@nextlyhq/storage-uploadthing 0.0.2-alpha.60 → 0.0.2-alpha.64

package/dist/chunk-W3CIFTIH.mjs

@@ -0,0 +1,1327 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+
+// ../nextly/dist/chunk-HJ5IQPOY.mjs
+function isDbError(err) {
+  if (!err || typeof err !== "object") return false;
+  const obj = err;
+  return obj.name === "DbError" && typeof obj.kind === "string";
+}
+var NEXTLY_ERROR_STATUS = {
+  VALIDATION_ERROR: 400,
+  INVALID_INPUT: 400,
+  AUTH_REQUIRED: 401,
+  AUTH_INVALID_CREDENTIALS: 401,
+  TOKEN_EXPIRED: 401,
+  FORBIDDEN: 403,
+  // The schema builder is off in this environment (production by default).
+  // Separate from FORBIDDEN: the caller's permissions are not the problem.
+  BUILDER_DISABLED: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  DUPLICATE: 409,
+  RATE_LIMITED: 429,
+  PAYLOAD_TOO_LARGE: 413,
+  UNSUPPORTED_MEDIA_TYPE: 415,
+  // 422: understood, well-formed, and refused on a rule the caller can act on.
+  // Deliberately NOT added to CANONICAL_CODE_FOR_STATUS -- that list drives the
+  // status -> code direction, where 422 stays mapped to INVALID_INPUT.
+  BUSINESS_RULE_VIOLATION: 422,
+  INTERNAL_ERROR: 500,
+  DATABASE_ERROR: 500,
+  EXTERNAL_SERVICE_ERROR: 502,
+  SERVICE_UNAVAILABLE: 503,
+  // Outbound-fetch safety (utils/validate-external-url): a URL refused for SSRF
+  // safety, and a fetch that timed out / exceeded the size cap / failed to decode.
+  EXTERNAL_URL_BLOCKED: 400,
+  EXTERNAL_REQUEST_FAILED: 502,
+  FILENAME_INVALID: 400,
+  EXTENSION_BLOCKED: 400,
+  MIME_BLOCKED: 415,
+  MIME_NOT_ALLOWED: 415,
+  SIZE_EXCEEDED: 413,
+  // A stored object exceeded the cap a READ was given, which is a different
+  // question from SIZE_EXCEEDED above: that one refuses an upload the caller
+  // is sending, this one refuses to buffer an object already stored. Kept
+  // apart so a caller discriminating on the code cannot match both.
+  STORAGE_READ_TOO_LARGE: 413,
+  // A stored object did not answer within the deadline the read was given. 504
+  // rather than 500 because the failure is the BACKEND not answering, and a
+  // caller can act on that difference: a gateway timeout is worth retrying, an
+  // internal error is not.
+  STORAGE_READ_TIMEOUT: 504,
+  // The store answered, and answered badly. 502 rather than 500 because the
+  // fault is UPSTREAM of this process: a caller can retry it, and an operator
+  // reading the log needs to look at the bucket rather than at this service.
+  // Distinct from the timeout above, which never got an answer at all.
+  STORAGE_READ_UNREACHABLE: 502,
+  MAGIC_BYTE_MISMATCH: 400,
+  SVG_SANITIZATION_FAILED: 400,
+  UNSUPPORTED_FOR_BACKEND: 415,
+  // Plan B — schema bookkeeping consolidation.
+  NEXTLY_LEGACY_BOOKKEEPING_DETECTED: 409,
+  NEXTLY_UPGRADE_TABLE_NAME_COLLISION: 409,
+  NEXTLY_UPGRADE_IN_PROGRESS: 409,
+  // Plan C2 — nextly migrate phases.
+  NEXTLY_MIGRATE_LOCK_BUSY: 409,
+  NEXTLY_BASELINE_LOCK_NOT_HELD: 409,
+  NEXTLY_RESOLVE_LOCK_NOT_HELD: 409,
+  // Boot refused to serve: the migrate lock stayed held past the wait deadline,
+  // so this process never established whether the schema matches the code. 503
+  // rather than 409 — a load balancer should take the instance out of rotation
+  // and retry it, which is exactly the recovery this refusal wants.
+  NEXTLY_BOOT_MIGRATIONS_NOT_RUN: 503,
+  // Still running rather than refused. 503 for the same reason: retry shortly.
+  NEXTLY_BOOT_MIGRATIONS_PENDING: 503,
+  NEXTLY_CORE_DESTRUCTIVE_REFUSED: 409,
+  NEXTLY_MIGRATION_DRIFT: 409,
+  NEXTLY_MIGRATION_APPLY_FAILED: 500,
+  // Plan C3 — migrate:resolve recovery command.
+  NEXTLY_MIGRATION_FILE_MISSING: 404,
+  NEXTLY_MIGRATION_SNAPSHOT_MISSING: 404,
+  NEXTLY_MIGRATION_RESOLVE_DRIFT: 409,
+  NEXTLY_MIGRATION_RESOLVE_PRECONDITION: 409,
+  // Plan D — UI schema support.
+  NEXTLY_UI_SCHEMA_INVALID: 400,
+  NEXTLY_SCHEMA_SLUG_COLLISION: 409,
+  NEXTLY_SCHEMA_RELATION_TARGET_MISSING: 400,
+  // Plugin platform (P2b) — schema extend (contributes.extend) + relations (D15).
+  NEXTLY_SCHEMA_EXTEND_TARGET_UNKNOWN: 400,
+  NEXTLY_SCHEMA_EXTEND_FIELD_DUPLICATE: 409,
+  NEXTLY_SCHEMA_CROSS_PLUGIN_RELATION: 409,
+  // Plugin platform (P2c) — framework remap (.rename()).
+  NEXTLY_SCHEMA_RENAME_UNKNOWN_TARGET: 400,
+  // Plugin platform — a declared admin.clientConfig that cannot be delivered
+  // to the browser, refused at boot rather than serialized mangled.
+  NEXTLY_PLUGIN_CLIENT_CONFIG_INVALID: 500,
+  // Plugin platform — a contributed admin widget that cannot be delivered to
+  // the browser. Refused at boot because it is serialized into the ONE
+  // `/api/admin-meta/workspace` payload: a value `JSON.stringify` throws on
+  // fails that request for every admin, not just the widget's own card.
+  NEXTLY_PLUGIN_ADMIN_WIDGET_INVALID: 500,
+  // Plugin platform (P0) — boot-time plugin dependency/version resolution.
+  PLUGIN_RESOLUTION_ERROR: 500,
+  // Plugin platform (P4) — contributes.routes collection (D25).
+  NEXTLY_ROUTE_COLLISION: 409,
+  NEXTLY_ROUTE_INVALID_PATH: 400,
+  // An email transport whose library is an optional peer dependency the host
+  // has not installed. 503 rather than 500: the request is not malformed and
+  // nothing is broken, the install simply cannot carry it out yet, and the
+  // remedy is one command on the server rather than a change by the caller.
+  NEXTLY_EMAIL_TRANSPORT_UNAVAILABLE: 503,
+  // The tooling that compiles `nextly.config.ts` is an optional peer the host
+  // has not installed. 503 rather than 500 for the same reason as the mail
+  // transport above: nothing is broken and the request is not malformed, the
+  // install simply cannot carry it out until one command is run.
+  NEXTLY_CONFIG_TOOLING_UNAVAILABLE: 503
+};
+var CANONICAL_CODE_FOR_STATUS = [
+  "VALIDATION_ERROR",
+  "AUTH_REQUIRED",
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "CONFLICT",
+  "PAYLOAD_TOO_LARGE",
+  "UNSUPPORTED_MEDIA_TYPE",
+  "RATE_LIMITED",
+  "EXTERNAL_SERVICE_ERROR",
+  "SERVICE_UNAVAILABLE"
+];
+({
+  ...Object.fromEntries(
+    CANONICAL_CODE_FOR_STATUS.map((code) => [NEXTLY_ERROR_STATUS[code], code])
+  )});
+var DB_ERROR_MAPPING = {
+  "unique-violation": {
+    code: "DUPLICATE",
+    statusCode: 409,
+    publicMessage: "Resource already exists."
+  },
+  "fk-violation": {
+    code: "VALIDATION_ERROR",
+    statusCode: 400,
+    publicMessage: "Referenced record does not exist."
+  },
+  "not-null-violation": {
+    code: "VALIDATION_ERROR",
+    statusCode: 400,
+    publicMessage: "A required field is missing."
+  },
+  constraint: {
+    code: "VALIDATION_ERROR",
+    statusCode: 400,
+    publicMessage: "The provided data violates a constraint."
+  },
+  deadlock: {
+    code: "CONFLICT",
+    statusCode: 409,
+    publicMessage: "The operation could not be completed. Please retry."
+  },
+  "serialization-failure": {
+    code: "CONFLICT",
+    statusCode: 409,
+    publicMessage: "The operation could not be completed. Please retry."
+  },
+  timeout: {
+    code: "DATABASE_ERROR",
+    statusCode: 500,
+    publicMessage: "The operation timed out. Please try again."
+  },
+  "connection-lost": {
+    code: "DATABASE_ERROR",
+    statusCode: 500,
+    publicMessage: "A temporary database error occurred. Please try again."
+  },
+  syntax: {
+    code: "INTERNAL_ERROR",
+    statusCode: 500,
+    publicMessage: "An unexpected error occurred."
+  },
+  internal: {
+    code: "INTERNAL_ERROR",
+    statusCode: 500,
+    publicMessage: "An unexpected error occurred."
+  }
+};
+var NEXTLY_ERROR_BRAND = Symbol.for("nextly/NextlyError");
+function hasBrand(value) {
+  if (value === null || typeof value !== "object" && typeof value !== "function") {
+    return false;
+  }
+  return value[NEXTLY_ERROR_BRAND] === true;
+}
+var NextlyError = class _NextlyError extends Error {
+  code;
+  statusCode;
+  publicMessage;
+  publicData;
+  messageKey;
+  logMessage;
+  logContext;
+  cause;
+  timestamp;
+  constructor(opts) {
+    super(opts.publicMessage);
+    this.name = "NextlyError";
+    this.code = opts.code;
+    this.publicMessage = opts.publicMessage;
+    this.publicData = opts.publicData;
+    this.messageKey = opts.messageKey;
+    this.logMessage = opts.logMessage;
+    this.logContext = opts.logContext;
+    this.cause = opts.cause;
+    this.timestamp = /* @__PURE__ */ new Date();
+    this.statusCode = _NextlyError.resolveStatusCode(opts);
+    Error.captureStackTrace?.(this, _NextlyError);
+  }
+  static {
+    _NextlyError.prototype[NEXTLY_ERROR_BRAND] = true;
+  }
+  static resolveStatusCode(opts) {
+    if (typeof opts.statusCode === "number") return opts.statusCode;
+    if (opts.code in NEXTLY_ERROR_STATUS) {
+      return NEXTLY_ERROR_STATUS[opts.code];
+    }
+    return 500;
+  }
+  /** HTTP-safe JSON. Strips logMessage / logContext / cause / stack. */
+  toResponseJSON(requestId) {
+    const json = {
+      code: String(this.code),
+      message: this.publicMessage,
+      requestId
+    };
+    if (this.messageKey) json.messageKey = this.messageKey;
+    if (this.publicData !== void 0) json.data = this.publicData;
+    return json;
+  }
+  /** Operator-facing JSON for log lines. Includes everything. */
+  toLogJSON(requestId) {
+    return {
+      code: this.code,
+      statusCode: this.statusCode,
+      publicMessage: this.publicMessage,
+      messageKey: this.messageKey,
+      logMessage: this.logMessage,
+      logContext: this.logContext,
+      cause: this.cause ? {
+        name: this.cause.name,
+        message: this.cause.message,
+        stack: this.cause.stack
+      } : void 0,
+      timestamp: this.timestamp.toISOString(),
+      requestId
+    };
+  }
+  // ────────────────────────────────────────────────────────────────────
+  // Static factories — the recommended throw site for every common case.
+  // Public messages here follow the §13.8 rubric: complete sentence,
+  // generic, no identifiers, no value echoing, no policy hints.
+  // ────────────────────────────────────────────────────────────────────
+  static invalidCredentials(opts) {
+    return new _NextlyError({
+      code: "AUTH_INVALID_CREDENTIALS",
+      publicMessage: "Invalid email or password.",
+      logMessage: "Login failed",
+      logContext: opts?.logContext
+    });
+  }
+  static authRequired(opts) {
+    return new _NextlyError({
+      code: "AUTH_REQUIRED",
+      publicMessage: "Authentication required.",
+      logContext: opts?.logContext
+    });
+  }
+  /**
+   * Distinct from `authRequired`: the caller was authenticated but the
+   * session token expired. Clients key on the TOKEN_EXPIRED *code* to
+   * silently refresh and retry rather than redirecting to login; the public
+   * message stays the generic spec §13.6 string ("Authentication required.")
+   * so the wire never reveals the session state — same as `authRequired`.
+   */
+  static tokenExpired(opts) {
+    return new _NextlyError({
+      code: "TOKEN_EXPIRED",
+      publicMessage: "Authentication required.",
+      logContext: opts?.logContext
+    });
+  }
+  static notFound(opts) {
+    return new _NextlyError({
+      code: "NOT_FOUND",
+      publicMessage: opts?.message ?? "Not found.",
+      cause: opts?.cause,
+      logContext: opts?.logContext
+    });
+  }
+  static forbidden(opts) {
+    return new _NextlyError({
+      code: "FORBIDDEN",
+      publicMessage: "You don't have permission to perform this action.",
+      cause: opts?.cause,
+      logContext: opts?.logContext
+    });
+  }
+  /**
+   * A call the caller got wrong, where naming the mistake IS the value of the
+   * error.
+   *
+   * The only factory that takes its public message from the caller. The
+   * generic messages elsewhere exist so an HTTP response cannot leak internal
+   * detail; this one is for arguments and configuration a developer controls
+   * and must be told about — a missing option, an unusable combination — where
+   * `internal()` would reduce the one useful sentence to "An unexpected error
+   * occurred." Do not pass user-supplied data through it.
+   */
+  static invalidInput(opts) {
+    return new _NextlyError({
+      code: "INVALID_INPUT",
+      publicMessage: opts.message,
+      logContext: opts.logContext
+    });
+  }
+  static validation(opts) {
+    return new _NextlyError({
+      code: "VALIDATION_ERROR",
+      publicMessage: "Validation failed.",
+      publicData: { errors: opts.errors },
+      cause: opts.cause,
+      logContext: opts.logContext
+    });
+  }
+  static conflict(opts) {
+    return new _NextlyError({
+      code: "CONFLICT",
+      publicMessage: opts?.message ?? "The resource has changed since you last loaded it. Please refresh and try again.",
+      cause: opts?.cause,
+      logContext: { reason: opts?.reason, ...opts?.logContext }
+    });
+  }
+  static duplicate(opts) {
+    return new _NextlyError({
+      code: "DUPLICATE",
+      publicMessage: "Resource already exists.",
+      logContext: opts?.logContext
+    });
+  }
+  static rateLimited(opts) {
+    return new _NextlyError({
+      code: "RATE_LIMITED",
+      publicMessage: "Too many requests. Please try again later.",
+      publicData: opts?.retryAfterSeconds !== void 0 ? { retryAfterSeconds: opts.retryAfterSeconds } : void 0,
+      logContext: opts?.logContext
+    });
+  }
+  static internal(opts) {
+    return new _NextlyError({
+      code: "INTERNAL_ERROR",
+      publicMessage: "An unexpected error occurred.",
+      cause: opts?.cause,
+      logContext: opts?.logContext
+    });
+  }
+  // Accepts an optional `logMessage` override so callers (e.g. the health
+  // route) can record a specific operator narrative ("Health check failed")
+  // while the public message stays canonical per spec §13.8.5.
+  static serviceUnavailable(opts) {
+    return new _NextlyError({
+      code: "SERVICE_UNAVAILABLE",
+      publicMessage: opts?.publicMessage ?? "Service unavailable. Please try again later.",
+      logMessage: opts?.logMessage,
+      cause: opts?.cause,
+      logContext: opts?.logContext
+    });
+  }
+  /**
+   * Convert a DbError (or arbitrary unknown thrown by the DB layer) to a
+   * NextlyError with a generic public message and rich logContext. Used by
+   * `withDbErrors` for auto-conversion (Pattern A) and by services that
+   * catch DB errors at boundaries (Pattern B). Spec §8.2 mapping table.
+   *
+   * Never leaks DB driver text, constraint names, or table names into
+   * `publicMessage`. All DB context goes into `logContext`. The original
+   * DbError is preserved as `cause`.
+   */
+  static fromDatabaseError(error) {
+    if (isDbError(error)) {
+      const mapping = DB_ERROR_MAPPING[error.kind];
+      const logContext = {
+        dbKind: error.kind,
+        dialect: error.dialect
+      };
+      if (error.code !== void 0) logContext.dbCode = error.code;
+      if (error.meta !== void 0) logContext.meta = error.meta;
+      return new _NextlyError({
+        code: mapping.code,
+        statusCode: mapping.statusCode,
+        publicMessage: mapping.publicMessage,
+        logMessage: "Database error",
+        logContext,
+        cause: error
+      });
+    }
+    return new _NextlyError({
+      code: "INTERNAL_ERROR",
+      statusCode: 500,
+      publicMessage: "An unexpected error occurred.",
+      logMessage: "Non-DbError passed to fromDatabaseError",
+      cause: error instanceof Error ? error : void 0,
+      logContext: error instanceof Error ? void 0 : { value: String(error) }
+    });
+  }
+  // ────────────────────────────────────────────────────────────────────
+  // Type guards. Structural rather than `instanceof` so they survive
+  // package-boundary mismatches (one consumer's NextlyError is a
+  // different module instance from another's).
+  // ────────────────────────────────────────────────────────────────────
+  static is(err) {
+    return hasBrand(err);
+  }
+  static isCode(err, code) {
+    return hasBrand(err) && err.code === code;
+  }
+  static isNotFound(err) {
+    return _NextlyError.isCode(err, "NOT_FOUND");
+  }
+  static isValidation(err) {
+    return _NextlyError.isCode(err, "VALIDATION_ERROR");
+  }
+  static isAuthRequired(err) {
+    return _NextlyError.isCode(err, "AUTH_REQUIRED");
+  }
+  static isForbidden(err) {
+    return _NextlyError.isCode(err, "FORBIDDEN");
+  }
+  static isConflict(err) {
+    return _NextlyError.isCode(err, "CONFLICT");
+  }
+  static isRateLimited(err) {
+    return _NextlyError.isCode(err, "RATE_LIMITED");
+  }
+};
+
+// ../nextly/dist/chunk-W77AQUUQ.mjs
+var StorageReadTooLargeError = class extends NextlyError {
+  constructor(path2, maxBytes, size) {
+    super({
+      code: "STORAGE_READ_TOO_LARGE",
+      publicMessage: "The stored file is larger than the limit for this read.",
+      logContext: {
+        path: path2,
+        maxBytes,
+        ...size === void 0 ? {} : { size }
+      }
+    });
+    this.path = path2;
+    this.maxBytes = maxBytes;
+    this.size = size;
+  }
+};
+var StorageReadTimeoutError = class extends NextlyError {
+  constructor(path2, timeoutMs) {
+    super({
+      code: "STORAGE_READ_TIMEOUT",
+      publicMessage: "The stored file could not be read in time.",
+      logContext: { path: path2, timeoutMs }
+    });
+    this.path = path2;
+    this.timeoutMs = timeoutMs;
+  }
+};
+
+// ../nextly/dist/chunk-C2VHLQKK.mjs
+var IPV4_RE = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+var PRIVATE_IPV4_CIDRS = [
+  "0.0.0.0/8",
+  // RFC1122 "this network" / wildcard
+  "10.0.0.0/8",
+  // RFC1918
+  "100.64.0.0/10",
+  // RFC6598 CGNAT
+  "127.0.0.0/8",
+  // RFC1122 loopback
+  "169.254.0.0/16",
+  // RFC3927 link-local + AWS/GCP metadata
+  "172.16.0.0/12",
+  // RFC1918
+  "192.0.0.0/24",
+  // RFC6890 IETF protocol assignments
+  "192.0.2.0/24",
+  // RFC5737 documentation
+  "192.168.0.0/16",
+  // RFC1918
+  "198.18.0.0/15",
+  // RFC2544 benchmarking
+  "198.51.100.0/24",
+  // RFC5737 documentation
+  "203.0.113.0/24",
+  // RFC5737 documentation
+  "224.0.0.0/4",
+  // RFC5771 multicast
+  "240.0.0.0/4"
+  // RFC1112 reserved
+];
+var CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
+  "metadata.google.internal",
+  "metadata.googleapis.com",
+  "metadata"
+  // GCP short form
+]);
+var ExternalUrlError = class extends NextlyError {
+  constructor(message, url) {
+    super({
+      code: "EXTERNAL_URL_BLOCKED",
+      publicMessage: message,
+      logContext: { url }
+    });
+    this.url = url;
+    this.name = "ExternalUrlError";
+  }
+};
+async function validateExternalUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new ExternalUrlError("Invalid URL", rawUrl);
+  }
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const isLocalhostHostname = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  const baseProtocols = options.allowedProtocols ?? ["https:"];
+  const protocols = options.allowLocalhost && isLocalhostHostname ? [...baseProtocols, "http:"] : baseProtocols;
+  if (!protocols.includes(parsed.protocol)) {
+    throw new ExternalUrlError(
+      `Protocol ${parsed.protocol} not allowed (allowed: ${protocols.join(", ")})`,
+      rawUrl
+    );
+  }
+  if (CLOUD_METADATA_HOSTS.has(hostname)) {
+    throw new ExternalUrlError(
+      `Cloud-metadata hostname rejected: ${parsed.hostname}`,
+      rawUrl
+    );
+  }
+  if (IPV4_RE.test(hostname)) {
+    if (!isPublicIpv4(
+      hostname,
+      options.allowLocalhost === true && hostname === "127.0.0.1"
+    )) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${hostname}`,
+        rawUrl
+      );
+    }
+    return { url: parsed, pinnedIp: hostname, family: 4 };
+  }
+  if (hostname.includes(":")) {
+    if (!isPublicIpv6(
+      hostname,
+      options.allowLocalhost === true && hostname === "::1"
+    )) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${hostname}`,
+        rawUrl
+      );
+    }
+    return { url: parsed, pinnedIp: hostname, family: 6 };
+  }
+  const { lookup } = await import('dns/promises');
+  let addresses;
+  try {
+    addresses = await lookup(hostname, { all: true });
+  } catch (err) {
+    throw new ExternalUrlError(
+      `DNS lookup failed: ${err.message}`,
+      rawUrl
+    );
+  }
+  if (addresses.length === 0) {
+    throw new ExternalUrlError("No IPs returned for host", rawUrl);
+  }
+  for (const { address, family } of addresses) {
+    const allow = options.allowLocalhost === true && isLocalhostHostname && family === 4;
+    const ok = family === 4 ? isPublicIpv4(address, allow) : isPublicIpv6(address, allow);
+    if (!ok) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${address}`,
+        rawUrl
+      );
+    }
+  }
+  const first = addresses[0];
+  return {
+    url: parsed,
+    pinnedIp: first.address,
+    family: first.family === 6 ? 6 : 4
+  };
+}
+var DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var SafeFetchError = class extends NextlyError {
+  constructor(message, url, reason, status) {
+    super({
+      code: "EXTERNAL_REQUEST_FAILED",
+      publicMessage: message,
+      logContext: { url, reason }
+    });
+    this.url = url;
+    this.reason = reason;
+    this.status = status;
+    this.name = "SafeFetchError";
+  }
+};
+function createPinnedLookup(ip, family) {
+  return (_hostname, options, callback) => {
+    if (options && options.all) {
+      callback(null, [{ address: ip, family }]);
+    } else {
+      callback(null, ip, family);
+    }
+  };
+}
+async function safeFetch(rawUrl, options = {}) {
+  const {
+    allowLocalhost,
+    allowedProtocols,
+    method,
+    headers,
+    body,
+    signal,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES,
+    timeoutMs = DEFAULT_TIMEOUT_MS
+  } = options;
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort(signal?.reason);
+  if (signal) {
+    if (signal.aborted) controller.abort(signal.reason);
+    else signal.addEventListener("abort", forwardAbort, { once: true });
+  }
+  const timer = setTimeout(
+    () => controller.abort(
+      new SafeFetchError(`Request exceeded ${timeoutMs}ms`, rawUrl, "timeout")
+    ),
+    timeoutMs
+  );
+  try {
+    const validated = await abortable(
+      validateExternalUrl(rawUrl, { allowLocalhost, allowedProtocols }),
+      controller.signal
+    );
+    return await pinnedFetch(validated, {
+      method,
+      headers,
+      body,
+      signal: controller.signal,
+      maxResponseBytes
+    });
+  } finally {
+    clearTimeout(timer);
+    if (signal) signal.removeEventListener("abort", forwardAbort);
+  }
+}
+function abortError(signal) {
+  const reason = signal.reason;
+  if (reason instanceof Error) return reason;
+  return new DOMException("The operation was aborted", "AbortError");
+}
+function abortable(promise, signal) {
+  if (signal.aborted) return Promise.reject(abortError(signal));
+  let onAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    onAbort = () => reject(abortError(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  return Promise.race([promise, aborted]).finally(
+    () => signal.removeEventListener("abort", onAbort)
+  );
+}
+async function pinnedFetch(validated, init) {
+  const { url, pinnedIp, family } = validated;
+  const httpMod = url.protocol === "https:" ? await import('https') : await import('http');
+  const zlib = await import('zlib');
+  const lookup = createPinnedLookup(pinnedIp, family);
+  const outHeaders = toOutgoingHeaders(init.headers);
+  if (init.body != null) {
+    delete outHeaders["transfer-encoding"];
+    outHeaders["content-length"] = String(
+      typeof init.body === "string" ? Buffer.byteLength(init.body) : init.body.byteLength
+    );
+  }
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
+    const failure = (err) => init.signal.aborted ? abortError(init.signal) : err;
+    const req = httpMod.request(
+      url,
+      {
+        method: init.method ?? "GET",
+        headers: outHeaders,
+        lookup,
+        // Fresh socket per request so a pooled connection can't reuse a
+        // differently-resolved address, and so the pinned lookup always runs.
+        agent: false,
+        // The combined deadline/caller signal aborts the request in flight.
+        signal: init.signal
+      },
+      (res) => {
+        const chunks = [];
+        let received = 0;
+        res.on("data", (chunk) => {
+          received += chunk.length;
+          if (received > init.maxResponseBytes) {
+            res.destroy();
+            req.destroy();
+            settle(
+              () => reject(
+                new SafeFetchError(
+                  `Response body exceeded ${init.maxResponseBytes} bytes`,
+                  url.href,
+                  "response-too-large",
+                  res.statusCode
+                )
+              )
+            );
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on("end", () => {
+          const decoded = decodeBody(
+            Buffer.concat(chunks),
+            res.headers["content-encoding"],
+            zlib,
+            init.maxResponseBytes,
+            url.href,
+            res.statusCode
+          );
+          if (decoded instanceof SafeFetchError) {
+            settle(() => reject(decoded));
+            return;
+          }
+          settle(
+            () => resolve2(toWhatwgResponse(res, decoded.body, decoded.decoded))
+          );
+        });
+        res.on("error", (err) => settle(() => reject(failure(err))));
+      }
+    );
+    req.on("error", (err) => settle(() => reject(failure(err))));
+    if (!req.destroyed) {
+      if (init.body != null) req.write(init.body);
+      req.end();
+    }
+  });
+}
+function toOutgoingHeaders(headers) {
+  const out = {};
+  if (!headers) return out;
+  const add = (rawKey, value) => {
+    const key = rawKey.toLowerCase();
+    if (key === "host") return;
+    const existing = out[key];
+    out[key] = existing === void 0 ? value : [].concat(existing, value);
+  };
+  if (headers instanceof Headers) {
+    headers.forEach((value, key) => add(key, value));
+  } else if (Array.isArray(headers)) {
+    for (const [key, value] of headers) add(key, value);
+  } else {
+    for (const [key, value] of Object.entries(headers)) add(key, value);
+  }
+  return out;
+}
+function toWhatwgResponse(res, body, stripContentHeaders) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value == null) continue;
+    const lower = key.toLowerCase();
+    if (stripContentHeaders && (lower === "content-encoding" || lower === "content-length")) {
+      continue;
+    }
+    const values = Array.isArray(value) ? value : [value];
+    for (const v of values) {
+      try {
+        headers.append(key, v);
+      } catch {
+      }
+    }
+  }
+  const raw = res.statusCode ?? 502;
+  const status = raw >= 200 && raw <= 599 ? raw : 502;
+  const nullBody = status === 204 || status === 205 || status === 304;
+  const bytes = new Uint8Array(body.byteLength);
+  bytes.set(body);
+  return new Response(nullBody ? null : bytes, {
+    status,
+    statusText: res.statusMessage ?? "",
+    headers
+  });
+}
+function decodeBody(buf, encoding, zlib, cap, url, status) {
+  if (!encoding) return { body: buf, decoded: false };
+  if (buf.length === 0) return { body: buf, decoded: true };
+  const layers = encoding.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const opts = { maxOutputLength: cap };
+  let current = buf;
+  let decoded = false;
+  try {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const enc = layers[i];
+      if (enc === "identity") continue;
+      if (enc === "gzip" || enc === "x-gzip") {
+        current = zlib.gunzipSync(current, opts);
+      } else if (enc === "br") {
+        current = zlib.brotliDecompressSync(current, opts);
+      } else if (enc === "deflate") {
+        try {
+          current = zlib.inflateSync(current, opts);
+        } catch (inflateErr) {
+          if (errorCode(inflateErr) === "ERR_BUFFER_TOO_LARGE")
+            throw inflateErr;
+          current = zlib.inflateRawSync(current, opts);
+        }
+      } else {
+        if (decoded) {
+          return new SafeFetchError(
+            `Cannot fully decode content-encoding "${encoding}"`,
+            url,
+            "decode-failed",
+            status
+          );
+        }
+        return { body: buf, decoded: false };
+      }
+      decoded = true;
+    }
+    return { body: current, decoded };
+  } catch (err) {
+    const tooLarge = errorCode(err) === "ERR_BUFFER_TOO_LARGE";
+    return new SafeFetchError(
+      tooLarge ? `Decoded ${encoding} response body exceeded the size cap` : `Failed to decode ${encoding} response body`,
+      url,
+      tooLarge ? "response-too-large" : "decode-failed",
+      status
+    );
+  }
+}
+function errorCode(err) {
+  if (err != null && typeof err === "object" && "code" in err) {
+    const code = err.code;
+    return typeof code === "string" ? code : void 0;
+  }
+  return void 0;
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let acc = 0;
+  for (const p of parts) {
+    const n = Number(p);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    acc = acc << 8 | n;
+  }
+  return acc >>> 0;
+}
+function isIpv4InCidr(intIp, cidr) {
+  const [addr, prefixRaw] = cidr.split("/");
+  const intCidr = ipv4ToInt(addr);
+  if (intCidr === null) return false;
+  const prefix = Number(prefixRaw);
+  if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false;
+  const mask = prefix === 0 ? 0 : -1 >>> 32 - prefix << 32 - prefix;
+  return (intIp & mask) >>> 0 === (intCidr & mask) >>> 0;
+}
+function isPublicIpv4(addr, allowLoopback) {
+  const intIp = ipv4ToInt(addr);
+  if (intIp === null) return false;
+  if (allowLoopback && addr === "127.0.0.1") return true;
+  for (const cidr of PRIVATE_IPV4_CIDRS) {
+    if (isIpv4InCidr(intIp, cidr)) return false;
+  }
+  return true;
+}
+function mappedIpv4(lower) {
+  const dotted = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (dotted) return dotted[1];
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hex) {
+    const hi = parseInt(hex[1], 16);
+    const lo = parseInt(hex[2], 16);
+    return [hi >> 8, hi & 255, lo >> 8, lo & 255].join(".");
+  }
+  return null;
+}
+function isPublicIpv6(addr, allowLoopback) {
+  const lower = addr.toLowerCase();
+  if (allowLoopback && lower === "::1") return true;
+  const mapped = mappedIpv4(lower);
+  if (mapped) {
+    return isPublicIpv4(mapped, allowLoopback);
+  }
+  if (lower === "::" || lower === "::1") return false;
+  const firstHextet = lower.split(":")[0] || "";
+  if (firstHextet.startsWith("fc") || firstHextet.startsWith("fd"))
+    return false;
+  if (firstHextet.startsWith("fe8") || firstHextet.startsWith("fe9"))
+    return false;
+  if (firstHextet.startsWith("fea") || firstHextet.startsWith("feb"))
+    return false;
+  if (firstHextet.startsWith("ff")) return false;
+  return true;
+}
+async function fetchStoredBytes(url, context, label, options, signal) {
+  let response;
+  try {
+    response = await safeFetch(url, {
+      ...options?.maxBytes === void 0 ? {} : { maxResponseBytes: options.maxBytes },
+      /*
+       * A caller's signal REPLACES the deadline rather than joining it.
+       *
+       * These adapters look the object's address up before fetching it, and
+       * that lookup can stall too. Starting a fresh timer here would give the
+       * fetch its own full budget on top of however long the lookup took, so a
+       * read could outlive the deadline the caller was told applied — by
+       * roughly double. One signal begun before the lookup governs both phases.
+       */
+      ...signal !== void 0 ? { signal } : options?.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+    });
+  } catch (error) {
+    const verdict = classifyFetchFailure(error);
+    if (verdict === "absent") return null;
+    if (verdict === "oversized") {
+      throw new StorageReadTooLargeError(
+        context,
+        resolveReadBounds(options).maxBytes
+      );
+    }
+    throw error;
+  }
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    throw NextlyError.internal({
+      logContext: {
+        service: label,
+        path: context,
+        status: response.status,
+        statusText: response.statusText
+      }
+    });
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+function classifyFetchFailure(error) {
+  if (!(error instanceof SafeFetchError)) return "unknown";
+  if (error.status === 404) return "absent";
+  const successful = error.status !== void 0 && error.status >= 200 && error.status < 300;
+  return error.reason === "response-too-large" && successful ? "oversized" : "unknown";
+}
+var DEFAULT_READ_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
+var DEFAULT_READ_MAX_BYTES = DEFAULT_MAX_RESPONSE_BYTES;
+function resolveReadBounds(options) {
+  return {
+    maxBytes: options?.maxBytes ?? DEFAULT_READ_MAX_BYTES,
+    timeoutMs: options?.timeoutMs ?? DEFAULT_READ_TIMEOUT_MS
+  };
+}
+function deadlineSignal(timeoutMs, context) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort(new StorageReadTimeoutError(context, timeoutMs));
+  }, timeoutMs);
+  timer.unref?.();
+  return {
+    signal: controller.signal,
+    /*
+     * Called once the read has settled, whichever way it went. `unref` only
+     * stops a pending timer holding the process open; it still sits on the
+     * timer heap retaining the controller and the path, so a server doing a
+     * thousand reads a second keeps thirty seconds of them alive and then runs
+     * a thousand aborts that answer nobody.
+     */
+    cancel: () => {
+      clearTimeout(timer);
+    }
+  };
+}
+async function withDeadline(work, signal) {
+  if (signal === void 0) return await work;
+  return await Promise.race([
+    work,
+    new Promise((_, reject) => {
+      if (signal.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      signal.addEventListener("abort", () => reject(signal.reason), {
+        once: true
+      });
+    })
+  ]);
+}
+var BaseStorageAdapter = class {
+  /**
+   * Get adapter info including capabilities.
+   *
+   * Default implementation that auto-detects capabilities by checking
+   * if getSignedUrl and getPresignedUploadUrl methods are implemented.
+   * Override in subclasses for more accurate capability reporting.
+   *
+   * @returns Adapter info with type, name, and capability flags
+   */
+  getInfo() {
+    const hasSignedUrls = "getSignedUrl" in this && typeof this.getSignedUrl === "function";
+    const hasClientUploads = "getPresignedUploadUrl" in this && typeof this.getPresignedUploadUrl === "function";
+    return {
+      type: this.getType(),
+      name: this.constructor.name,
+      supportsSignedUrls: hasSignedUrls,
+      supportsClientUploads: hasClientUploads
+    };
+  }
+  /**
+   * Sanitize filename to prevent directory traversal and storage issues.
+   *
+   * Security measures:
+   * - Remove path separators (/, \)
+   * - Keep only basename (no directories)
+   * - Replace problematic characters with hyphens
+   * - Preserve alphanumeric, dots, underscores, hyphens
+   *
+   * @param filename - Original filename to sanitize
+   * @returns Sanitized filename safe for storage
+   *
+   * @example
+   * ```typescript
+   * this.sanitizeFilename('../../../etc/passwd')  // 'passwd'
+   * this.sanitizeFilename('my file (1).jpg')      // 'my-file--1-.jpg'
+   * this.sanitizeFilename('photo.jpg')            // 'photo.jpg'
+   * ```
+   */
+  sanitizeFilename(filename) {
+    const basename = filename.split(/[/\\]/).pop() || filename;
+    return basename.replace(/[^a-zA-Z0-9._-]/g, "-");
+  }
+  /**
+   * Generate a unique storage key with date-based prefix.
+   *
+   * Creates keys in format: {folder}/{year}/{month}/{uuid}-{sanitized-filename}
+   * This provides:
+   * - Unique keys via UUID to prevent collisions
+   * - Date-based organization for easier management
+   * - Readable filenames for debugging
+   *
+   * @param filename - Original filename (will be sanitized)
+   * @param folder - Optional folder/prefix for organizing uploads
+   * @returns Generated storage key
+   *
+   * @example
+   * ```typescript
+   * this.generateKey('photo.jpg')
+   * // '2026/01/abc-123-...-photo.jpg'
+   *
+   * this.generateKey('doc.pdf', 'documents')
+   * // 'documents/2026/01/abc-123-...-doc.pdf'
+   * ```
+   */
+  generateKey(filename, folder) {
+    const sanitized = this.sanitizeFilename(filename);
+    const uuid = crypto.randomUUID();
+    const date = /* @__PURE__ */ new Date();
+    const year = date.getFullYear();
+    const month = String(date.getMonth() + 1).padStart(2, "0");
+    const prefix = folder ? `${folder}/${year}/${month}` : `${year}/${month}`;
+    return `${prefix}/${uuid}-${sanitized}`;
+  }
+};
+var gitignoreUpdated = false;
+var READ_CHUNK_BYTES = 64 * 1024;
+async function readCounted(handle, filePath, maxBytes, signal) {
+  const chunks = [];
+  const chunk = Buffer.allocUnsafe(READ_CHUNK_BYTES);
+  let received = 0;
+  for (; ; ) {
+    if (signal.aborted) throw signal.reason;
+    const { bytesRead } = await handle.read(chunk, 0, READ_CHUNK_BYTES, null);
+    if (bytesRead === 0) break;
+    received += bytesRead;
+    if (received > maxBytes) {
+      throw new StorageReadTooLargeError(filePath, maxBytes, received);
+    }
+    chunks.push(Buffer.from(chunk.subarray(0, bytesRead)));
+  }
+  return Buffer.concat(chunks);
+}
+var LocalStorageAdapter = class extends BaseStorageAdapter {
+  basePath;
+  baseUrl;
+  constructor(config) {
+    super();
+    this.basePath = path.resolve(config.basePath);
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+  }
+  /**
+   * Upload file to local disk.
+   * Creates directories as needed and writes the file buffer.
+   */
+  async upload(buffer, options) {
+    const key = this.generateKey(options.filename, options.folder);
+    const fullPath = this.resolveAndValidate(key);
+    await fs.mkdir(path.dirname(fullPath), { recursive: true });
+    await fs.writeFile(fullPath, buffer);
+    await this.ensureGitignore();
+    return {
+      url: this.getPublicUrl(key),
+      path: key
+    };
+  }
+  /**
+   * Delete file from local disk.
+   * Silently succeeds if the file doesn't exist.
+   */
+  async delete(filePath) {
+    let fullPath;
+    try {
+      fullPath = this.resolveAndValidate(filePath);
+    } catch {
+      return;
+    }
+    try {
+      await fs.unlink(fullPath);
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw err;
+      }
+    }
+  }
+  /**
+   * Bulk delete files from local disk.
+   * Uses parallel unlinks with Promise.allSettled for best performance.
+   */
+  async bulkDelete(filePaths) {
+    const results = await Promise.allSettled(
+      filePaths.map(async (filePath) => {
+        await this.delete(filePath);
+        return filePath;
+      })
+    );
+    const successful = [];
+    const failed = [];
+    results.forEach((result, index) => {
+      if (result.status === "fulfilled") {
+        successful.push(filePaths[index]);
+      } else {
+        failed.push({
+          filePath: filePaths[index],
+          error: result.reason?.message || "Unknown error"
+        });
+      }
+    });
+    return { successful, failed };
+  }
+  /**
+   * Check if file exists on local disk.
+   */
+  async exists(filePath) {
+    try {
+      const fullPath = this.resolveAndValidate(filePath);
+      await fs.access(fullPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get public URL for a file.
+   * Returns baseUrl + relative path for Next.js static file serving.
+   */
+  getPublicUrl(filePath) {
+    const cleanPath = filePath.replace(/^\/+/, "");
+    return `${this.baseUrl}/${cleanPath}`;
+  }
+  /**
+   * Get storage type identifier.
+   */
+  getType() {
+    return "local";
+  }
+  /**
+   * Read file contents from local disk.
+   *
+   * Returns the file buffer, or `null` if the file is not found.
+   *
+   * Honours the caller's bounds, which matters MORE here than anywhere else:
+   * this is the default backend, so a bound the cloud adapters keep and this
+   * one ignores is a bound that does nothing in the commonest deployment.
+   *
+   * Both bounds are enforced against ONE open descriptor. Resolving the name,
+   * asking for its size and then reading it again by name resolves the same
+   * name three times: a file replaced in between is read under a cap measured
+   * on the file it displaced, and one appended to in between is buffered whole
+   * however small it was when asked. The descriptor settles the first, and
+   * counting the bytes as they arrive settles the second.
+   */
+  async read(filePath, options) {
+    let fullPath;
+    try {
+      fullPath = this.resolveAndValidate(filePath);
+    } catch {
+      return null;
+    }
+    const bounds = resolveReadBounds(options);
+    const deadline = deadlineSignal(bounds.timeoutMs, filePath);
+    const work = this.readWithinCap(
+      fullPath,
+      filePath,
+      bounds.maxBytes,
+      deadline.signal
+    );
+    void work.catch(() => void 0);
+    try {
+      return await withDeadline(work, deadline.signal);
+    } finally {
+      deadline.cancel();
+    }
+  }
+  // ============================================================
+  // Private Helpers
+  // ============================================================
+  /**
+   * Read one opened file, refusing it the moment it exceeds the cap.
+   *
+   * Split out so the whole descriptor lifetime — open, size, read, close —
+   * sits inside a single promise the caller can race, and so the close in its
+   * `finally` still runs when that race has already answered the caller.
+   *
+   * @param fullPath - Absolute path, already validated against `basePath`
+   * @param filePath - The caller's path, carried only in the refusal
+   * @param maxBytes - The cap this read runs under
+   */
+  async readWithinCap(fullPath, filePath, maxBytes, signal) {
+    const handle = await fs.open(fullPath, "r").catch(() => null);
+    if (handle === null) return null;
+    try {
+      if (signal.aborted) throw signal.reason;
+      const { size } = await handle.stat();
+      if (size > maxBytes) {
+        throw new StorageReadTooLargeError(filePath, maxBytes, size);
+      }
+      return await readCounted(handle, filePath, maxBytes, signal);
+    } catch (error) {
+      if (error instanceof StorageReadTooLargeError) throw error;
+      return null;
+    } finally {
+      await handle.close().catch(() => void 0);
+    }
+  }
+  /**
+   * Resolve a relative file path to an absolute path within basePath.
+   * Throws if the resolved path would escape basePath (path traversal attack).
+   */
+  resolveAndValidate(filePath) {
+    const sanitized = filePath.replace(/^[/\\]+/, "").replace(/\.\.[/\\]/g, "");
+    const fullPath = path.resolve(this.basePath, sanitized);
+    if (!fullPath.startsWith(this.basePath)) {
+      throw new Error(
+        `Path traversal detected: ${filePath} resolves outside of storage directory`
+      );
+    }
+    return fullPath;
+  }
+  /**
+   * Auto-add the uploads directory to .gitignore on first upload.
+   * Prevents accidentally committing uploaded files to git.
+   */
+  async ensureGitignore() {
+    if (gitignoreUpdated) return;
+    gitignoreUpdated = true;
+    try {
+      const projectRoot = path.resolve(this.basePath, "..", "..");
+      const gitignorePath = path.join(projectRoot, ".gitignore");
+      let content = "";
+      try {
+        content = await fs.readFile(gitignorePath, "utf-8");
+      } catch {
+      }
+      const uploadsDirRelative = path.relative(projectRoot, this.basePath);
+      const ignorePattern = uploadsDirRelative + "/";
+      if (!content.includes(ignorePattern)) {
+        const newEntry = `
+# Nextly local uploads (auto-added)
+${ignorePattern}
+`;
+        await fs.writeFile(gitignorePath, content + newEntry, "utf-8");
+      }
+    } catch {
+    }
+  }
+};
+function localStorage(config) {
+  if (config.enabled === false) {
+    return {
+      name: "local-storage",
+      type: "local",
+      collections: {},
+      adapter: null
+    };
+  }
+  const adapter = new LocalStorageAdapter({
+    basePath: config.basePath ?? "./public/uploads",
+    baseUrl: config.baseUrl ?? "/uploads"
+  });
+  return {
+    name: "local-storage",
+    type: "local",
+    collections: config.collections,
+    adapter
+    // Local storage doesn't support presigned URLs or signed downloads
+  };
+}
+
+export { BaseStorageAdapter, DEFAULT_READ_TIMEOUT_MS, fetchStoredBytes, localStorage, withDeadline };
+//# sourceMappingURL=chunk-W3CIFTIH.mjs.map
+//# sourceMappingURL=chunk-W3CIFTIH.mjs.map