@nixxie-cms/storage 1.0.1

package/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Nixxie International DMCC
+Portions Copyright (c) 2023 Thinkmill Labs Pty Ltd and contributors
+(this software is derived from the KeystoneJS project, https://keystonejs.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# @nixxie-cms/storage
+
+Pluggable blob storage for Nixxie CMS. One interface, four drivers: local disk, AWS S3
+(and S3-compatible services like Cloudflare R2, MinIO, DigitalOcean Spaces), Google Cloud
+Storage, and Azure Blob Storage.
+
+```ts
+import { config } from '@nixxie-cms/core'
+import { createStorage } from '@nixxie-cms/storage'
+
+export default config({
+  storage: createStorage({
+    driver: 's3',
+    bucket: 'my-bucket',
+    region: 'us-east-1',
+  }),
+  // ...
+})
+```
+
+Once configured it is available everywhere as `context.services.storage`:
+
+```ts
+const file = await context.services.storage.put('avatars/1.png', buffer, {
+  contentType: 'image/png',
+  public: true,
+})
+const url = await context.services.storage.signedUrl('avatars/1.png', { expiresIn: 3600 })
+```
+
+## Drivers
+
+| driver  | extra dependency |
+| ------- | ---------------- |
+| `local` | none |
+| `s3`    | `@aws-sdk/client-s3`, `@aws-sdk/s3-request-presigner` |
+| `gcs`   | `@google-cloud/storage` |
+| `azure` | `@azure/storage-blob` |
+
+Driver dependencies are loaded lazily, so you only install the one you use.
+
+## API
+
+`put`, `get`, `delete`, `has`, `url`, `signedUrl`, `list` — see `NixxieStorageService`.

package/dist/declarations/src/AzureStorage.d.ts

@@ -0,0 +1,18 @@
+import type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile } from '@nixxie-cms/core';
+import type { AzureStorageConfig } from "./types.js";
+/** Azure Blob Storage backend. */
+export declare class AzureStorage implements NixxieStorageService {
+    private config;
+    private prefix;
+    private container;
+    constructor(config: AzureStorageConfig);
+    private blob;
+    put(key: string, data: Buffer | Uint8Array | string, options?: NixxiePutOptions): Promise<NixxieStoredFile>;
+    get(key: string): Promise<Buffer | undefined>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+    url(key: string): string;
+    signedUrl(key: string, options?: NixxieSignedUrlOptions): Promise<string>;
+    list(prefix?: string): Promise<string[]>;
+}
+//# sourceMappingURL=AzureStorage.d.ts.map

package/dist/declarations/src/AzureStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AzureStorage.d.ts","sourceRoot":"../../../src","sources":["AzureStorage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAe;AAYjD,kCAAkC;AAClC,qBAAa,YAAa,YAAW,oBAAoB;IACvD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,SAAS,CAAK;gBAEV,MAAM,EAAE,kBAAkB;IAQtC,OAAO,CAAC,IAAI;IAIN,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAStB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAS7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMlB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAQ3C"}

package/dist/declarations/src/GcsStorage.d.ts

@@ -0,0 +1,18 @@
+import type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile } from '@nixxie-cms/core';
+import type { GcsStorageConfig } from "./types.js";
+/** Google Cloud Storage backend. */
+export declare class GcsStorage implements NixxieStorageService {
+    private config;
+    private prefix;
+    private bucket;
+    constructor(config: GcsStorageConfig);
+    private file;
+    put(key: string, data: Buffer | Uint8Array | string, options?: NixxiePutOptions): Promise<NixxieStoredFile>;
+    get(key: string): Promise<Buffer | undefined>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+    url(key: string): string;
+    signedUrl(key: string, options?: NixxieSignedUrlOptions): Promise<string>;
+    list(prefix?: string): Promise<string[]>;
+}
+//# sourceMappingURL=GcsStorage.d.ts.map

package/dist/declarations/src/GcsStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GcsStorage.d.ts","sourceRoot":"../../../src","sources":["GcsStorage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAe;AAY/C,oCAAoC;AACpC,qBAAa,UAAW,YAAW,oBAAoB;IACrD,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAK;gBAEP,MAAM,EAAE,gBAAgB;IAQpC,OAAO,CAAC,IAAI;IAIN,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAWtB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAU7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMlB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC;IASzE,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAM3C"}

package/dist/declarations/src/LocalStorage.d.ts

@@ -0,0 +1,20 @@
+import type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile } from '@nixxie-cms/core';
+import type { LocalStorageConfig } from "./types.js";
+/**
+ * Filesystem-backed storage. Good for development and single-node deployments.
+ * `signedUrl()` falls back to the plain public URL since the local disk cannot sign.
+ */
+export declare class LocalStorage implements NixxieStorageService {
+    private baseDir;
+    private baseUrl;
+    constructor(config: LocalStorageConfig);
+    private path;
+    put(key: string, data: Buffer | Uint8Array | string, options?: NixxiePutOptions): Promise<NixxieStoredFile>;
+    get(key: string): Promise<Buffer | undefined>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+    url(key: string): string;
+    signedUrl(key: string, _options?: NixxieSignedUrlOptions): Promise<string>;
+    list(prefix?: string): Promise<string[]>;
+}
+//# sourceMappingURL=LocalStorage.d.ts.map

package/dist/declarations/src/LocalStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalStorage.d.ts","sourceRoot":"../../../src","sources":["LocalStorage.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAe;AAEjD;;;GAGG;AACH,qBAAa,YAAa,YAAW,oBAAoB;IACvD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;gBAEX,MAAM,EAAE,kBAAkB;IAKtC,OAAO,CAAC,IAAI;IAWN,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAatB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAM7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIlB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC;IAI1E,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAmB3C"}

package/dist/declarations/src/S3Storage.d.ts

@@ -0,0 +1,20 @@
+import type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile } from '@nixxie-cms/core';
+import type { S3StorageConfig } from "./types.js";
+/** AWS S3 (and S3-compatible: R2, MinIO, Spaces) storage backend. */
+export declare class S3Storage implements NixxieStorageService {
+    private config;
+    private prefix;
+    private client;
+    private s3;
+    private presigner;
+    constructor(config: S3StorageConfig);
+    private k;
+    put(key: string, data: Buffer | Uint8Array | string, options?: NixxiePutOptions): Promise<NixxieStoredFile>;
+    get(key: string): Promise<Buffer | undefined>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+    url(key: string): string;
+    signedUrl(key: string, options?: NixxieSignedUrlOptions): Promise<string>;
+    list(prefix?: string): Promise<string[]>;
+}
+//# sourceMappingURL=S3Storage.d.ts.map

package/dist/declarations/src/S3Storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Storage.d.ts","sourceRoot":"../../../src","sources":["S3Storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAe;AAkB9C,qEAAqE;AACrE,qBAAa,SAAU,YAAW,oBAAoB;IACpD,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,SAAS,CAAiB;gBAEtB,MAAM,EAAE,eAAe;IAiBnC,OAAO,CAAC,CAAC;IAIH,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAetB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAa7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IASlB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC;IAczE,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAY3C"}

package/dist/declarations/src/index.d.ts

@@ -0,0 +1,10 @@
+import type { StorageConfig } from "./types.js";
+import { AzureStorage } from "./AzureStorage.js";
+import { GcsStorage } from "./GcsStorage.js";
+import { LocalStorage } from "./LocalStorage.js";
+import { S3Storage } from "./S3Storage.js";
+export declare function createStorage(config: StorageConfig): LocalStorage | S3Storage | GcsStorage | AzureStorage;
+export { LocalStorage, S3Storage, GcsStorage, AzureStorage };
+export type { StorageConfig, LocalStorageConfig, S3StorageConfig, GcsStorageConfig, AzureStorageConfig, } from "./types.js";
+export type { NixxieStorageService, NixxieStoredFile, NixxiePutOptions, NixxieSignedUrlOptions, } from '@nixxie-cms/core';
+//# sourceMappingURL=index.d.ts.map

package/dist/declarations/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"../../../src","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAe;AAC5C,OAAO,EAAE,YAAY,EAAE,0BAAsB;AAC7C,OAAO,EAAE,UAAU,EAAE,wBAAoB;AACzC,OAAO,EAAE,YAAY,EAAE,0BAAsB;AAC7C,OAAO,EAAE,SAAS,EAAE,uBAAmB;AAEvC,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,GACpB,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAetD;AAED,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;AAC5D,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,mBAAe;AAChB,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA"}

package/dist/declarations/src/types.d.ts

@@ -0,0 +1,54 @@
+import type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile } from '@nixxie-cms/core';
+export type { NixxiePutOptions, NixxieSignedUrlOptions, NixxieStorageService, NixxieStoredFile };
+export type LocalStorageConfig = {
+    driver: 'local';
+    /** Directory on disk where files are written. Default: '.nixxie-storage' */
+    baseDir?: string;
+    /** Public URL prefix that maps to `baseDir`, e.g. 'http://localhost:3000/files'. Default: '/files' */
+    baseUrl?: string;
+};
+export type S3StorageConfig = {
+    driver: 's3';
+    /** Target bucket name. */
+    bucket: string;
+    /** AWS region. */
+    region?: string;
+    /** Access key id — falls back to the AWS SDK default credential chain when omitted. */
+    accessKeyId?: string;
+    /** Secret access key. */
+    secretAccessKey?: string;
+    /** Custom endpoint (for S3-compatible services like R2, MinIO, Spaces). */
+    endpoint?: string;
+    /** Force path-style addressing (required by most S3-compatible services). */
+    forcePathStyle?: boolean;
+    /** Key prefix applied to every object. */
+    prefix?: string;
+    /** Public base URL used by `url()` when objects are public / served via CDN. */
+    publicBaseUrl?: string;
+};
+export type GcsStorageConfig = {
+    driver: 'gcs';
+    /** Target bucket name. */
+    bucket: string;
+    /** GCP project id. */
+    projectId?: string;
+    /** Path to a service-account key file. */
+    keyFilename?: string;
+    /** Key prefix applied to every object. */
+    prefix?: string;
+    /** Public base URL used by `url()`. */
+    publicBaseUrl?: string;
+};
+export type AzureStorageConfig = {
+    driver: 'azure';
+    /** Blob container name. */
+    container: string;
+    /** Full connection string for the storage account. */
+    connectionString: string;
+    /** Key prefix applied to every blob. */
+    prefix?: string;
+    /** Public base URL used by `url()`. */
+    publicBaseUrl?: string;
+};
+export type StorageConfig = LocalStorageConfig | S3StorageConfig | GcsStorageConfig | AzureStorageConfig;
+//# sourceMappingURL=types.d.ts.map

package/dist/declarations/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"../../../src","sources":["types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAA;AAEhG,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,IAAI,CAAA;IACZ,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,KAAK,CAAA;IACb,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAA;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,eAAe,GACf,gBAAgB,GAChB,kBAAkB,CAAA"}

package/dist/nixxie-cms-storage.cjs.d.ts

@@ -0,0 +1,2 @@
+export * from "./declarations/src/index.js";
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibml4eGllLWNtcy1zdG9yYWdlLmNqcy5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi9kZWNsYXJhdGlvbnMvc3JjL2luZGV4LmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEifQ==

package/dist/nixxie-cms-storage.cjs.js

@@ -0,0 +1,399 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var node_fs = require('node:fs');
+var promises = require('node:fs/promises');
+var node_path = require('node:path');
+
+function loadAzure() {
+  try {
+    return require('@azure/storage-blob');
+  } catch {
+    throw new Error('@azure/storage-blob is required for the Azure driver. Run: npm install @azure/storage-blob');
+  }
+}
+
+/** Azure Blob Storage backend. */
+class AzureStorage {
+  constructor(config) {
+    this.config = config;
+    this.prefix = config.prefix ? config.prefix.replace(/\/$/, '') + '/' : '';
+    const {
+      BlobServiceClient
+    } = loadAzure();
+    const service = BlobServiceClient.fromConnectionString(config.connectionString);
+    this.container = service.getContainerClient(config.container);
+  }
+  blob(key) {
+    return this.container.getBlockBlobClient(`${this.prefix}${key}`);
+  }
+  async put(key, data, options) {
+    const body = typeof data === 'string' ? Buffer.from(data) : Buffer.from(data);
+    await this.blob(key).uploadData(body, {
+      blobHTTPHeaders: options !== null && options !== void 0 && options.contentType ? {
+        blobContentType: options.contentType
+      } : undefined,
+      metadata: options === null || options === void 0 ? void 0 : options.metadata
+    });
+    return {
+      key,
+      url: this.url(key),
+      size: body.byteLength,
+      contentType: options === null || options === void 0 ? void 0 : options.contentType
+    };
+  }
+  async get(key) {
+    try {
+      return await this.blob(key).downloadToBuffer();
+    } catch (err) {
+      if ((err === null || err === void 0 ? void 0 : err.statusCode) === 404) return undefined;
+      throw err;
+    }
+  }
+  async delete(key) {
+    await this.blob(key).deleteIfExists();
+  }
+  async has(key) {
+    return Boolean(await this.blob(key).exists());
+  }
+  url(key) {
+    if (this.config.publicBaseUrl) return `${this.config.publicBaseUrl.replace(/\/$/, '')}/${this.prefix}${key}`;
+    return this.blob(key).url;
+  }
+  async signedUrl(key, options) {
+    var _credential, _options$expiresIn;
+    const {
+      BlobSASPermissions,
+      generateBlobSASQueryParameters
+    } = loadAzure();
+    const blob = this.blob(key);
+    const credential = (_credential = this.container.credential) !== null && _credential !== void 0 ? _credential : blob.credential;
+    const expiresOn = new Date(Date.now() + ((_options$expiresIn = options === null || options === void 0 ? void 0 : options.expiresIn) !== null && _options$expiresIn !== void 0 ? _options$expiresIn : 900) * 1000);
+    const permissions = BlobSASPermissions.parse((options === null || options === void 0 ? void 0 : options.operation) === 'put' ? 'cw' : 'r');
+    try {
+      const sas = generateBlobSASQueryParameters({
+        containerName: this.config.container,
+        blobName: `${this.prefix}${key}`,
+        permissions,
+        expiresOn
+      }, credential).toString();
+      return `${blob.url}?${sas}`;
+    } catch {
+      // Falls back to the plain URL when SAS generation is unavailable (e.g. token credential).
+      return blob.url;
+    }
+  }
+  async list(prefix = '') {
+    const out = [];
+    for await (const item of this.container.listBlobsFlat({
+      prefix: `${this.prefix}${prefix}`
+    })) {
+      const name = item.name;
+      out.push(this.prefix && name.startsWith(this.prefix) ? name.slice(this.prefix.length) : name);
+    }
+    return out;
+  }
+}
+
+function loadGcs() {
+  try {
+    return require('@google-cloud/storage');
+  } catch {
+    throw new Error('@google-cloud/storage is required for the GCS driver. Run: npm install @google-cloud/storage');
+  }
+}
+
+/** Google Cloud Storage backend. */
+class GcsStorage {
+  constructor(config) {
+    this.config = config;
+    this.prefix = config.prefix ? config.prefix.replace(/\/$/, '') + '/' : '';
+    const {
+      Storage
+    } = loadGcs();
+    const client = new Storage({
+      projectId: config.projectId,
+      keyFilename: config.keyFilename
+    });
+    this.bucket = client.bucket(config.bucket);
+  }
+  file(key) {
+    return this.bucket.file(`${this.prefix}${key}`);
+  }
+  async put(key, data, options) {
+    const body = typeof data === 'string' ? Buffer.from(data) : Buffer.from(data);
+    const file = this.file(key);
+    await file.save(body, {
+      contentType: options === null || options === void 0 ? void 0 : options.contentType,
+      metadata: options !== null && options !== void 0 && options.metadata ? {
+        metadata: options.metadata
+      } : undefined
+    });
+    if (options !== null && options !== void 0 && options.public) await file.makePublic();
+    return {
+      key,
+      url: this.url(key),
+      size: body.byteLength,
+      contentType: options === null || options === void 0 ? void 0 : options.contentType
+    };
+  }
+  async get(key) {
+    try {
+      const [contents] = await this.file(key).download();
+      return contents;
+    } catch (err) {
+      if ((err === null || err === void 0 ? void 0 : err.code) === 404) return undefined;
+      throw err;
+    }
+  }
+  async delete(key) {
+    await this.file(key).delete({
+      ignoreNotFound: true
+    });
+  }
+  async has(key) {
+    const [exists] = await this.file(key).exists();
+    return Boolean(exists);
+  }
+  url(key) {
+    if (this.config.publicBaseUrl) return `${this.config.publicBaseUrl.replace(/\/$/, '')}/${this.prefix}${key}`;
+    return `https://storage.googleapis.com/${this.config.bucket}/${this.prefix}${key}`;
+  }
+  async signedUrl(key, options) {
+    var _options$expiresIn;
+    const [url] = await this.file(key).getSignedUrl({
+      action: (options === null || options === void 0 ? void 0 : options.operation) === 'put' ? 'write' : 'read',
+      expires: Date.now() + ((_options$expiresIn = options === null || options === void 0 ? void 0 : options.expiresIn) !== null && _options$expiresIn !== void 0 ? _options$expiresIn : 900) * 1000,
+      contentType: (options === null || options === void 0 ? void 0 : options.operation) === 'put' ? options === null || options === void 0 ? void 0 : options.contentType : undefined
+    });
+    return url;
+  }
+  async list(prefix = '') {
+    const [files] = await this.bucket.getFiles({
+      prefix: `${this.prefix}${prefix}`
+    });
+    return files.map(f => f.name).map(k => this.prefix && k.startsWith(this.prefix) ? k.slice(this.prefix.length) : k);
+  }
+}
+
+/**
+ * Filesystem-backed storage. Good for development and single-node deployments.
+ * `signedUrl()` falls back to the plain public URL since the local disk cannot sign.
+ */
+class LocalStorage {
+  constructor(config) {
+    var _config$baseDir, _config$baseUrl;
+    this.baseDir = (_config$baseDir = config.baseDir) !== null && _config$baseDir !== void 0 ? _config$baseDir : '.nixxie-storage';
+    this.baseUrl = ((_config$baseUrl = config.baseUrl) !== null && _config$baseUrl !== void 0 ? _config$baseUrl : '/files').replace(/\/$/, '');
+  }
+  path(key) {
+    // Confine resolved paths to baseDir so keys like "../../etc/passwd" (or absolute paths)
+    // cannot escape the storage root.
+    const root = node_path.resolve(this.baseDir);
+    const full = node_path.resolve(root, key);
+    if (full !== root && !full.startsWith(root + node_path.sep)) {
+      throw new Error(`Invalid storage key (path traversal detected): ${key}`);
+    }
+    return full;
+  }
+  async put(key, data, options) {
+    const filePath = this.path(key);
+    await promises.mkdir(node_path.dirname(filePath), {
+      recursive: true
+    });
+    const buffer = typeof data === 'string' ? Buffer.from(data) : Buffer.from(data);
+    await promises.writeFile(filePath, buffer);
+    return {
+      key,
+      url: this.url(key),
+      size: buffer.byteLength,
+      contentType: options === null || options === void 0 ? void 0 : options.contentType
+    };
+  }
+  async get(key) {
+    const filePath = this.path(key);
+    if (!node_fs.existsSync(filePath)) return undefined;
+    return promises.readFile(filePath);
+  }
+  async delete(key) {
+    await promises.rm(this.path(key), {
+      force: true
+    });
+  }
+  async has(key) {
+    try {
+      await promises.stat(this.path(key));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  url(key) {
+    return `${this.baseUrl}/${key.split(node_path.sep).join('/')}`;
+  }
+  async signedUrl(key, _options) {
+    return this.url(key);
+  }
+  async list(prefix = '') {
+    const root = this.baseDir;
+    const out = [];
+    const walk = async dir => {
+      let entries;
+      try {
+        entries = await promises.readdir(dir, {
+          withFileTypes: true
+        });
+      } catch {
+        return;
+      }
+      for (const entry of entries) {
+        const full = node_path.join(dir, entry.name);
+        if (entry.isDirectory()) await walk(full);else out.push(node_path.relative(root, full).split(node_path.sep).join(node_path.posix.sep));
+      }
+    };
+    await walk(root);
+    return out.filter(k => k.startsWith(prefix));
+  }
+}
+
+function loadS3() {
+  try {
+    return {
+      s3: require('@aws-sdk/client-s3'),
+      presigner: require('@aws-sdk/s3-request-presigner')
+    };
+  } catch {
+    throw new Error('@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner are required for the S3 driver. Run: npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner');
+  }
+}
+
+/** AWS S3 (and S3-compatible: R2, MinIO, Spaces) storage backend. */
+class S3Storage {
+  constructor(config) {
+    this.config = config;
+    this.prefix = config.prefix ? config.prefix.replace(/\/$/, '') + '/' : '';
+    const {
+      s3,
+      presigner
+    } = loadS3();
+    this.s3 = s3;
+    this.presigner = presigner;
+    this.client = new s3.S3Client({
+      region: config.region,
+      endpoint: config.endpoint,
+      forcePathStyle: config.forcePathStyle,
+      credentials: config.accessKeyId && config.secretAccessKey ? {
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey
+      } : undefined
+    });
+  }
+  k(key) {
+    return `${this.prefix}${key}`;
+  }
+  async put(key, data, options) {
+    const body = typeof data === 'string' ? Buffer.from(data) : Buffer.from(data);
+    await this.client.send(new this.s3.PutObjectCommand({
+      Bucket: this.config.bucket,
+      Key: this.k(key),
+      Body: body,
+      ContentType: options === null || options === void 0 ? void 0 : options.contentType,
+      ACL: options !== null && options !== void 0 && options.public ? 'public-read' : undefined,
+      Metadata: options === null || options === void 0 ? void 0 : options.metadata
+    }));
+    return {
+      key,
+      url: this.url(key),
+      size: body.byteLength,
+      contentType: options === null || options === void 0 ? void 0 : options.contentType
+    };
+  }
+  async get(key) {
+    try {
+      var _res$Body;
+      const res = await this.client.send(new this.s3.GetObjectCommand({
+        Bucket: this.config.bucket,
+        Key: this.k(key)
+      }));
+      const bytes = await ((_res$Body = res.Body) === null || _res$Body === void 0 ? void 0 : _res$Body.transformToByteArray());
+      return bytes ? Buffer.from(bytes) : undefined;
+    } catch (err) {
+      var _err$$metadata;
+      if ((err === null || err === void 0 ? void 0 : err.name) === 'NoSuchKey' || (err === null || err === void 0 || (_err$$metadata = err.$metadata) === null || _err$$metadata === void 0 ? void 0 : _err$$metadata.httpStatusCode) === 404) return undefined;
+      throw err;
+    }
+  }
+  async delete(key) {
+    await this.client.send(new this.s3.DeleteObjectCommand({
+      Bucket: this.config.bucket,
+      Key: this.k(key)
+    }));
+  }
+  async has(key) {
+    try {
+      await this.client.send(new this.s3.HeadObjectCommand({
+        Bucket: this.config.bucket,
+        Key: this.k(key)
+      }));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  url(key) {
+    var _this$config$region;
+    if (this.config.publicBaseUrl) return `${this.config.publicBaseUrl.replace(/\/$/, '')}/${this.k(key)}`;
+    const host = this.config.endpoint ? `${this.config.endpoint.replace(/\/$/, '')}/${this.config.bucket}` : `https://${this.config.bucket}.s3.${(_this$config$region = this.config.region) !== null && _this$config$region !== void 0 ? _this$config$region : 'us-east-1'}.amazonaws.com`;
+    return `${host}/${this.k(key)}`;
+  }
+  async signedUrl(key, options) {
+    var _options$expiresIn;
+    const command = (options === null || options === void 0 ? void 0 : options.operation) === 'put' ? new this.s3.PutObjectCommand({
+      Bucket: this.config.bucket,
+      Key: this.k(key),
+      ContentType: options.contentType
+    }) : new this.s3.GetObjectCommand({
+      Bucket: this.config.bucket,
+      Key: this.k(key)
+    });
+    return this.presigner.getSignedUrl(this.client, command, {
+      expiresIn: (_options$expiresIn = options === null || options === void 0 ? void 0 : options.expiresIn) !== null && _options$expiresIn !== void 0 ? _options$expiresIn : 900
+    });
+  }
+  async list(prefix = '') {
+    var _res$Contents;
+    const res = await this.client.send(new this.s3.ListObjectsV2Command({
+      Bucket: this.config.bucket,
+      Prefix: this.k(prefix)
+    }));
+    return ((_res$Contents = res.Contents) !== null && _res$Contents !== void 0 ? _res$Contents : []).map(o => {
+      var _o$Key;
+      return (_o$Key = o.Key) !== null && _o$Key !== void 0 ? _o$Key : '';
+    }).map(k => this.prefix && k.startsWith(this.prefix) ? k.slice(this.prefix.length) : k).filter(Boolean);
+  }
+}
+
+function createStorage(config) {
+  switch (config.driver) {
+    case 'local':
+      return new LocalStorage(config);
+    case 's3':
+      return new S3Storage(config);
+    case 'gcs':
+      return new GcsStorage(config);
+    case 'azure':
+      return new AzureStorage(config);
+    default:
+      {
+        const exhaustive = config;
+        throw new Error(`Unknown storage driver: ${exhaustive.driver}`);
+      }
+  }
+}
+
+exports.AzureStorage = AzureStorage;
+exports.GcsStorage = GcsStorage;
+exports.LocalStorage = LocalStorage;
+exports.S3Storage = S3Storage;
+exports.createStorage = createStorage;