drive_default.find(query, {}, { sort: { order: 1 } });
+      const plainItems = withSignedUrls(await Promise.all(updatedItems.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Reordered", data: { items: plainItems } });
+      return;
+    }
+    case "rename": {
+      const renameData = renameBodySchema.safeParse({ id: req.query.id, ...req.body });
+      if (!renameData.success) return void res.status(400).json({ status: 400, message: "Could not rename: invalid request data" });
+      const { id, newName } = renameData.data;
+      const item = withSignedUrl(await provider.rename(id, newName, owner, accountId), config);
+      res.status(200).json({ status: 200, message: "Renamed", data: { item } });
+      return;
+    }
+    default: {
+      res.status(400).json({ status: 400, message: `Unknown action requested: "${action}"` });
+      return;
+    }
+  }
+};
+
+// src/server/index.ts
+var driveAPIHandler = async (req, res) => {
+  const action = req.query.action || (req.query.code && req.query.state ? "callback" : void 0);
+  let config;
+  try {
+    config = getDriveConfig();
+  } catch (error) {
+    console.error("[next-drive] Configuration error:", error);
+    res.status(500).json({ status: 500, message: "Drive is not ready: failed to initialize configuration" });
+    return;
+  }
+  const isPreflightHandled = applyCorsHeaders(req, res, config);
+  if (isPreflightHandled) return;
+  if (!action) {
+    res.status(400).json({ status: 400, message: 'Missing "action" parameter in request' });
+    return;
+  }
+  const wasPublicHandled = await handlePublicAction(req, res, action, config);
+  if (wasPublicHandled) return;
+  try {
+    const mode = config.mode || "NORMAL";
+    if (action === "information") {
+      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+      const googleConfigured = !!(clientId && clientSecret && redirectUri);
+      let authenticated = false;
+      try {
+        await getDriveInformation({ method: "REQUEST", req });
+        authenticated = true;
+      } catch {
+        authenticated = false;
+      }
+      res.status(200).json({
+        status: 200,
+        message: "Information retrieved",
+        data: {
+          providers: {
+            google: googleConfigured
+          },
+          mode,
+          authenticated,
+          unauthenticatedUploads: !!config.security?.unauthenticated?.enabled
+        }
+      });
+      return;
     }
+    const information = await getDriveInformation({ method: "REQUEST", req });
+    const { key: owner } = information;
+    const isRootMode = mode === "ROOT";
+    const wasAuthHandled = await handleAuthAction(req, res, action, config, owner);
+    if (wasAuthHandled) return;
+    const { provider, accountId } = await resolveProvider(req, owner);
+    await handleDriveAction({
+      req,
+      res,
+      action,
+      config,
+      owner,
+      isRootMode,
+      information,
+      provider,
+      accountId
+    });
   } catch (error) {
     console.error(`[next-drive] Error handling action ${action}:`, error);
-    res.status(500).json({ status: 500, message: error instanceof Error ? error.message : "Something went wrong while processing your request" });
+    const detail = error instanceof Error ? error.message : "Something went wrong while processing your request";
+    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
   }
 };
 
-export { driveAPIHandler, driveCleanup, driveConfiguration, driveDelete, driveFilePath, driveFileSchemaZod, driveGetUrl, driveInfo, driveList, driveListFiles, driveReadFile, driveUpload, drive_default, getDriveConfig, getDriveInformation };
-//# sourceMappingURL=chunk-MVYNW56R.js.map
-//# sourceMappingURL=chunk-MVYNW56R.js.map
+export { driveAPIHandler, driveCleanup, driveConfiguration, driveConfirm, driveDelete, driveFilePath, driveFileSchemaZod, driveGetUrl, driveInfo, driveList, driveListFiles, drivePurgeExpired, driveReadFile, driveUpload, drive_default, getDriveConfig, getDriveInformation };
+//# sourceMappingURL=chunk-XUPDNN2U.js.map
+//# sourceMappingURL=chunk-XUPDNN2U.js.map