@nextlyhq/storage-uploadthing 0.0.2-alpha.60 → 0.0.2-alpha.64

package/dist/index.cjs

@@ -1,16 +1,1013 @@
 'use strict';
 
+var module$1 = require('module');
 var server = require('uploadthing/server');
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
-// ../nextly/dist/chunk-2ROPMX7N.mjs
+// ../nextly/dist/chunk-HJ5IQPOY.mjs
+function isDbError(err) {
+  if (!err || typeof err !== "object") return false;
+  const obj = err;
+  return obj.name === "DbError" && typeof obj.kind === "string";
+}
+function hasBrand(value) {
+  if (value === null || typeof value !== "object" && typeof value !== "function") {
+    return false;
+  }
+  return value[NEXTLY_ERROR_BRAND] === true;
+}
+var NEXTLY_ERROR_STATUS, CANONICAL_CODE_FOR_STATUS, LEGACY_UNPROCESSABLE_STATUS, DB_ERROR_MAPPING, NEXTLY_ERROR_BRAND, NextlyError;
+var init_chunk_HJ5IQPOY = __esm({
+  "../nextly/dist/chunk-HJ5IQPOY.mjs"() {
+    NEXTLY_ERROR_STATUS = {
+      VALIDATION_ERROR: 400,
+      INVALID_INPUT: 400,
+      AUTH_REQUIRED: 401,
+      AUTH_INVALID_CREDENTIALS: 401,
+      TOKEN_EXPIRED: 401,
+      FORBIDDEN: 403,
+      // The schema builder is off in this environment (production by default).
+      // Separate from FORBIDDEN: the caller's permissions are not the problem.
+      BUILDER_DISABLED: 403,
+      NOT_FOUND: 404,
+      CONFLICT: 409,
+      DUPLICATE: 409,
+      RATE_LIMITED: 429,
+      PAYLOAD_TOO_LARGE: 413,
+      UNSUPPORTED_MEDIA_TYPE: 415,
+      // 422: understood, well-formed, and refused on a rule the caller can act on.
+      // Deliberately NOT added to CANONICAL_CODE_FOR_STATUS -- that list drives the
+      // status -> code direction, where 422 stays mapped to INVALID_INPUT.
+      BUSINESS_RULE_VIOLATION: 422,
+      INTERNAL_ERROR: 500,
+      DATABASE_ERROR: 500,
+      EXTERNAL_SERVICE_ERROR: 502,
+      SERVICE_UNAVAILABLE: 503,
+      // Outbound-fetch safety (utils/validate-external-url): a URL refused for SSRF
+      // safety, and a fetch that timed out / exceeded the size cap / failed to decode.
+      EXTERNAL_URL_BLOCKED: 400,
+      EXTERNAL_REQUEST_FAILED: 502,
+      FILENAME_INVALID: 400,
+      EXTENSION_BLOCKED: 400,
+      MIME_BLOCKED: 415,
+      MIME_NOT_ALLOWED: 415,
+      SIZE_EXCEEDED: 413,
+      // A stored object exceeded the cap a READ was given, which is a different
+      // question from SIZE_EXCEEDED above: that one refuses an upload the caller
+      // is sending, this one refuses to buffer an object already stored. Kept
+      // apart so a caller discriminating on the code cannot match both.
+      STORAGE_READ_TOO_LARGE: 413,
+      // A stored object did not answer within the deadline the read was given. 504
+      // rather than 500 because the failure is the BACKEND not answering, and a
+      // caller can act on that difference: a gateway timeout is worth retrying, an
+      // internal error is not.
+      STORAGE_READ_TIMEOUT: 504,
+      // The store answered, and answered badly. 502 rather than 500 because the
+      // fault is UPSTREAM of this process: a caller can retry it, and an operator
+      // reading the log needs to look at the bucket rather than at this service.
+      // Distinct from the timeout above, which never got an answer at all.
+      STORAGE_READ_UNREACHABLE: 502,
+      MAGIC_BYTE_MISMATCH: 400,
+      SVG_SANITIZATION_FAILED: 400,
+      UNSUPPORTED_FOR_BACKEND: 415,
+      // Plan B — schema bookkeeping consolidation.
+      NEXTLY_LEGACY_BOOKKEEPING_DETECTED: 409,
+      NEXTLY_UPGRADE_TABLE_NAME_COLLISION: 409,
+      NEXTLY_UPGRADE_IN_PROGRESS: 409,
+      // Plan C2 — nextly migrate phases.
+      NEXTLY_MIGRATE_LOCK_BUSY: 409,
+      NEXTLY_BASELINE_LOCK_NOT_HELD: 409,
+      NEXTLY_RESOLVE_LOCK_NOT_HELD: 409,
+      // Boot refused to serve: the migrate lock stayed held past the wait deadline,
+      // so this process never established whether the schema matches the code. 503
+      // rather than 409 — a load balancer should take the instance out of rotation
+      // and retry it, which is exactly the recovery this refusal wants.
+      NEXTLY_BOOT_MIGRATIONS_NOT_RUN: 503,
+      // Still running rather than refused. 503 for the same reason: retry shortly.
+      NEXTLY_BOOT_MIGRATIONS_PENDING: 503,
+      NEXTLY_CORE_DESTRUCTIVE_REFUSED: 409,
+      NEXTLY_MIGRATION_DRIFT: 409,
+      NEXTLY_MIGRATION_APPLY_FAILED: 500,
+      // Plan C3 — migrate:resolve recovery command.
+      NEXTLY_MIGRATION_FILE_MISSING: 404,
+      NEXTLY_MIGRATION_SNAPSHOT_MISSING: 404,
+      NEXTLY_MIGRATION_RESOLVE_DRIFT: 409,
+      NEXTLY_MIGRATION_RESOLVE_PRECONDITION: 409,
+      // Plan D — UI schema support.
+      NEXTLY_UI_SCHEMA_INVALID: 400,
+      NEXTLY_SCHEMA_SLUG_COLLISION: 409,
+      NEXTLY_SCHEMA_RELATION_TARGET_MISSING: 400,
+      // Plugin platform (P2b) — schema extend (contributes.extend) + relations (D15).
+      NEXTLY_SCHEMA_EXTEND_TARGET_UNKNOWN: 400,
+      NEXTLY_SCHEMA_EXTEND_FIELD_DUPLICATE: 409,
+      NEXTLY_SCHEMA_CROSS_PLUGIN_RELATION: 409,
+      // Plugin platform (P2c) — framework remap (.rename()).
+      NEXTLY_SCHEMA_RENAME_UNKNOWN_TARGET: 400,
+      // Plugin platform — a declared admin.clientConfig that cannot be delivered
+      // to the browser, refused at boot rather than serialized mangled.
+      NEXTLY_PLUGIN_CLIENT_CONFIG_INVALID: 500,
+      // Plugin platform — a contributed admin widget that cannot be delivered to
+      // the browser. Refused at boot because it is serialized into the ONE
+      // `/api/admin-meta/workspace` payload: a value `JSON.stringify` throws on
+      // fails that request for every admin, not just the widget's own card.
+      NEXTLY_PLUGIN_ADMIN_WIDGET_INVALID: 500,
+      // Plugin platform (P0) — boot-time plugin dependency/version resolution.
+      PLUGIN_RESOLUTION_ERROR: 500,
+      // Plugin platform (P4) — contributes.routes collection (D25).
+      NEXTLY_ROUTE_COLLISION: 409,
+      NEXTLY_ROUTE_INVALID_PATH: 400,
+      // An email transport whose library is an optional peer dependency the host
+      // has not installed. 503 rather than 500: the request is not malformed and
+      // nothing is broken, the install simply cannot carry it out yet, and the
+      // remedy is one command on the server rather than a change by the caller.
+      NEXTLY_EMAIL_TRANSPORT_UNAVAILABLE: 503,
+      // The tooling that compiles `nextly.config.ts` is an optional peer the host
+      // has not installed. 503 rather than 500 for the same reason as the mail
+      // transport above: nothing is broken and the request is not malformed, the
+      // install simply cannot carry it out until one command is run.
+      NEXTLY_CONFIG_TOOLING_UNAVAILABLE: 503
+    };
+    CANONICAL_CODE_FOR_STATUS = [
+      "VALIDATION_ERROR",
+      "AUTH_REQUIRED",
+      "FORBIDDEN",
+      "NOT_FOUND",
+      "CONFLICT",
+      "PAYLOAD_TOO_LARGE",
+      "UNSUPPORTED_MEDIA_TYPE",
+      "RATE_LIMITED",
+      "EXTERNAL_SERVICE_ERROR",
+      "SERVICE_UNAVAILABLE"
+    ];
+    LEGACY_UNPROCESSABLE_STATUS = 422;
+    ({
+      ...Object.fromEntries(
+        CANONICAL_CODE_FOR_STATUS.map((code) => [NEXTLY_ERROR_STATUS[code], code])
+      ),
+      [LEGACY_UNPROCESSABLE_STATUS]: "INVALID_INPUT"
+    });
+    DB_ERROR_MAPPING = {
+      "unique-violation": {
+        code: "DUPLICATE",
+        statusCode: 409,
+        publicMessage: "Resource already exists."
+      },
+      "fk-violation": {
+        code: "VALIDATION_ERROR",
+        statusCode: 400,
+        publicMessage: "Referenced record does not exist."
+      },
+      "not-null-violation": {
+        code: "VALIDATION_ERROR",
+        statusCode: 400,
+        publicMessage: "A required field is missing."
+      },
+      constraint: {
+        code: "VALIDATION_ERROR",
+        statusCode: 400,
+        publicMessage: "The provided data violates a constraint."
+      },
+      deadlock: {
+        code: "CONFLICT",
+        statusCode: 409,
+        publicMessage: "The operation could not be completed. Please retry."
+      },
+      "serialization-failure": {
+        code: "CONFLICT",
+        statusCode: 409,
+        publicMessage: "The operation could not be completed. Please retry."
+      },
+      timeout: {
+        code: "DATABASE_ERROR",
+        statusCode: 500,
+        publicMessage: "The operation timed out. Please try again."
+      },
+      "connection-lost": {
+        code: "DATABASE_ERROR",
+        statusCode: 500,
+        publicMessage: "A temporary database error occurred. Please try again."
+      },
+      syntax: {
+        code: "INTERNAL_ERROR",
+        statusCode: 500,
+        publicMessage: "An unexpected error occurred."
+      },
+      internal: {
+        code: "INTERNAL_ERROR",
+        statusCode: 500,
+        publicMessage: "An unexpected error occurred."
+      }
+    };
+    NEXTLY_ERROR_BRAND = Symbol.for("nextly/NextlyError");
+    NextlyError = class _NextlyError extends Error {
+      code;
+      statusCode;
+      publicMessage;
+      publicData;
+      messageKey;
+      logMessage;
+      logContext;
+      cause;
+      timestamp;
+      constructor(opts) {
+        super(opts.publicMessage);
+        this.name = "NextlyError";
+        this.code = opts.code;
+        this.publicMessage = opts.publicMessage;
+        this.publicData = opts.publicData;
+        this.messageKey = opts.messageKey;
+        this.logMessage = opts.logMessage;
+        this.logContext = opts.logContext;
+        this.cause = opts.cause;
+        this.timestamp = /* @__PURE__ */ new Date();
+        this.statusCode = _NextlyError.resolveStatusCode(opts);
+        Error.captureStackTrace?.(this, _NextlyError);
+      }
+      static {
+        _NextlyError.prototype[NEXTLY_ERROR_BRAND] = true;
+      }
+      static resolveStatusCode(opts) {
+        if (typeof opts.statusCode === "number") return opts.statusCode;
+        if (opts.code in NEXTLY_ERROR_STATUS) {
+          return NEXTLY_ERROR_STATUS[opts.code];
+        }
+        return 500;
+      }
+      /** HTTP-safe JSON. Strips logMessage / logContext / cause / stack. */
+      toResponseJSON(requestId) {
+        const json = {
+          code: String(this.code),
+          message: this.publicMessage,
+          requestId
+        };
+        if (this.messageKey) json.messageKey = this.messageKey;
+        if (this.publicData !== void 0) json.data = this.publicData;
+        return json;
+      }
+      /** Operator-facing JSON for log lines. Includes everything. */
+      toLogJSON(requestId) {
+        return {
+          code: this.code,
+          statusCode: this.statusCode,
+          publicMessage: this.publicMessage,
+          messageKey: this.messageKey,
+          logMessage: this.logMessage,
+          logContext: this.logContext,
+          cause: this.cause ? {
+            name: this.cause.name,
+            message: this.cause.message,
+            stack: this.cause.stack
+          } : void 0,
+          timestamp: this.timestamp.toISOString(),
+          requestId
+        };
+      }
+      // ────────────────────────────────────────────────────────────────────
+      // Static factories — the recommended throw site for every common case.
+      // Public messages here follow the §13.8 rubric: complete sentence,
+      // generic, no identifiers, no value echoing, no policy hints.
+      // ────────────────────────────────────────────────────────────────────
+      static invalidCredentials(opts) {
+        return new _NextlyError({
+          code: "AUTH_INVALID_CREDENTIALS",
+          publicMessage: "Invalid email or password.",
+          logMessage: "Login failed",
+          logContext: opts?.logContext
+        });
+      }
+      static authRequired(opts) {
+        return new _NextlyError({
+          code: "AUTH_REQUIRED",
+          publicMessage: "Authentication required.",
+          logContext: opts?.logContext
+        });
+      }
+      /**
+       * Distinct from `authRequired`: the caller was authenticated but the
+       * session token expired. Clients key on the TOKEN_EXPIRED *code* to
+       * silently refresh and retry rather than redirecting to login; the public
+       * message stays the generic spec §13.6 string ("Authentication required.")
+       * so the wire never reveals the session state — same as `authRequired`.
+       */
+      static tokenExpired(opts) {
+        return new _NextlyError({
+          code: "TOKEN_EXPIRED",
+          publicMessage: "Authentication required.",
+          logContext: opts?.logContext
+        });
+      }
+      static notFound(opts) {
+        return new _NextlyError({
+          code: "NOT_FOUND",
+          publicMessage: opts?.message ?? "Not found.",
+          cause: opts?.cause,
+          logContext: opts?.logContext
+        });
+      }
+      static forbidden(opts) {
+        return new _NextlyError({
+          code: "FORBIDDEN",
+          publicMessage: "You don't have permission to perform this action.",
+          cause: opts?.cause,
+          logContext: opts?.logContext
+        });
+      }
+      /**
+       * A call the caller got wrong, where naming the mistake IS the value of the
+       * error.
+       *
+       * The only factory that takes its public message from the caller. The
+       * generic messages elsewhere exist so an HTTP response cannot leak internal
+       * detail; this one is for arguments and configuration a developer controls
+       * and must be told about — a missing option, an unusable combination — where
+       * `internal()` would reduce the one useful sentence to "An unexpected error
+       * occurred." Do not pass user-supplied data through it.
+       */
+      static invalidInput(opts) {
+        return new _NextlyError({
+          code: "INVALID_INPUT",
+          publicMessage: opts.message,
+          logContext: opts.logContext
+        });
+      }
+      static validation(opts) {
+        return new _NextlyError({
+          code: "VALIDATION_ERROR",
+          publicMessage: "Validation failed.",
+          publicData: { errors: opts.errors },
+          cause: opts.cause,
+          logContext: opts.logContext
+        });
+      }
+      static conflict(opts) {
+        return new _NextlyError({
+          code: "CONFLICT",
+          publicMessage: opts?.message ?? "The resource has changed since you last loaded it. Please refresh and try again.",
+          cause: opts?.cause,
+          logContext: { reason: opts?.reason, ...opts?.logContext }
+        });
+      }
+      static duplicate(opts) {
+        return new _NextlyError({
+          code: "DUPLICATE",
+          publicMessage: "Resource already exists.",
+          logContext: opts?.logContext
+        });
+      }
+      static rateLimited(opts) {
+        return new _NextlyError({
+          code: "RATE_LIMITED",
+          publicMessage: "Too many requests. Please try again later.",
+          publicData: opts?.retryAfterSeconds !== void 0 ? { retryAfterSeconds: opts.retryAfterSeconds } : void 0,
+          logContext: opts?.logContext
+        });
+      }
+      static internal(opts) {
+        return new _NextlyError({
+          code: "INTERNAL_ERROR",
+          publicMessage: "An unexpected error occurred.",
+          cause: opts?.cause,
+          logContext: opts?.logContext
+        });
+      }
+      // Accepts an optional `logMessage` override so callers (e.g. the health
+      // route) can record a specific operator narrative ("Health check failed")
+      // while the public message stays canonical per spec §13.8.5.
+      static serviceUnavailable(opts) {
+        return new _NextlyError({
+          code: "SERVICE_UNAVAILABLE",
+          publicMessage: opts?.publicMessage ?? "Service unavailable. Please try again later.",
+          logMessage: opts?.logMessage,
+          cause: opts?.cause,
+          logContext: opts?.logContext
+        });
+      }
+      /**
+       * Convert a DbError (or arbitrary unknown thrown by the DB layer) to a
+       * NextlyError with a generic public message and rich logContext. Used by
+       * `withDbErrors` for auto-conversion (Pattern A) and by services that
+       * catch DB errors at boundaries (Pattern B). Spec §8.2 mapping table.
+       *
+       * Never leaks DB driver text, constraint names, or table names into
+       * `publicMessage`. All DB context goes into `logContext`. The original
+       * DbError is preserved as `cause`.
+       */
+      static fromDatabaseError(error) {
+        if (isDbError(error)) {
+          const mapping = DB_ERROR_MAPPING[error.kind];
+          const logContext = {
+            dbKind: error.kind,
+            dialect: error.dialect
+          };
+          if (error.code !== void 0) logContext.dbCode = error.code;
+          if (error.meta !== void 0) logContext.meta = error.meta;
+          return new _NextlyError({
+            code: mapping.code,
+            statusCode: mapping.statusCode,
+            publicMessage: mapping.publicMessage,
+            logMessage: "Database error",
+            logContext,
+            cause: error
+          });
+        }
+        return new _NextlyError({
+          code: "INTERNAL_ERROR",
+          statusCode: 500,
+          publicMessage: "An unexpected error occurred.",
+          logMessage: "Non-DbError passed to fromDatabaseError",
+          cause: error instanceof Error ? error : void 0,
+          logContext: error instanceof Error ? void 0 : { value: String(error) }
+        });
+      }
+      // ────────────────────────────────────────────────────────────────────
+      // Type guards. Structural rather than `instanceof` so they survive
+      // package-boundary mismatches (one consumer's NextlyError is a
+      // different module instance from another's).
+      // ────────────────────────────────────────────────────────────────────
+      static is(err) {
+        return hasBrand(err);
+      }
+      static isCode(err, code) {
+        return hasBrand(err) && err.code === code;
+      }
+      static isNotFound(err) {
+        return _NextlyError.isCode(err, "NOT_FOUND");
+      }
+      static isValidation(err) {
+        return _NextlyError.isCode(err, "VALIDATION_ERROR");
+      }
+      static isAuthRequired(err) {
+        return _NextlyError.isCode(err, "AUTH_REQUIRED");
+      }
+      static isForbidden(err) {
+        return _NextlyError.isCode(err, "FORBIDDEN");
+      }
+      static isConflict(err) {
+        return _NextlyError.isCode(err, "CONFLICT");
+      }
+      static isRateLimited(err) {
+        return _NextlyError.isCode(err, "RATE_LIMITED");
+      }
+    };
+  }
+});
+
+// ../nextly/dist/chunk-W77AQUUQ.mjs
+var StorageReadTooLargeError;
+var init_chunk_W77AQUUQ = __esm({
+  "../nextly/dist/chunk-W77AQUUQ.mjs"() {
+    init_chunk_HJ5IQPOY();
+    StorageReadTooLargeError = class extends NextlyError {
+      constructor(path, maxBytes, size) {
+        super({
+          code: "STORAGE_READ_TOO_LARGE",
+          publicMessage: "The stored file is larger than the limit for this read.",
+          logContext: {
+            path,
+            maxBytes,
+            ...size === void 0 ? {} : { size }
+          }
+        });
+        this.path = path;
+        this.maxBytes = maxBytes;
+        this.size = size;
+      }
+    };
+  }
+});
+
+// ../nextly/dist/chunk-C2VHLQKK.mjs
+async function validateExternalUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new ExternalUrlError("Invalid URL", rawUrl);
+  }
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const isLocalhostHostname = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  const baseProtocols = options.allowedProtocols ?? ["https:"];
+  const protocols = options.allowLocalhost && isLocalhostHostname ? [...baseProtocols, "http:"] : baseProtocols;
+  if (!protocols.includes(parsed.protocol)) {
+    throw new ExternalUrlError(
+      `Protocol ${parsed.protocol} not allowed (allowed: ${protocols.join(", ")})`,
+      rawUrl
+    );
+  }
+  if (CLOUD_METADATA_HOSTS.has(hostname)) {
+    throw new ExternalUrlError(
+      `Cloud-metadata hostname rejected: ${parsed.hostname}`,
+      rawUrl
+    );
+  }
+  if (IPV4_RE.test(hostname)) {
+    if (!isPublicIpv4(
+      hostname,
+      options.allowLocalhost === true && hostname === "127.0.0.1"
+    )) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${hostname}`,
+        rawUrl
+      );
+    }
+    return { url: parsed, pinnedIp: hostname, family: 4 };
+  }
+  if (hostname.includes(":")) {
+    if (!isPublicIpv6(
+      hostname,
+      options.allowLocalhost === true && hostname === "::1"
+    )) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${hostname}`,
+        rawUrl
+      );
+    }
+    return { url: parsed, pinnedIp: hostname, family: 6 };
+  }
+  const { lookup } = await import('dns/promises');
+  let addresses;
+  try {
+    addresses = await lookup(hostname, { all: true });
+  } catch (err) {
+    throw new ExternalUrlError(
+      `DNS lookup failed: ${err.message}`,
+      rawUrl
+    );
+  }
+  if (addresses.length === 0) {
+    throw new ExternalUrlError("No IPs returned for host", rawUrl);
+  }
+  for (const { address, family } of addresses) {
+    const allow = options.allowLocalhost === true && isLocalhostHostname && family === 4;
+    const ok = family === 4 ? isPublicIpv4(address, allow) : isPublicIpv6(address, allow);
+    if (!ok) {
+      throw new ExternalUrlError(
+        `Resolved to non-public IP: ${address}`,
+        rawUrl
+      );
+    }
+  }
+  const first = addresses[0];
+  return {
+    url: parsed,
+    pinnedIp: first.address,
+    family: first.family === 6 ? 6 : 4
+  };
+}
+function createPinnedLookup(ip, family) {
+  return (_hostname, options, callback) => {
+    if (options && options.all) {
+      callback(null, [{ address: ip, family }]);
+    } else {
+      callback(null, ip, family);
+    }
+  };
+}
+async function safeFetch(rawUrl, options = {}) {
+  const {
+    allowLocalhost,
+    allowedProtocols,
+    method,
+    headers,
+    body,
+    signal,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES,
+    timeoutMs = DEFAULT_TIMEOUT_MS
+  } = options;
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort(signal?.reason);
+  if (signal) {
+    if (signal.aborted) controller.abort(signal.reason);
+    else signal.addEventListener("abort", forwardAbort, { once: true });
+  }
+  const timer = setTimeout(
+    () => controller.abort(
+      new SafeFetchError(`Request exceeded ${timeoutMs}ms`, rawUrl, "timeout")
+    ),
+    timeoutMs
+  );
+  try {
+    const validated = await abortable(
+      validateExternalUrl(rawUrl, { allowLocalhost, allowedProtocols }),
+      controller.signal
+    );
+    return await pinnedFetch(validated, {
+      method,
+      headers,
+      body,
+      signal: controller.signal,
+      maxResponseBytes
+    });
+  } finally {
+    clearTimeout(timer);
+    if (signal) signal.removeEventListener("abort", forwardAbort);
+  }
+}
+function abortError(signal) {
+  const reason = signal.reason;
+  if (reason instanceof Error) return reason;
+  return new DOMException("The operation was aborted", "AbortError");
+}
+function abortable(promise, signal) {
+  if (signal.aborted) return Promise.reject(abortError(signal));
+  let onAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    onAbort = () => reject(abortError(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  return Promise.race([promise, aborted]).finally(
+    () => signal.removeEventListener("abort", onAbort)
+  );
+}
+async function pinnedFetch(validated, init) {
+  const { url, pinnedIp, family } = validated;
+  const httpMod = url.protocol === "https:" ? await import('https') : await import('http');
+  const zlib = await import('zlib');
+  const lookup = createPinnedLookup(pinnedIp, family);
+  const outHeaders = toOutgoingHeaders(init.headers);
+  if (init.body != null) {
+    delete outHeaders["transfer-encoding"];
+    outHeaders["content-length"] = String(
+      typeof init.body === "string" ? Buffer.byteLength(init.body) : init.body.byteLength
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
+    const failure = (err) => init.signal.aborted ? abortError(init.signal) : err;
+    const req = httpMod.request(
+      url,
+      {
+        method: init.method ?? "GET",
+        headers: outHeaders,
+        lookup,
+        // Fresh socket per request so a pooled connection can't reuse a
+        // differently-resolved address, and so the pinned lookup always runs.
+        agent: false,
+        // The combined deadline/caller signal aborts the request in flight.
+        signal: init.signal
+      },
+      (res) => {
+        const chunks = [];
+        let received = 0;
+        res.on("data", (chunk) => {
+          received += chunk.length;
+          if (received > init.maxResponseBytes) {
+            res.destroy();
+            req.destroy();
+            settle(
+              () => reject(
+                new SafeFetchError(
+                  `Response body exceeded ${init.maxResponseBytes} bytes`,
+                  url.href,
+                  "response-too-large",
+                  res.statusCode
+                )
+              )
+            );
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on("end", () => {
+          const decoded = decodeBody(
+            Buffer.concat(chunks),
+            res.headers["content-encoding"],
+            zlib,
+            init.maxResponseBytes,
+            url.href,
+            res.statusCode
+          );
+          if (decoded instanceof SafeFetchError) {
+            settle(() => reject(decoded));
+            return;
+          }
+          settle(
+            () => resolve(toWhatwgResponse(res, decoded.body, decoded.decoded))
+          );
+        });
+        res.on("error", (err) => settle(() => reject(failure(err))));
+      }
+    );
+    req.on("error", (err) => settle(() => reject(failure(err))));
+    if (!req.destroyed) {
+      if (init.body != null) req.write(init.body);
+      req.end();
+    }
+  });
+}
+function toOutgoingHeaders(headers) {
+  const out = {};
+  if (!headers) return out;
+  const add = (rawKey, value) => {
+    const key = rawKey.toLowerCase();
+    if (key === "host") return;
+    const existing = out[key];
+    out[key] = existing === void 0 ? value : [].concat(existing, value);
+  };
+  if (headers instanceof Headers) {
+    headers.forEach((value, key) => add(key, value));
+  } else if (Array.isArray(headers)) {
+    for (const [key, value] of headers) add(key, value);
+  } else {
+    for (const [key, value] of Object.entries(headers)) add(key, value);
+  }
+  return out;
+}
+function toWhatwgResponse(res, body, stripContentHeaders) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value == null) continue;
+    const lower = key.toLowerCase();
+    if (stripContentHeaders && (lower === "content-encoding" || lower === "content-length")) {
+      continue;
+    }
+    const values = Array.isArray(value) ? value : [value];
+    for (const v of values) {
+      try {
+        headers.append(key, v);
+      } catch {
+      }
+    }
+  }
+  const raw = res.statusCode ?? 502;
+  const status = raw >= 200 && raw <= 599 ? raw : 502;
+  const nullBody = status === 204 || status === 205 || status === 304;
+  const bytes = new Uint8Array(body.byteLength);
+  bytes.set(body);
+  return new Response(nullBody ? null : bytes, {
+    status,
+    statusText: res.statusMessage ?? "",
+    headers
+  });
+}
+function decodeBody(buf, encoding, zlib, cap, url, status) {
+  if (!encoding) return { body: buf, decoded: false };
+  if (buf.length === 0) return { body: buf, decoded: true };
+  const layers = encoding.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const opts = { maxOutputLength: cap };
+  let current = buf;
+  let decoded = false;
+  try {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const enc = layers[i];
+      if (enc === "identity") continue;
+      if (enc === "gzip" || enc === "x-gzip") {
+        current = zlib.gunzipSync(current, opts);
+      } else if (enc === "br") {
+        current = zlib.brotliDecompressSync(current, opts);
+      } else if (enc === "deflate") {
+        try {
+          current = zlib.inflateSync(current, opts);
+        } catch (inflateErr) {
+          if (errorCode(inflateErr) === "ERR_BUFFER_TOO_LARGE")
+            throw inflateErr;
+          current = zlib.inflateRawSync(current, opts);
+        }
+      } else {
+        if (decoded) {
+          return new SafeFetchError(
+            `Cannot fully decode content-encoding "${encoding}"`,
+            url,
+            "decode-failed",
+            status
+          );
+        }
+        return { body: buf, decoded: false };
+      }
+      decoded = true;
+    }
+    return { body: current, decoded };
+  } catch (err) {
+    const tooLarge = errorCode(err) === "ERR_BUFFER_TOO_LARGE";
+    return new SafeFetchError(
+      tooLarge ? `Decoded ${encoding} response body exceeded the size cap` : `Failed to decode ${encoding} response body`,
+      url,
+      tooLarge ? "response-too-large" : "decode-failed",
+      status
+    );
+  }
+}
+function errorCode(err) {
+  if (err != null && typeof err === "object" && "code" in err) {
+    const code = err.code;
+    return typeof code === "string" ? code : void 0;
+  }
+  return void 0;
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let acc = 0;
+  for (const p of parts) {
+    const n = Number(p);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    acc = acc << 8 | n;
+  }
+  return acc >>> 0;
+}
+function isIpv4InCidr(intIp, cidr) {
+  const [addr, prefixRaw] = cidr.split("/");
+  const intCidr = ipv4ToInt(addr);
+  if (intCidr === null) return false;
+  const prefix = Number(prefixRaw);
+  if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false;
+  const mask = prefix === 0 ? 0 : -1 >>> 32 - prefix << 32 - prefix;
+  return (intIp & mask) >>> 0 === (intCidr & mask) >>> 0;
+}
+function isPublicIpv4(addr, allowLoopback) {
+  const intIp = ipv4ToInt(addr);
+  if (intIp === null) return false;
+  if (allowLoopback && addr === "127.0.0.1") return true;
+  for (const cidr of PRIVATE_IPV4_CIDRS) {
+    if (isIpv4InCidr(intIp, cidr)) return false;
+  }
+  return true;
+}
+function mappedIpv4(lower) {
+  const dotted = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (dotted) return dotted[1];
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hex) {
+    const hi = parseInt(hex[1], 16);
+    const lo = parseInt(hex[2], 16);
+    return [hi >> 8, hi & 255, lo >> 8, lo & 255].join(".");
+  }
+  return null;
+}
+function isPublicIpv6(addr, allowLoopback) {
+  const lower = addr.toLowerCase();
+  if (allowLoopback && lower === "::1") return true;
+  const mapped = mappedIpv4(lower);
+  if (mapped) {
+    return isPublicIpv4(mapped, allowLoopback);
+  }
+  if (lower === "::" || lower === "::1") return false;
+  const firstHextet = lower.split(":")[0] || "";
+  if (firstHextet.startsWith("fc") || firstHextet.startsWith("fd"))
+    return false;
+  if (firstHextet.startsWith("fe8") || firstHextet.startsWith("fe9"))
+    return false;
+  if (firstHextet.startsWith("fea") || firstHextet.startsWith("feb"))
+    return false;
+  if (firstHextet.startsWith("ff")) return false;
+  return true;
+}
+async function fetchStoredBytes(url, context, label, options, signal) {
+  let response;
+  try {
+    response = await safeFetch(url, {
+      ...options?.maxBytes === void 0 ? {} : { maxResponseBytes: options.maxBytes },
+      /*
+       * A caller's signal REPLACES the deadline rather than joining it.
+       *
+       * These adapters look the object's address up before fetching it, and
+       * that lookup can stall too. Starting a fresh timer here would give the
+       * fetch its own full budget on top of however long the lookup took, so a
+       * read could outlive the deadline the caller was told applied — by
+       * roughly double. One signal begun before the lookup governs both phases.
+       */
+      ...signal !== void 0 ? { signal } : options?.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+    });
+  } catch (error) {
+    const verdict = classifyFetchFailure(error);
+    if (verdict === "absent") return null;
+    if (verdict === "oversized") {
+      throw new StorageReadTooLargeError(
+        context,
+        resolveReadBounds(options).maxBytes
+      );
+    }
+    throw error;
+  }
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    throw NextlyError.internal({
+      logContext: {
+        service: label,
+        path: context,
+        status: response.status,
+        statusText: response.statusText
+      }
+    });
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+function classifyFetchFailure(error) {
+  if (!(error instanceof SafeFetchError)) return "unknown";
+  if (error.status === 404) return "absent";
+  const successful = error.status !== void 0 && error.status >= 200 && error.status < 300;
+  return error.reason === "response-too-large" && successful ? "oversized" : "unknown";
+}
+function resolveReadBounds(options) {
+  return {
+    maxBytes: options?.maxBytes ?? DEFAULT_READ_MAX_BYTES,
+    timeoutMs: options?.timeoutMs ?? DEFAULT_READ_TIMEOUT_MS
+  };
+}
+async function withDeadline(work, signal) {
+  if (signal === void 0) return await work;
+  return await Promise.race([
+    work,
+    new Promise((_, reject) => {
+      if (signal.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      signal.addEventListener("abort", () => reject(signal.reason), {
+        once: true
+      });
+    })
+  ]);
+}
+var IPV4_RE, PRIVATE_IPV4_CIDRS, CLOUD_METADATA_HOSTS, ExternalUrlError, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, SafeFetchError, DEFAULT_READ_TIMEOUT_MS, DEFAULT_READ_MAX_BYTES;
+var init_chunk_C2VHLQKK = __esm({
+  "../nextly/dist/chunk-C2VHLQKK.mjs"() {
+    init_chunk_W77AQUUQ();
+    init_chunk_HJ5IQPOY();
+    IPV4_RE = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+    PRIVATE_IPV4_CIDRS = [
+      "0.0.0.0/8",
+      // RFC1122 "this network" / wildcard
+      "10.0.0.0/8",
+      // RFC1918
+      "100.64.0.0/10",
+      // RFC6598 CGNAT
+      "127.0.0.0/8",
+      // RFC1122 loopback
+      "169.254.0.0/16",
+      // RFC3927 link-local + AWS/GCP metadata
+      "172.16.0.0/12",
+      // RFC1918
+      "192.0.0.0/24",
+      // RFC6890 IETF protocol assignments
+      "192.0.2.0/24",
+      // RFC5737 documentation
+      "192.168.0.0/16",
+      // RFC1918
+      "198.18.0.0/15",
+      // RFC2544 benchmarking
+      "198.51.100.0/24",
+      // RFC5737 documentation
+      "203.0.113.0/24",
+      // RFC5737 documentation
+      "224.0.0.0/4",
+      // RFC5771 multicast
+      "240.0.0.0/4"
+      // RFC1112 reserved
+    ];
+    CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
+      "metadata.google.internal",
+      "metadata.googleapis.com",
+      "metadata"
+      // GCP short form
+    ]);
+    ExternalUrlError = class extends NextlyError {
+      constructor(message, url) {
+        super({
+          code: "EXTERNAL_URL_BLOCKED",
+          publicMessage: message,
+          logContext: { url }
+        });
+        this.url = url;
+        this.name = "ExternalUrlError";
+      }
+    };
+    DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+    DEFAULT_TIMEOUT_MS = 3e4;
+    SafeFetchError = class extends NextlyError {
+      constructor(message, url, reason, status) {
+        super({
+          code: "EXTERNAL_REQUEST_FAILED",
+          publicMessage: message,
+          logContext: { url, reason }
+        });
+        this.url = url;
+        this.reason = reason;
+        this.status = status;
+        this.name = "SafeFetchError";
+      }
+    };
+    DEFAULT_READ_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
+    DEFAULT_READ_MAX_BYTES = DEFAULT_MAX_RESPONSE_BYTES;
+  }
+});
+
+// ../nextly/dist/chunk-IJCL4XOT.mjs
 var BaseStorageAdapter;
-var init_chunk_2ROPMX7N = __esm({
-  "../nextly/dist/chunk-2ROPMX7N.mjs"() {
+var init_chunk_IJCL4XOT = __esm({
+  "../nextly/dist/chunk-IJCL4XOT.mjs"() {
+    init_chunk_C2VHLQKK();
+    init_chunk_W77AQUUQ();
     BaseStorageAdapter = class {
       /**
        * Get adapter info including capabilities.
@@ -95,11 +1092,21 @@ var init_chunk_7P6ASYW6 = __esm({
   }
 });
 
-// ../nextly/dist/chunk-VM3CQBI2.mjs
-init_chunk_2ROPMX7N();
+// ../nextly/dist/chunk-ANFXYTYN.mjs
+init_chunk_IJCL4XOT();
+module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
 
 // ../nextly/dist/storage/index.mjs
-init_chunk_2ROPMX7N();
+init_chunk_IJCL4XOT();
+init_chunk_C2VHLQKK();
+init_chunk_W77AQUUQ();
+init_chunk_HJ5IQPOY();
+init_chunk_7P6ASYW6();
+
+// ../nextly/dist/storage/fetch-stored-bytes.mjs
+init_chunk_C2VHLQKK();
+init_chunk_W77AQUUQ();
+init_chunk_HJ5IQPOY();
 init_chunk_7P6ASYW6();
 var UploadthingStorageAdapter = class extends BaseStorageAdapter {
   utapi;
@@ -178,6 +1185,37 @@ var UploadthingStorageAdapter = class extends BaseStorageAdapter {
       return false;
     }
   }
+  /**
+   * Read a stored file back as bytes, or `null` when it is not there.
+   *
+   * A NETWORK round trip for the same reason as the Vercel adapter: the bytes
+   * live on UploadThing's CDN. A caller serving these from its own origin has
+   * to cache, or it pays the fetch on every request.
+   *
+   * The URL comes from `getFileUrls` rather than being assembled, because the
+   * service owns the address and this adapter never chose it.
+   *
+   * @param filePath - File key
+   * @returns The file's bytes, or `null` when no such key exists
+   */
+  async read(filePath, options) {
+    const deadline = AbortSignal.timeout(
+      options?.timeoutMs ?? DEFAULT_READ_TIMEOUT_MS
+    );
+    const result = await withDeadline(
+      this.utapi.getFileUrls([filePath], { keyType: "fileKey" }),
+      deadline
+    );
+    const target = Array.from(result.data)[0]?.url;
+    if (target === void 0) return null;
+    return await fetchStoredBytes(
+      target,
+      filePath,
+      "UploadThing",
+      options,
+      deadline
+    );
+  }
   /**
    * Get public URL for a file.
    * Uploadthing files are served from utfs.io CDN.