@nextlyhq/storage-vercel-blob 0.0.1

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 NextlyHQ <info@nextlyhq.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,90 @@
+# @nextlyhq/storage-vercel-blob
+
+[Vercel Blob](https://vercel.com/docs/storage/vercel-blob) storage adapter for Nextly. Optimized for Vercel deployments with built-in support for client-side uploads to bypass the 4.5 MB serverless body limit.
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@nextlyhq/storage-vercel-blob"><img alt="npm" src="https://img.shields.io/npm/v/@nextlyhq/storage-vercel-blob?style=flat-square&label=npm&color=cb3837" /></a>
+  <a href="https://github.com/nextlyhq/nextly/blob/main/LICENSE.md"><img alt="License" src="https://img.shields.io/github/license/nextlyhq/nextly?style=flat-square&color=blue" /></a>
+  <a href="https://nextlyhq.com/docs"><img alt="Status" src="https://img.shields.io/badge/status-alpha-orange?style=flat-square" /></a>
+</p>
+
+> [!IMPORTANT]
+> Nextly is in alpha. APIs may change before 1.0. Pin exact versions in production.
+
+## What it is
+
+Stores Nextly media uploads on Vercel Blob. The simplest option if you are deploying to [Vercel](https://vercel.com?utm_source=nextly&utm_medium=readme) and want zero infrastructure setup. Client-side uploads (large files bypass the serverless body limit) are enabled with one config flag.
+
+> **You do not need this for development.** Nextly's default storage is local disk under `./public/uploads/`. Install this when you are ready to move uploads to Vercel Blob, typically for production deployments to Vercel.
+
+## Installation
+
+```bash
+pnpm add @nextlyhq/storage-vercel-blob
+```
+
+## Quick usage
+
+Register the storage adapter in `nextly.config.ts`:
+
+```ts
+import { defineConfig } from "nextly/config";
+import { vercelBlobStorage } from "@nextlyhq/storage-vercel-blob";
+
+export default defineConfig({
+  storage: [
+    vercelBlobStorage({
+      token: process.env.BLOB_READ_WRITE_TOKEN!,
+      collections: { media: true },
+    }),
+  ],
+});
+```
+
+## Required environment variables
+
+| Variable                | Required? | Default | Notes                                                                  |
+| ----------------------- | --------- | ------- | ---------------------------------------------------------------------- |
+| `BLOB_READ_WRITE_TOKEN` | yes       | (none)  | Provisioned automatically by Vercel when you enable Blob in a project. |
+
+## Client-side uploads
+
+For files larger than ~4.5 MB on Vercel's serverless functions, enable client uploads:
+
+```ts
+vercelBlobStorage({
+  token: process.env.BLOB_READ_WRITE_TOKEN!,
+  collections: {
+    media: { clientUploads: true },
+  },
+});
+```
+
+The admin uploader hands the file to the browser-side SDK, which uploads directly to Blob. The server only signs the upload.
+
+## Main exports
+
+- `vercelBlobStorage`: plugin factory for `defineConfig.storage`
+- `VercelBlobStorageAdapter`: the adapter class (advanced)
+- Type exports: `VercelBlobStorageConfig`
+
+## Compatibility
+
+| Tool           | Version |
+| -------------- | ------- |
+| Node.js        | 20+     |
+| `@vercel/blob` | peer    |
+| `nextly`       | 0.0.x   |
+
+## Documentation
+
+- [**Media and storage docs**](https://nextlyhq.com/docs/guides/media-storage)
+
+## Related packages
+
+- [`@nextlyhq/storage-s3`](../storage-s3)
+- [`@nextlyhq/storage-uploadthing`](../storage-uploadthing)
+
+## License
+
+[MIT](../../LICENSE.md)

package/dist/index.cjs

@@ -0,0 +1,399 @@
+'use strict';
+
+var blob = require('@vercel/blob');
+
+// src/adapter.ts
+var VercelBlobStorageAdapter = class {
+  /**
+   * Create a new Vercel Blob storage adapter.
+   *
+   * @param config - Vercel Blob storage configuration
+   * @throws Error if token is not provided
+   */
+  constructor(config) {
+    this.config = config;
+    const token = config.token || process.env.BLOB_READ_WRITE_TOKEN || "";
+    if (!token) {
+      throw new Error(
+        "@nextly/storage-vercel-blob: token is required.\n\nEither set the BLOB_READ_WRITE_TOKEN environment variable or pass token in config.\nGet your token from: Vercel Dashboard > Storage > Blob > Tokens"
+      );
+    }
+    this.resolvedConfig = {
+      token,
+      addRandomSuffix: config.addRandomSuffix ?? true,
+      cacheControlMaxAge: config.cacheControlMaxAge ?? 31536e3,
+      access: config.access ?? "public",
+      storeId: config.storeId,
+      allowOverwrite: config.allowOverwrite ?? false,
+      multipartThreshold: config.multipartThreshold ?? 5 * 1024 * 1024
+      // 5MB
+    };
+  }
+  resolvedConfig;
+  // ============================================================
+  // Core IStorageAdapter Methods
+  // ============================================================
+  /**
+   * Upload file to Vercel Blob.
+   *
+   * Files are stored with globally distributed CDN backing.
+   * By default, a random suffix is added to prevent filename collisions.
+   *
+   * @param buffer - File content as Buffer
+   * @param options - Upload options (filename, mimeType, folder, collection)
+   * @returns Upload result with URL and storage path
+   */
+  async upload(buffer, options) {
+    const mimeType = (options.contentType || options.mimeType || "").toLowerCase().trim();
+    const filename = (options.filename || "").toLowerCase();
+    const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".") + 1) : "";
+    const isSvg = mimeType === "image/svg+xml" || ext === "svg" || ext === "svgz";
+    const isHtml = mimeType === "text/html" || mimeType === "application/xhtml+xml" || ext === "html" || ext === "htm" || ext === "xhtml";
+    if (isSvg || isHtml) {
+      const kind = isSvg ? "SVG" : "HTML";
+      throw new Error(
+        `[nextly/storage-vercel-blob] ${kind} uploads are rejected on Vercel Blob \u2014 the platform cannot serve them with attachment-disposition or a restrictive CSP, so they would be stored XSS. Use the S3 / R2 adapter for ${kind} files, or convert to a raster format (PNG/WebP).`
+      );
+    }
+    const pathname = this.buildPathname(options.filename, options.folder);
+    const result = await blob.put(pathname, buffer, {
+      access: this.resolvedConfig.access,
+      token: this.resolvedConfig.token,
+      contentType: options.contentType || options.mimeType,
+      addRandomSuffix: this.resolvedConfig.addRandomSuffix,
+      cacheControlMaxAge: this.resolvedConfig.cacheControlMaxAge
+    });
+    return {
+      url: result.url,
+      path: result.url
+    };
+  }
+  /**
+   * Delete file from Vercel Blob.
+   *
+   * @param filePath - Full blob URL to delete
+   */
+  async delete(filePath) {
+    await blob.del(filePath, {
+      token: this.resolvedConfig.token
+    });
+  }
+  /**
+   * Delete multiple files from Vercel Blob in chunked batches.
+   *
+   * Processes deletions in chunks of 10 concurrent calls using Promise.allSettled,
+   * collecting successes and failures without short-circuiting.
+   *
+   * @param filePaths - Array of full blob URLs to delete
+   * @returns BulkDeleteResult with successful and failed arrays
+   */
+  async bulkDelete(filePaths) {
+    const successful = [];
+    const failed = [];
+    const chunkSize = 10;
+    for (let i = 0; i < filePaths.length; i += chunkSize) {
+      const chunk = filePaths.slice(i, i + chunkSize);
+      const results = await Promise.allSettled(
+        chunk.map((fp) => blob.del(fp, { token: this.resolvedConfig.token }))
+      );
+      results.forEach((result, idx) => {
+        const fp = chunk[idx];
+        if (result.status === "fulfilled") {
+          successful.push(fp);
+        } else {
+          failed.push({
+            filePath: fp,
+            error: result.reason instanceof Error ? result.reason.message : String(result.reason)
+          });
+        }
+      });
+    }
+    return { successful, failed };
+  }
+  /**
+   * Check if file exists in Vercel Blob.
+   *
+   * Uses the head() function which is efficient for existence checks.
+   *
+   * @param filePath - Full blob URL to check
+   * @returns true if file exists, false otherwise
+   */
+  async exists(filePath) {
+    try {
+      await blob.head(filePath, {
+        token: this.resolvedConfig.token
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get public URL for Vercel Blob file.
+   *
+   * Vercel Blob paths ARE the public URLs - they're already full HTTPS URLs
+   * with CDN distribution.
+   *
+   * @param filePath - Full blob URL
+   * @returns The same URL (Vercel Blob paths are already public URLs)
+   */
+  getPublicUrl(filePath) {
+    return filePath;
+  }
+  /**
+   * Get storage type identifier.
+   */
+  getType() {
+    return "vercel-blob";
+  }
+  // ============================================================
+  // Optional IStorageAdapter Methods
+  // ============================================================
+  /**
+   * Get adapter info including capabilities.
+   *
+   * @returns Adapter info with type, name, and capability flags
+   */
+  getInfo() {
+    return {
+      type: "vercel-blob",
+      name: "VercelBlobStorageAdapter",
+      supportsSignedUrls: false,
+      // Vercel Blob URLs are public by default
+      supportsClientUploads: true
+      // Via handleUpload API
+    };
+  }
+  /**
+   * Get file metadata from Vercel Blob.
+   *
+   * Retrieves file information including size, content type, and upload date.
+   *
+   * @param filePath - Full blob URL
+   * @returns File metadata or null if file not found
+   */
+  async getMetadata(filePath) {
+    try {
+      const result = await blob.head(filePath, {
+        token: this.resolvedConfig.token
+      });
+      const filename = result.pathname.split("/").pop() || result.pathname;
+      return {
+        id: filePath,
+        filename,
+        originalFilename: filename,
+        mimeType: result.contentType,
+        size: result.size,
+        url: result.url,
+        createdAt: result.uploadedAt.toISOString()
+      };
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Generate pre-signed URL for client-side uploads.
+   *
+   * Vercel Blob uses a different pattern for client uploads - they require
+   * the handleUpload API which handles token generation server-side.
+   *
+   * This method is not implemented because Vercel Blob's client upload flow
+   * requires server-side route handlers with handleUpload().
+   *
+   * @see https://vercel.com/docs/storage/vercel-blob/client-upload
+   * @throws Error always - client uploads require handleUpload API
+   */
+  getPresignedUploadUrl(_key, _mimeType, _expiresIn) {
+    return Promise.reject(
+      new Error(
+        "@nextly/storage-vercel-blob: Client uploads require the handleUpload API.\n\nVercel Blob uses a different pattern for client-side uploads that involves:\n1. A server-side route handler with handleUpload()\n2. The @vercel/blob/client upload() function\n\nSee: https://vercel.com/docs/storage/vercel-blob/client-upload\n\nFor server-side uploads, use the standard upload() method instead."
+      )
+    );
+  }
+  // ============================================================
+  // Additional Methods
+  // ============================================================
+  /**
+   * List blobs with optional prefix filter.
+   *
+   * Useful for browsing or batch operations on stored files.
+   *
+   * @param prefix - Optional prefix to filter results
+   * @param options - List options (limit, cursor)
+   * @returns List of blob metadata
+   */
+  async listBlobs(prefix, options) {
+    const result = await blob.list({
+      token: this.resolvedConfig.token,
+      prefix,
+      limit: options?.limit,
+      cursor: options?.cursor
+    });
+    return {
+      blobs: result.blobs.map((blob) => ({
+        url: blob.url,
+        pathname: blob.pathname,
+        size: blob.size,
+        uploadedAt: blob.uploadedAt
+      })),
+      hasMore: result.hasMore,
+      cursor: result.cursor
+    };
+  }
+  // ============================================================
+  // Helper Methods
+  // ============================================================
+  /**
+   * Build pathname for Vercel Blob upload.
+   *
+   * Creates pathname in format: {folder}/{filename}
+   * If no folder is provided, uses the filename directly.
+   *
+   * @param filename - Original filename (will be sanitized)
+   * @param folder - Optional folder/prefix for organizing uploads
+   * @returns Generated pathname
+   * @throws Error if folder fails sanitization
+   */
+  buildPathname(filename, folder) {
+    const sanitized = this.sanitizeFilename(filename);
+    if (!folder) return sanitized;
+    return `${this.sanitizeFolder(folder)}/${sanitized}`;
+  }
+  /**
+   * Sanitize filename to prevent path traversal issues.
+   *
+   * @param filename - Original filename
+   * @returns Sanitized filename
+   */
+  sanitizeFilename(filename) {
+    const basename = filename.split(/[/\\]/).pop() || filename;
+    return basename.replace(/[^a-zA-Z0-9._-]/g, "-");
+  }
+  /**
+   * Reject folder values that would let a caller
+   * escape the configured prefix via path traversal or weird
+   * separators. Vercel Blob is flat-keyed so `/` is just part of the
+   * pathname, but an attacker who controls `folder` could still:
+   *
+   *   - Use `..` to chain a relative-traversal-style key.
+   *   - Use `\` (Windows separator) to confuse downstream tooling.
+   *   - Use control chars / null bytes to truncate the key.
+   *   - Use a leading `/` to look like an absolute path.
+   *
+   * Internal `/` segments stay allowed because callers legitimately
+   * use nested folders (`docs/2026/...`); a leading `/`, empty
+   * segments (`docs//x`), or `..` segments are rejected.
+   *
+   * @throws Error with a stable message so the storage facade can
+   *   surface a 400 instead of a 500.
+   */
+  sanitizeFolder(folder) {
+    const trimmed = folder.replace(/\/+$/, "");
+    if (!trimmed) {
+      throw new Error("Folder must be a non-empty string.");
+    }
+    if (/[\\\0\x01-\x1f\x7f]/.test(trimmed)) {
+      throw new Error(
+        "Folder contains forbidden characters (backslash, control chars, or null bytes)."
+      );
+    }
+    if (trimmed.startsWith("/")) {
+      throw new Error("Folder must not start with `/`.");
+    }
+    const segments = trimmed.split("/");
+    for (const segment of segments) {
+      if (segment === "") {
+        throw new Error("Folder must not contain empty segments (`//`).");
+      }
+      if (segment === "..") {
+        throw new Error("Folder must not contain `..` segments.");
+      }
+    }
+    return trimmed;
+  }
+  // ============================================================
+  // Public Accessors
+  // ============================================================
+  /**
+   * Get the configured token (masked for logging).
+   */
+  getTokenMasked() {
+    const token = this.resolvedConfig.token;
+    if (token.length <= 8) return "****";
+    return `${token.slice(0, 4)}...${token.slice(-4)}`;
+  }
+  /**
+   * Check if random suffix is enabled.
+   */
+  hasRandomSuffix() {
+    return this.resolvedConfig.addRandomSuffix;
+  }
+  /**
+   * Get configured cache control max age.
+   */
+  getCacheControlMaxAge() {
+    return this.resolvedConfig.cacheControlMaxAge;
+  }
+};
+
+// src/plugin.ts
+function vercelBlobStorage(config) {
+  if (config.enabled === false) {
+    return {
+      name: "vercel-blob-storage",
+      type: "vercel-blob",
+      collections: {},
+      adapter: null
+    };
+  }
+  const adapter = new VercelBlobStorageAdapter(config);
+  const plugin = {
+    name: "vercel-blob-storage",
+    type: "vercel-blob",
+    collections: config.collections,
+    adapter,
+    /**
+     * Generate upload URL for client-side uploads.
+     *
+     * Note: Vercel Blob uses a different pattern for client uploads.
+     * Instead of pre-signed URLs, it uses the handleUpload() API which
+     * requires server-side route handlers.
+     *
+     * This method throws an error explaining the correct approach.
+     *
+     * @see https://vercel.com/docs/storage/vercel-blob/client-upload
+     */
+    getClientUploadUrl(_filename, _mimeType, _collection) {
+      return Promise.reject(
+        new Error(
+          "@nextly/storage-vercel-blob: Client uploads require the handleUpload API.\n\nVercel Blob uses a different pattern than S3 for client-side uploads:\n\n1. Create a server-side route handler with handleUpload()\n2. Use upload() from @vercel/blob/client on the frontend\n\nSee: https://vercel.com/docs/storage/vercel-blob/client-upload"
+        )
+      );
+    },
+    /**
+     * Get signed download URL for file access.
+     *
+     * Note: Vercel Blob URLs are public by default and do not support
+     * signed/temporary URLs. All uploaded blobs are accessible via their
+     * public URL.
+     *
+     * @param path - Storage path (full blob URL)
+     * @returns The same URL (Vercel Blob URLs are public)
+     */
+    getSignedDownloadUrl(path) {
+      return Promise.resolve(path);
+    }
+  };
+  return plugin;
+}
+
+// src/index.ts
+var PACKAGE_NAME = "@nextly/storage-vercel-blob";
+var PACKAGE_VERSION = "0.1.0";
+
+exports.PACKAGE_NAME = PACKAGE_NAME;
+exports.PACKAGE_VERSION = PACKAGE_VERSION;
+exports.VercelBlobStorageAdapter = VercelBlobStorageAdapter;
+exports.vercelBlobStorage = vercelBlobStorage;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapter.ts","../src/plugin.ts","../src/index.ts"],"names":["put","del","head","list"],"mappings":";;;;;AAuDO,IAAM,2BAAN,MAA0D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/D,YAAoB,MAAA,EAAiC;AAAjC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAElB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,OAAA,CAAQ,IAAI,qBAAA,IAAyB,EAAA;AAEnE,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAGF;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,cAAA,GAAiB;AAAA,MACpB,KAAA;AAAA,MACA,eAAA,EAAiB,OAAO,eAAA,IAAmB,IAAA;AAAA,MAC3C,kBAAA,EAAoB,OAAO,kBAAA,IAAsB,OAAA;AAAA,MACjD,MAAA,EAAQ,OAAO,MAAA,IAAU,QAAA;AAAA,MACzB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,cAAA,EAAgB,OAAO,cAAA,IAAkB,KAAA;AAAA,MACzC,kBAAA,EAAoB,MAAA,CAAO,kBAAA,IAAsB,CAAA,GAAI,IAAA,GAAO;AAAA;AAAA,KAC9D;AAAA,EACF;AAAA,EA9BQ,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8CR,MAAM,MAAA,CAAO,MAAA,EAAgB,OAAA,EAA+C;AAO1E,IAAA,MAAM,QAAA,GAAA,CAAY,QAAQ,WAAA,IAAe,OAAA,CAAQ,YAAY,EAAA,EAC1D,WAAA,GACA,IAAA,EAAK;AACR,IAAA,MAAM,QAAA,GAAA,CAAY,OAAA,CAAQ,QAAA,IAAY,EAAA,EAAI,WAAA,EAAY;AACtD,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,GAC7B,QAAA,CAAS,KAAA,CAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA,GAAI,CAAC,CAAA,GAC5C,EAAA;AACJ,IAAA,MAAM,KAAA,GACJ,QAAA,KAAa,eAAA,IAAmB,GAAA,KAAQ,SAAS,GAAA,KAAQ,MAAA;AAC3D,IAAA,MAAM,MAAA,GACJ,aAAa,WAAA,IACb,QAAA,KAAa,2BACb,GAAA,KAAQ,MAAA,IACR,GAAA,KAAQ,KAAA,IACR,GAAA,KAAQ,OAAA;AACV,IAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,GAAQ,MAAA;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,6BAAA,EAAgC,IAAI,CAAA,sLAAA,EAGnB,IAAI,CAAA,iDAAA;AAAA,OACvB;AAAA,IACF;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,aAAA,CAAc,OAAA,CAAQ,QAAA,EAAU,QAAQ,MAAM,CAAA;AAEpE,IAAA,MAAM,MAAA,GAAS,MAAMA,QAAA,CAAI,QAAA,EAAU,MAAA,EAAQ;AAAA,MACzC,MAAA,EAAQ,KAAK,cAAA,CAAe,MAAA;AAAA,MAC5B,KAAA,EAAO,KAAK,cAAA,CAAe,KAAA;AAAA,MAC3B,WAAA,EAAa,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,QAAA;AAAA,MAC5C,eAAA,EAAiB,KAAK,cAAA,CAAe,eAAA;AAAA,MACrC,kBAAA,EAAoB,KAAK,cAAA,CAAe;AAAA,KACzC,CAAA;AAGD,IAAA,OAAO;AAAA,MACL,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,MAAM,MAAA,CAAO;AAAA,KACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAMC,SAAI,QAAA,EAAU;AAAA,MAClB,KAAA,EAAO,KAAK,cAAA,CAAe;AAAA,KAC5B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,WAAW,SAAA,EAAgD;AAC/D,IAAA,MAAM,aAAuB,EAAC;AAC9B,IAAA,MAAM,SAAqD,EAAC;AAC5D,IAAA,MAAM,SAAA,GAAY,EAAA;AAElB,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,MAAA,EAAQ,KAAK,SAAA,EAAW;AACpD,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,IAAI,SAAS,CAAA;AAC9C,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA;AAAA,QAC5B,KAAA,CAAM,GAAA,CAAI,CAAA,EAAA,KAAMA,QAAA,CAAI,EAAA,EAAI,EAAE,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,CAAC;AAAA,OAC/D;AAEA,MAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAA,KAAQ;AAC/B,QAAA,MAAM,EAAA,GAAK,MAAM,GAAG,CAAA;AACpB,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,UAAA,CAAW,KAAK,EAAE,CAAA;AAAA,QACpB,CAAA,MAAO;AACL,UAAA,MAAA,CAAO,IAAA,CAAK;AAAA,YACV,QAAA,EAAU,EAAA;AAAA,YACV,KAAA,EACE,OAAO,MAAA,YAAkB,KAAA,GACrB,OAAO,MAAA,CAAO,OAAA,GACd,MAAA,CAAO,MAAA,CAAO,MAAM;AAAA,WAC3B,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,EAAE,YAAY,MAAA,EAAO;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,QAAA,EAAoC;AAC/C,IAAA,IAAI;AACF,MAAA,MAAMC,UAAK,QAAA,EAAU;AAAA,QACnB,KAAA,EAAO,KAAK,cAAA,CAAe;AAAA,OAC5B,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,QAAA,EAA0B;AAErC,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAyB;AACvB,IAAA,OAAO,aAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAA,GAA8B;AAC5B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,aAAA;AAAA,MACN,IAAA,EAAM,0BAAA;AAAA,MACN,kBAAA,EAAoB,KAAA;AAAA;AAAA,MACpB,qBAAA,EAAuB;AAAA;AAAA,KACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAY,QAAA,EAAgD;AAChE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAMA,SAAA,CAAK,QAAA,EAAU;AAAA,QAClC,KAAA,EAAO,KAAK,cAAA,CAAe;AAAA,OAC5B,CAAA;AAGD,MAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,MAAS,MAAA,CAAO,QAAA;AAE5D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,QAAA;AAAA,QACJ,QAAA;AAAA,QACA,gBAAA,EAAkB,QAAA;AAAA,QAClB,UAAU,MAAA,CAAO,WAAA;AAAA,QACjB,MAAM,MAAA,CAAO,IAAA;AAAA,QACb,KAAK,MAAA,CAAO,GAAA;AAAA,QACZ,SAAA,EAAW,MAAA,CAAO,UAAA,CAAW,WAAA;AAAY,OAC3C;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,qBAAA,CACE,IAAA,EACA,SAAA,EACA,UAAA,EAC2B;AAC3B,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,KAAA;AAAA,QACF;AAAA;AAMF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,SAAA,CACJ,MAAA,EACA,OAAA,EAUC;AACD,IAAA,MAAM,MAAA,GAAS,MAAMC,SAAA,CAAK;AAAA,MACxB,KAAA,EAAO,KAAK,cAAA,CAAe,KAAA;AAAA,MAC3B,MAAA;AAAA,MACA,OAAO,OAAA,EAAS,KAAA;AAAA,MAChB,QAAQ,OAAA,EAAS;AAAA,KAClB,CAAA;AAED,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,MAAS;AAAA,QAC/B,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,UAAU,IAAA,CAAK,QAAA;AAAA,QACf,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,YAAY,IAAA,CAAK;AAAA,OACnB,CAAE,CAAA;AAAA,MACF,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,QAAQ,MAAA,CAAO;AAAA,KACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,aAAA,CAAc,UAAkB,MAAA,EAAyB;AAC/D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,gBAAA,CAAiB,QAAQ,CAAA;AAChD,IAAA,IAAI,CAAC,QAAQ,OAAO,SAAA;AACpB,IAAA,OAAO,GAAG,IAAA,CAAK,cAAA,CAAe,MAAM,CAAC,IAAI,SAAS,CAAA,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,iBAAiB,QAAA,EAA0B;AACjD,IAAA,MAAM,WAAW,QAAA,CAAS,KAAA,CAAM,OAAO,CAAA,CAAE,KAAI,IAAK,QAAA;AAClD,IAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,kBAAA,EAAoB,GAAG,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBQ,eAAe,MAAA,EAAwB;AAC7C,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACzC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI,YAAY,EAAA,EAAI;AAClB,QAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,MAClE;AACA,MAAA,IAAI,YAAY,IAAA,EAAM;AACpB,QAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cAAA,GAAyB;AACvB,IAAA,MAAM,KAAA,GAAQ,KAAK,cAAA,CAAe,KAAA;AAClC,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,CAAA,EAAG,OAAO,MAAA;AAC9B,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GAA2B;AACzB,IAAA,OAAO,KAAK,cAAA,CAAe,eAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAA,GAAgC;AAC9B,IAAA,OAAO,KAAK,cAAA,CAAe,kBAAA;AAAA,EAC7B;AACF;;;AClYO,SAAS,kBACd,MAAA,EACe;AAIf,EAAA,IAAI,MAAA,CAAO,YAAY,KAAA,EAAO;AAC5B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,qBAAA;AAAA,MACN,IAAA,EAAM,aAAA;AAAA,MACN,aAAa,EAAC;AAAA,MACd,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAIA,EAAA,MAAM,OAAA,GAAU,IAAI,wBAAA,CAAyB,MAAM,CAAA;AAGnD,EAAA,MAAM,MAAA,GAAwB;AAAA,IAC5B,IAAA,EAAM,qBAAA;AAAA,IACN,IAAA,EAAM,aAAA;AAAA,IACN,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAaA,kBAAA,CACE,SAAA,EACA,SAAA,EACA,WAAA,EAC2B;AAG3B,MAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,QACb,IAAI,KAAA;AAAA,UACF;AAAA;AAKF,OACF;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,qBAAqB,IAAA,EAA+B;AAGlD,MAAA,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,IAC7B;AAAA,GACF;AAEA,EAAA,OAAO,MAAA;AACT;;;AC1FO,IAAM,YAAA,GAAe;AACrB,IAAM,eAAA,GAAkB","file":"index.cjs","sourcesContent":["/**\n * Vercel Blob Storage Adapter\n *\n * Stores files on Vercel Blob Storage, a globally distributed object storage\n * service powered by Cloudflare R2. Optimized for Vercel deployments with\n * built-in CDN distribution.\n *\n * Features:\n * - Globally distributed CDN-backed storage\n * - Automatic file management with unique filenames\n * - Token-based authentication\n * - Client-side upload support (via handleUpload API)\n * - Serverless-friendly (no filesystem access required)\n *\n * @example Basic usage\n * ```typescript\n * const adapter = new VercelBlobStorageAdapter({\n *   token: process.env.BLOB_READ_WRITE_TOKEN,\n *   collections: { media: true }\n * });\n *\n * const result = await adapter.upload(buffer, {\n *   filename: 'photo.jpg',\n *   mimeType: 'image/jpeg'\n * });\n * // result.url: \"https://abc123.public.blob.vercel-storage.com/photo-xyz.jpg\"\n * ```\n */\n\nimport { put, del, head, list } from \"@vercel/blob\";\nimport type {\n  IStorageAdapter,\n  UploadOptions,\n  UploadResult,\n  StorageAdapterInfo,\n  ClientUploadData,\n  FileMetadata,\n  BulkDeleteResult,\n} from \"nextly/storage\";\n\nimport type {\n  VercelBlobStorageConfig,\n  ResolvedVercelBlobConfig,\n} from \"./types\";\n\n// ============================================================\n// Vercel Blob Storage Adapter\n// ============================================================\n\n/**\n * Vercel Blob Storage Adapter\n *\n * Implements the IStorageAdapter interface for Vercel Blob Storage.\n * Provides file upload, deletion, existence checks, and metadata retrieval.\n */\nexport class VercelBlobStorageAdapter implements IStorageAdapter {\n  private resolvedConfig: ResolvedVercelBlobConfig;\n\n  /**\n   * Create a new Vercel Blob storage adapter.\n   *\n   * @param config - Vercel Blob storage configuration\n   * @throws Error if token is not provided\n   */\n  constructor(private config: VercelBlobStorageConfig) {\n    // Resolve token from config or environment\n    const token = config.token || process.env.BLOB_READ_WRITE_TOKEN || \"\";\n\n    if (!token) {\n      throw new Error(\n        \"@nextly/storage-vercel-blob: token is required.\\n\\n\" +\n          \"Either set the BLOB_READ_WRITE_TOKEN environment variable or pass token in config.\\n\" +\n          \"Get your token from: Vercel Dashboard > Storage > Blob > Tokens\"\n      );\n    }\n\n    // Resolve config with defaults\n    this.resolvedConfig = {\n      token,\n      addRandomSuffix: config.addRandomSuffix ?? true,\n      cacheControlMaxAge: config.cacheControlMaxAge ?? 31536000,\n      access: config.access ?? \"public\",\n      storeId: config.storeId,\n      allowOverwrite: config.allowOverwrite ?? false,\n      multipartThreshold: config.multipartThreshold ?? 5 * 1024 * 1024, // 5MB\n    };\n  }\n\n  // ============================================================\n  // Core IStorageAdapter Methods\n  // ============================================================\n\n  /**\n   * Upload file to Vercel Blob.\n   *\n   * Files are stored with globally distributed CDN backing.\n   * By default, a random suffix is added to prevent filename collisions.\n   *\n   * @param buffer - File content as Buffer\n   * @param options - Upload options (filename, mimeType, folder, collection)\n   * @returns Upload result with URL and storage path\n   */\n  async upload(buffer: Buffer, options: UploadOptions): Promise<UploadResult> {\n    // Hard-reject SVG and HTML uploads on Vercel Blob. The platform\n    // does not support per-object response headers (no Content-\n    // Disposition: attachment, no CSP), so an attacker who can\n    // persuade an admin to upload `evil.svg` (or `.html`) gets a\n    // stored XSS that fires on every viewer hit. S3 / R2 / similar\n    // adapters can enforce attachment-disposition; Vercel Blob cannot.\n    const mimeType = (options.contentType || options.mimeType || \"\")\n      .toLowerCase()\n      .trim();\n    const filename = (options.filename || \"\").toLowerCase();\n    const ext = filename.includes(\".\")\n      ? filename.slice(filename.lastIndexOf(\".\") + 1)\n      : \"\";\n    const isSvg =\n      mimeType === \"image/svg+xml\" || ext === \"svg\" || ext === \"svgz\";\n    const isHtml =\n      mimeType === \"text/html\" ||\n      mimeType === \"application/xhtml+xml\" ||\n      ext === \"html\" ||\n      ext === \"htm\" ||\n      ext === \"xhtml\";\n    if (isSvg || isHtml) {\n      const kind = isSvg ? \"SVG\" : \"HTML\";\n      throw new Error(\n        `[nextly/storage-vercel-blob] ${kind} uploads are rejected on Vercel ` +\n          `Blob — the platform cannot serve them with attachment-disposition ` +\n          `or a restrictive CSP, so they would be stored XSS. Use the S3 / R2 ` +\n          `adapter for ${kind} files, or convert to a raster format (PNG/WebP).`\n      );\n    }\n\n    const pathname = this.buildPathname(options.filename, options.folder);\n\n    const result = await put(pathname, buffer, {\n      access: this.resolvedConfig.access,\n      token: this.resolvedConfig.token,\n      contentType: options.contentType || options.mimeType,\n      addRandomSuffix: this.resolvedConfig.addRandomSuffix,\n      cacheControlMaxAge: this.resolvedConfig.cacheControlMaxAge,\n    });\n\n    // Vercel Blob uses the URL as the path identifier\n    return {\n      url: result.url,\n      path: result.url,\n    };\n  }\n\n  /**\n   * Delete file from Vercel Blob.\n   *\n   * @param filePath - Full blob URL to delete\n   */\n  async delete(filePath: string): Promise<void> {\n    await del(filePath, {\n      token: this.resolvedConfig.token,\n    });\n  }\n\n  /**\n   * Delete multiple files from Vercel Blob in chunked batches.\n   *\n   * Processes deletions in chunks of 10 concurrent calls using Promise.allSettled,\n   * collecting successes and failures without short-circuiting.\n   *\n   * @param filePaths - Array of full blob URLs to delete\n   * @returns BulkDeleteResult with successful and failed arrays\n   */\n  async bulkDelete(filePaths: string[]): Promise<BulkDeleteResult> {\n    const successful: string[] = [];\n    const failed: Array<{ filePath: string; error: string }> = [];\n    const chunkSize = 10;\n\n    for (let i = 0; i < filePaths.length; i += chunkSize) {\n      const chunk = filePaths.slice(i, i + chunkSize);\n      const results = await Promise.allSettled(\n        chunk.map(fp => del(fp, { token: this.resolvedConfig.token }))\n      );\n\n      results.forEach((result, idx) => {\n        const fp = chunk[idx];\n        if (result.status === \"fulfilled\") {\n          successful.push(fp);\n        } else {\n          failed.push({\n            filePath: fp,\n            error:\n              result.reason instanceof Error\n                ? result.reason.message\n                : String(result.reason),\n          });\n        }\n      });\n    }\n\n    return { successful, failed };\n  }\n\n  /**\n   * Check if file exists in Vercel Blob.\n   *\n   * Uses the head() function which is efficient for existence checks.\n   *\n   * @param filePath - Full blob URL to check\n   * @returns true if file exists, false otherwise\n   */\n  async exists(filePath: string): Promise<boolean> {\n    try {\n      await head(filePath, {\n        token: this.resolvedConfig.token,\n      });\n      return true;\n    } catch {\n      // Vercel Blob throws an error if the blob doesn't exist\n      return false;\n    }\n  }\n\n  /**\n   * Get public URL for Vercel Blob file.\n   *\n   * Vercel Blob paths ARE the public URLs - they're already full HTTPS URLs\n   * with CDN distribution.\n   *\n   * @param filePath - Full blob URL\n   * @returns The same URL (Vercel Blob paths are already public URLs)\n   */\n  getPublicUrl(filePath: string): string {\n    // Vercel Blob paths are already full URLs\n    return filePath;\n  }\n\n  /**\n   * Get storage type identifier.\n   */\n  getType(): \"vercel-blob\" {\n    return \"vercel-blob\";\n  }\n\n  // ============================================================\n  // Optional IStorageAdapter Methods\n  // ============================================================\n\n  /**\n   * Get adapter info including capabilities.\n   *\n   * @returns Adapter info with type, name, and capability flags\n   */\n  getInfo(): StorageAdapterInfo {\n    return {\n      type: \"vercel-blob\",\n      name: \"VercelBlobStorageAdapter\",\n      supportsSignedUrls: false, // Vercel Blob URLs are public by default\n      supportsClientUploads: true, // Via handleUpload API\n    };\n  }\n\n  /**\n   * Get file metadata from Vercel Blob.\n   *\n   * Retrieves file information including size, content type, and upload date.\n   *\n   * @param filePath - Full blob URL\n   * @returns File metadata or null if file not found\n   */\n  async getMetadata(filePath: string): Promise<FileMetadata | null> {\n    try {\n      const result = await head(filePath, {\n        token: this.resolvedConfig.token,\n      });\n\n      // Extract filename from pathname\n      const filename = result.pathname.split(\"/\").pop() || result.pathname;\n\n      return {\n        id: filePath,\n        filename,\n        originalFilename: filename,\n        mimeType: result.contentType,\n        size: result.size,\n        url: result.url,\n        createdAt: result.uploadedAt.toISOString(),\n      };\n    } catch {\n      // File not found\n      return null;\n    }\n  }\n\n  /**\n   * Generate pre-signed URL for client-side uploads.\n   *\n   * Vercel Blob uses a different pattern for client uploads - they require\n   * the handleUpload API which handles token generation server-side.\n   *\n   * This method is not implemented because Vercel Blob's client upload flow\n   * requires server-side route handlers with handleUpload().\n   *\n   * @see https://vercel.com/docs/storage/vercel-blob/client-upload\n   * @throws Error always - client uploads require handleUpload API\n   */\n  getPresignedUploadUrl(\n    _key: string,\n    _mimeType: string,\n    _expiresIn?: number\n  ): Promise<ClientUploadData> {\n    return Promise.reject(\n      new Error(\n        \"@nextly/storage-vercel-blob: Client uploads require the handleUpload API.\\n\\n\" +\n          \"Vercel Blob uses a different pattern for client-side uploads that involves:\\n\" +\n          \"1. A server-side route handler with handleUpload()\\n\" +\n          \"2. The @vercel/blob/client upload() function\\n\\n\" +\n          \"See: https://vercel.com/docs/storage/vercel-blob/client-upload\\n\\n\" +\n          \"For server-side uploads, use the standard upload() method instead.\"\n      )\n    );\n  }\n\n  // ============================================================\n  // Additional Methods\n  // ============================================================\n\n  /**\n   * List blobs with optional prefix filter.\n   *\n   * Useful for browsing or batch operations on stored files.\n   *\n   * @param prefix - Optional prefix to filter results\n   * @param options - List options (limit, cursor)\n   * @returns List of blob metadata\n   */\n  async listBlobs(\n    prefix?: string,\n    options?: { limit?: number; cursor?: string }\n  ): Promise<{\n    blobs: Array<{\n      url: string;\n      pathname: string;\n      size: number;\n      uploadedAt: Date;\n    }>;\n    hasMore: boolean;\n    cursor?: string;\n  }> {\n    const result = await list({\n      token: this.resolvedConfig.token,\n      prefix,\n      limit: options?.limit,\n      cursor: options?.cursor,\n    });\n\n    return {\n      blobs: result.blobs.map(blob => ({\n        url: blob.url,\n        pathname: blob.pathname,\n        size: blob.size,\n        uploadedAt: blob.uploadedAt,\n      })),\n      hasMore: result.hasMore,\n      cursor: result.cursor,\n    };\n  }\n\n  // ============================================================\n  // Helper Methods\n  // ============================================================\n\n  /**\n   * Build pathname for Vercel Blob upload.\n   *\n   * Creates pathname in format: {folder}/{filename}\n   * If no folder is provided, uses the filename directly.\n   *\n   * @param filename - Original filename (will be sanitized)\n   * @param folder - Optional folder/prefix for organizing uploads\n   * @returns Generated pathname\n   * @throws Error if folder fails sanitization\n   */\n  private buildPathname(filename: string, folder?: string): string {\n    const sanitized = this.sanitizeFilename(filename);\n    if (!folder) return sanitized;\n    return `${this.sanitizeFolder(folder)}/${sanitized}`;\n  }\n\n  /**\n   * Sanitize filename to prevent path traversal issues.\n   *\n   * @param filename - Original filename\n   * @returns Sanitized filename\n   */\n  private sanitizeFilename(filename: string): string {\n    const basename = filename.split(/[/\\\\]/).pop() || filename;\n    return basename.replace(/[^a-zA-Z0-9._-]/g, \"-\");\n  }\n\n  /**\n   * Reject folder values that would let a caller\n   * escape the configured prefix via path traversal or weird\n   * separators. Vercel Blob is flat-keyed so `/` is just part of the\n   * pathname, but an attacker who controls `folder` could still:\n   *\n   *   - Use `..` to chain a relative-traversal-style key.\n   *   - Use `\\` (Windows separator) to confuse downstream tooling.\n   *   - Use control chars / null bytes to truncate the key.\n   *   - Use a leading `/` to look like an absolute path.\n   *\n   * Internal `/` segments stay allowed because callers legitimately\n   * use nested folders (`docs/2026/...`); a leading `/`, empty\n   * segments (`docs//x`), or `..` segments are rejected.\n   *\n   * @throws Error with a stable message so the storage facade can\n   *   surface a 400 instead of a 500.\n   */\n  private sanitizeFolder(folder: string): string {\n    const trimmed = folder.replace(/\\/+$/, \"\"); // tolerate one trailing `/`\n    if (!trimmed) {\n      throw new Error(\"Folder must be a non-empty string.\");\n    }\n    // eslint-disable-next-line no-control-regex -- the whole point is to reject control chars\n    if (/[\\\\\\0\\x01-\\x1f\\x7f]/.test(trimmed)) {\n      throw new Error(\n        \"Folder contains forbidden characters (backslash, control chars, or null bytes).\"\n      );\n    }\n    if (trimmed.startsWith(\"/\")) {\n      throw new Error(\"Folder must not start with `/`.\");\n    }\n    const segments = trimmed.split(\"/\");\n    for (const segment of segments) {\n      if (segment === \"\") {\n        throw new Error(\"Folder must not contain empty segments (`//`).\");\n      }\n      if (segment === \"..\") {\n        throw new Error(\"Folder must not contain `..` segments.\");\n      }\n    }\n    return trimmed;\n  }\n\n  // ============================================================\n  // Public Accessors\n  // ============================================================\n\n  /**\n   * Get the configured token (masked for logging).\n   */\n  getTokenMasked(): string {\n    const token = this.resolvedConfig.token;\n    if (token.length <= 8) return \"****\";\n    return `${token.slice(0, 4)}...${token.slice(-4)}`;\n  }\n\n  /**\n   * Check if random suffix is enabled.\n   */\n  hasRandomSuffix(): boolean {\n    return this.resolvedConfig.addRandomSuffix;\n  }\n\n  /**\n   * Get configured cache control max age.\n   */\n  getCacheControlMaxAge(): number {\n    return this.resolvedConfig.cacheControlMaxAge;\n  }\n}\n","/**\n * Vercel Blob Storage Plugin\n *\n * Factory function that creates a storage plugin for Vercel Blob Storage.\n * Returns a StoragePlugin that can be registered with MediaStorage.\n *\n * @example Basic usage\n * ```typescript\n * import { vercelBlobStorage } from '@nextly/storage-vercel-blob'\n * import { defineConfig } from 'nextly/config'\n *\n * export default defineConfig({\n *   storage: [\n *     vercelBlobStorage({\n *       token: process.env.BLOB_READ_WRITE_TOKEN,\n *       collections: {\n *         media: true\n *       }\n *     })\n *   ]\n * })\n * ```\n *\n * @example With client uploads (recommended for Vercel)\n * ```typescript\n * vercelBlobStorage({\n *   collections: {\n *     media: {\n *       clientUploads: true // Bypass 4.5MB serverless limit\n *     }\n *   }\n * })\n * ```\n *\n * @example With collection-specific configuration\n * ```typescript\n * vercelBlobStorage({\n *   addRandomSuffix: true,\n *   cacheControlMaxAge: 86400, // 1 day\n *   collections: {\n *     // Simple enable with defaults\n *     media: true,\n *\n *     // Full configuration\n *     documents: {\n *       prefix: 'docs/',\n *       addRandomSuffix: false,\n *       allowOverwrite: true\n *     }\n *   }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { StoragePlugin, ClientUploadData } from \"nextly/storage\";\n\nimport { VercelBlobStorageAdapter } from \"./adapter\";\nimport type { VercelBlobStorageConfig } from \"./types\";\n\n// ============================================================\n// Plugin Factory Function\n// ============================================================\n\n/**\n * Create a Vercel Blob storage plugin for Nextly.\n *\n * This factory function creates a StoragePlugin that can be added to\n * the `storage` array in `nextly.config.ts`. Vercel Blob is optimized\n * for Vercel deployments with:\n *\n * - Global CDN distribution\n * - Simple token-based authentication\n * - Client-side upload support (via handleUpload API)\n * - Automatic file management\n *\n * @param config - Vercel Blob storage configuration\n * @returns A StoragePlugin that MediaStorage can register\n *\n * @throws Error if token is not provided (via adapter)\n */\nexport function vercelBlobStorage(\n  config: VercelBlobStorageConfig\n): StoragePlugin {\n  // Handle disabled plugin\n  // When disabled, return a plugin with no collections and null adapter\n  // MediaStorage.registerPlugin() checks for null adapter and skips registration\n  if (config.enabled === false) {\n    return {\n      name: \"vercel-blob-storage\",\n      type: \"vercel-blob\",\n      collections: {},\n      adapter: null as unknown as StoragePlugin[\"adapter\"],\n    };\n  }\n\n  // Create the Vercel Blob adapter\n  // Adapter constructor validates required config (token)\n  const adapter = new VercelBlobStorageAdapter(config);\n\n  // Build and return the plugin\n  const plugin: StoragePlugin = {\n    name: \"vercel-blob-storage\",\n    type: \"vercel-blob\",\n    collections: config.collections,\n    adapter,\n\n    /**\n     * Generate upload URL for client-side uploads.\n     *\n     * Note: Vercel Blob uses a different pattern for client uploads.\n     * Instead of pre-signed URLs, it uses the handleUpload() API which\n     * requires server-side route handlers.\n     *\n     * This method throws an error explaining the correct approach.\n     *\n     * @see https://vercel.com/docs/storage/vercel-blob/client-upload\n     */\n    getClientUploadUrl(\n      _filename: string,\n      _mimeType: string,\n      _collection: string\n    ): Promise<ClientUploadData> {\n      // Vercel Blob doesn't use pre-signed URLs like S3\n      // Instead, it requires using the handleUpload API with @vercel/blob/client\n      return Promise.reject(\n        new Error(\n          \"@nextly/storage-vercel-blob: Client uploads require the handleUpload API.\\n\\n\" +\n            \"Vercel Blob uses a different pattern than S3 for client-side uploads:\\n\\n\" +\n            \"1. Create a server-side route handler with handleUpload()\\n\" +\n            \"2. Use upload() from @vercel/blob/client on the frontend\\n\\n\" +\n            \"See: https://vercel.com/docs/storage/vercel-blob/client-upload\"\n        )\n      );\n    },\n\n    /**\n     * Get signed download URL for file access.\n     *\n     * Note: Vercel Blob URLs are public by default and do not support\n     * signed/temporary URLs. All uploaded blobs are accessible via their\n     * public URL.\n     *\n     * @param path - Storage path (full blob URL)\n     * @returns The same URL (Vercel Blob URLs are public)\n     */\n    getSignedDownloadUrl(path: string): Promise<string> {\n      // Vercel Blob URLs are public by default\n      // No signed URL support - just return the public URL\n      return Promise.resolve(path);\n    },\n  };\n\n  return plugin;\n}\n","/**\n * @nextly/storage-vercel-blob\n *\n * Vercel Blob storage adapter for Nextly CMS.\n * Optimized for Vercel deployments with client-side upload support\n * to bypass serverless function size limits (4.5MB).\n *\n * @example Basic usage\n * ```typescript\n * import { vercelBlobStorage } from '@nextly/storage-vercel-blob'\n * import { defineConfig } from 'nextly/config'\n *\n * export default defineConfig({\n *   storage: [\n *     vercelBlobStorage({\n *       token: process.env.BLOB_READ_WRITE_TOKEN,\n *       collections: {\n *         media: true\n *       }\n *     })\n *   ]\n * })\n * ```\n *\n * @example With client uploads (recommended for Vercel)\n * ```typescript\n * vercelBlobStorage({\n *   collections: {\n *     media: {\n *       clientUploads: true // Bypass 4.5MB serverless limit\n *     }\n *   }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\n// ============================================================\n// Vercel Blob Storage Plugin Export (Primary API)\n// ============================================================\n\nexport { vercelBlobStorage } from \"./plugin\";\n\n// ============================================================\n// Vercel Blob Storage Adapter Export\n// ============================================================\n\nexport { VercelBlobStorageAdapter } from \"./adapter\";\n\n// ============================================================\n// Vercel Blob Types Export\n// ============================================================\n\nexport type {\n  VercelBlobStorageConfig,\n  VercelBlobCollectionConfig,\n  VercelBlobCollectionStorageMap,\n  ResolvedVercelBlobConfig,\n} from \"./types\";\n\n// ============================================================\n// Package Metadata\n// ============================================================\n\nexport const PACKAGE_NAME = \"@nextly/storage-vercel-blob\";\nexport const PACKAGE_VERSION = \"0.1.0\";\n"]}