@rebasepro/server 0.12.1-canary.g389e9b2 → 0.12.1-canary.g4e7bcbf

package/dist/{S3StorageController-CK7r5yZb.js → S3StorageController-B2EDXXMH.js}

@@ -202,7 +202,13 @@ var S3StorageController = class {
 			Bucket: resolvedBucket,
 			Key: resolvedPath
 		});
-		await client.send(command);
+		try {
+			await client.send(command);
+		} catch (error) {
+			const s3Error = error;
+			if (s3Error.name === "NoSuchKey" || s3Error.$metadata?.httpStatusCode === 404) return;
+			throw error;
+		}
 	}
 	async listObjects(prefix, options) {
 		const resolvedBucket = this.getBucket(options?.bucket);
@@ -240,4 +246,4 @@ var S3StorageController = class {
 //#endregion
 export { S3StorageController_exports as n, S3StorageController as t };
 
-//# sourceMappingURL=S3StorageController-CK7r5yZb.js.map
+//# sourceMappingURL=S3StorageController-B2EDXXMH.js.map

package/dist/{S3StorageController-CK7r5yZb.js.map → S3StorageController-B2EDXXMH.js.map}

@@ -1 +1 @@
-{"version":3,"file":"S3StorageController-CK7r5yZb.js","names":[],"sources":["../src/storage/S3StorageController.ts"],"sourcesContent":["/**\n * S3-compatible storage controller (works with AWS S3 and MinIO)\n */\n\nimport type { S3Client as S3ClientType, } from \"@aws-sdk/client-s3\";\nimport { DEFAULT_MAX_FILE_SIZE, S3StorageConfig, StorageController } from \"./types\";\nimport {\n    DownloadConfig,\n    DownloadMetadata,\n    StorageListResult,\n    StorageReference,\n    UploadFileProps,\n    UploadFileResult\n} from \"@rebasepro/types\";\n\nlet _s3Module: typeof import(\"@aws-sdk/client-s3\") | undefined;\nlet _presignerModule: typeof import(\"@aws-sdk/s3-request-presigner\") | undefined;\n\nasync function loadS3() {\n    if (!_s3Module) {\n        try {\n            _s3Module = await import(\"@aws-sdk/client-s3\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/client-s3 is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _s3Module;\n}\n\nasync function loadPresigner() {\n    if (!_presignerModule) {\n        try {\n            _presignerModule = await import(\"@aws-sdk/s3-request-presigner\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/s3-request-presigner is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _presignerModule;\n}\n\n/**\n * S3-compatible storage implementation\n * Works with AWS S3 and MinIO (with forcePathStyle option)\n */\nexport class S3StorageController implements StorageController {\n    private config: S3StorageConfig;\n    private _client: S3ClientType | undefined;\n\n    constructor(config: S3StorageConfig) {\n        this.config = config;\n    }\n\n    /**\n     * Lazily create and cache the S3 client on first use\n     */\n    private async getClient(): Promise<S3ClientType> {\n        if (!this._client) {\n            const s3 = await loadS3();\n            this._client = new s3.S3Client({\n                region: this.config.region || \"us-east-1\",\n                endpoint: this.config.endpoint,\n                forcePathStyle: this.config.forcePathStyle ?? !!this.config.endpoint, // Auto-enable for custom endpoints (MinIO)\n                credentials: {\n                    accessKeyId: this.config.accessKeyId,\n                    secretAccessKey: this.config.secretAccessKey\n                }\n            });\n        }\n        return this._client;\n    }\n\n    getType(): \"s3\" {\n        return \"s3\";\n    }\n\n    /**\n     * Validate file before upload\n     */\n    private validateFile(file: File): void {\n        const maxSize = this.config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n        if (file.size > maxSize) {\n            throw new Error(`File size ${file.size} exceeds maximum allowed size ${maxSize}`);\n        }\n\n        if (this.config.allowedMimeTypes && this.config.allowedMimeTypes.length > 0) {\n            if (!this.config.allowedMimeTypes.includes(file.type)) {\n                throw new Error(`File type ${file.type} is not allowed. Allowed types: ${this.config.allowedMimeTypes.join(\", \")}`);\n            }\n        }\n    }\n\n    /**\n     * Get the bucket name - either from parameter or config\n     */\n    private getBucket(bucket?: string): string {\n        // \"default\" is a logical bucket name used by local storage;\n        // for S3 it should resolve to the configured bucket.\n        if (!bucket || bucket === \"default\") return this.config.bucket;\n        return bucket;\n    }\n\n    async putObject({\n        file,\n        key,\n        metadata,\n        bucket\n    }: UploadFileProps): Promise<UploadFileResult> {\n        this.validateFile(file);\n\n        const usedBucket = this.getBucket(bucket);\n\n        // Convert File to Buffer\n        const arrayBuffer = await file.arrayBuffer();\n        const buffer = Buffer.from(arrayBuffer);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.PutObjectCommand({\n            Bucket: usedBucket,\n            Key: key,\n            Body: buffer,\n            ContentType: file.type,\n            Metadata: metadata ? this.flattenMetadata(metadata) : undefined\n        });\n\n        await client.send(command);\n\n        return {\n            key,\n            bucket: usedBucket,\n            storageUrl: `s3://${usedBucket}/${key}`\n        };\n    }\n\n    /**\n     * Flatten nested metadata to string values (S3 requirement)\n     */\n    private flattenMetadata(metadata: Record<string, unknown>): Record<string, string> {\n        const flattened: Record<string, string> = {};\n        for (const [key, value] of Object.entries(metadata)) {\n            if (typeof value === \"string\") {\n                flattened[key] = value;\n            } else if (value !== undefined && value !== null) {\n                flattened[key] = JSON.stringify(value);\n            }\n        }\n        return flattened;\n    }\n\n    async getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig> {\n        // Handle s3:// and gs:// URLs for backward compatibility\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const presigner = await loadPresigner();\n            const client = await this.getClient();\n\n            // First check if the object exists and get metadata\n            const headCommand = new s3.HeadObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const headResult = await client.send(headCommand);\n\n            // Generate a signed URL\n            const getCommand = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const expiresIn = this.config.signedUrlExpiration ?? 3600;\n            const url = await presigner.getSignedUrl(client, getCommand, { expiresIn });\n\n            const metadata: DownloadMetadata = {\n                bucket: resolvedBucket,\n                fullPath: resolvedPath,\n                name: resolvedPath.split(\"/\").pop() || resolvedPath,\n                size: headResult.ContentLength || 0,\n                contentType: headResult.ContentType || \"application/octet-stream\",\n                customMetadata: headResult.Metadata || {}\n            };\n\n            return {\n                url,\n                metadata\n            };\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NotFound\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return {\n                    url: null,\n                    fileNotFound: true\n                };\n            }\n            throw error;\n        }\n    }\n\n    async getObject(key: string, bucket?: string): Promise<File | null> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const client = await this.getClient();\n\n            const command = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const response = await client.send(command);\n\n            if (!response.Body) {\n                return null;\n            }\n\n            // Convert stream to buffer\n            const chunks: Uint8Array[] = [];\n            for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {\n                chunks.push(chunk);\n            }\n            const buffer = Buffer.concat(chunks);\n\n            const contentType = response.ContentType || \"application/octet-stream\";\n            const fileName = resolvedPath.split(\"/\").pop() || resolvedPath;\n\n            const blob = new Blob([buffer], { type: contentType });\n            return new File([blob], fileName, { type: contentType });\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NoSuchKey\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return null;\n            }\n            throw error;\n        }\n    }\n\n    async deleteObject(key: string, bucket?: string): Promise<void> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.DeleteObjectCommand({\n            Bucket: resolvedBucket,\n            Key: resolvedPath\n        });\n\n        await client.send(command);\n    }\n\n    async listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult> {\n        const resolvedBucket = this.getBucket(options?.bucket);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.ListObjectsV2Command({\n            Bucket: resolvedBucket,\n            Prefix: prefix || undefined,\n            MaxKeys: options?.maxResults ?? 1000,\n            ContinuationToken: options?.pageToken,\n            Delimiter: \"/\" // This gives us folder-like behavior\n        });\n\n        const response = await client.send(command);\n\n        const items: StorageReference[] = (response.Contents || []).map(obj => ({\n            bucket: resolvedBucket,\n            fullPath: obj.Key || \"\",\n            name: (obj.Key || \"\").split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${obj.Key}`\n        }));\n\n        const prefixes: StorageReference[] = (response.CommonPrefixes || []).map(prefix => ({\n            bucket: resolvedBucket,\n            fullPath: prefix.Prefix || \"\",\n            name: (prefix.Prefix || \"\").replace(/\\/$/, \"\").split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${prefix.Prefix}`\n        }));\n\n        return {\n            items,\n            prefixes,\n            nextPageToken: response.NextContinuationToken\n        };\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAI;AACJ,IAAI;AAEJ,eAAe,SAAS;CACpB,IAAI,CAAC,WACD,IAAI;EACA,YAAY,MAAM,OAAO;CAC7B,QAAQ;EACJ,MAAM,IAAI,MACN,sHAEJ;CACJ;CAEJ,OAAO;AACX;AAEA,eAAe,gBAAgB;CAC3B,IAAI,CAAC,kBACD,IAAI;EACA,mBAAmB,MAAM,OAAO;CACpC,QAAQ;EACJ,MAAM,IAAI,MACN,iIAEJ;CACJ;CAEJ,OAAO;AACX;;;;;AAMA,IAAa,sBAAb,MAA8D;CAC1D;CACA;CAEA,YAAY,QAAyB;EACjC,KAAK,SAAS;CAClB;;;;CAKA,MAAc,YAAmC;EAC7C,IAAI,CAAC,KAAK,SAAS;GACf,MAAM,KAAK,MAAM,OAAO;GACxB,KAAK,UAAU,IAAI,GAAG,SAAS;IAC3B,QAAQ,KAAK,OAAO,UAAU;IAC9B,UAAU,KAAK,OAAO;IACtB,gBAAgB,KAAK,OAAO,kBAAkB,CAAC,CAAC,KAAK,OAAO;IAC5D,aAAa;KACT,aAAa,KAAK,OAAO;KACzB,iBAAiB,KAAK,OAAO;IACjC;GACJ,CAAC;EACL;EACA,OAAO,KAAK;CAChB;CAEA,UAAgB;EACZ,OAAO;CACX;;;;CAKA,aAAqB,MAAkB;EACnC,MAAM,UAAU,KAAK,OAAO,eAAA;EAC5B,IAAI,KAAK,OAAO,SACZ,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,gCAAgC,SAAS;EAGpF,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,iBAAiB,SAAS;OAClE,CAAC,KAAK,OAAO,iBAAiB,SAAS,KAAK,IAAI,GAChD,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,kCAAkC,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG;EAAA;CAG9H;;;;CAKA,UAAkB,QAAyB;EAGvC,IAAI,CAAC,UAAU,WAAW,WAAW,OAAO,KAAK,OAAO;EACxD,OAAO;CACX;CAEA,MAAM,UAAU,EACZ,MACA,KACA,UACA,UAC2C;EAC3C,KAAK,aAAa,IAAI;EAEtB,MAAM,aAAa,KAAK,UAAU,MAAM;EAGxC,MAAM,cAAc,MAAM,KAAK,YAAY;EAC3C,MAAM,SAAS,OAAO,KAAK,WAAW;EAEtC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;GACpC,QAAQ;GACR,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,UAAU,WAAW,KAAK,gBAAgB,QAAQ,IAAI,KAAA;EAC1D,CAAC;EAED,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;GACH;GACA,QAAQ;GACR,YAAY,QAAQ,WAAW,GAAG;EACtC;CACJ;;;;CAKA,gBAAwB,UAA2D;EAC/E,MAAM,YAAoC,CAAC;EAC3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAC9C,IAAI,OAAO,UAAU,UACjB,UAAU,OAAO;OACd,IAAI,UAAU,KAAA,KAAa,UAAU,MACxC,UAAU,OAAO,KAAK,UAAU,KAAK;EAG7C,OAAO;CACX;CAEA,MAAM,aAAa,KAAa,QAA0C;EAEtE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,YAAY,MAAM,cAAc;GACtC,MAAM,SAAS,MAAM,KAAK,UAAU;GAGpC,MAAM,cAAc,IAAI,GAAG,kBAAkB;IACzC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,aAAa,MAAM,OAAO,KAAK,WAAW;GAGhD,MAAM,aAAa,IAAI,GAAG,iBAAiB;IACvC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,YAAY,KAAK,OAAO,uBAAuB;GAYrD,OAAO;IACH,KAAA,MAZc,UAAU,aAAa,QAAQ,YAAY,EAAE,UAAU,CAAC;IAatE,UAAA;KAVA,QAAQ;KACR,UAAU;KACV,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACvC,MAAM,WAAW,iBAAiB;KAClC,aAAa,WAAW,eAAe;KACvC,gBAAgB,WAAW,YAAY,CAAC;IAKxC;GACJ;EACJ,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,cAAc,QAAQ,WAAW,mBAAmB,KACrE,OAAO;IACH,KAAK;IACL,cAAc;GAClB;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,UAAU,KAAa,QAAuC;EAEhE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,SAAS,MAAM,KAAK,UAAU;GAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;IACpC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;GAE1C,IAAI,CAAC,SAAS,MACV,OAAO;GAIX,MAAM,SAAuB,CAAC;GAC9B,WAAW,MAAM,SAAS,SAAS,MAC/B,OAAO,KAAK,KAAK;GAErB,MAAM,SAAS,OAAO,OAAO,MAAM;GAEnC,MAAM,cAAc,SAAS,eAAe;GAC5C,MAAM,WAAW,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAElD,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,YAAY,CAAC;GACrD,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,MAAM,YAAY,CAAC;EAC3D,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,eAAe,QAAQ,WAAW,mBAAmB,KACtE,OAAO;GAEX,MAAM;EACV;CACJ;CAEA,MAAM,aAAa,KAAa,QAAgC;EAE5D,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,oBAAoB;GACvC,QAAQ;GACR,KAAK;EACT,CAAC;EAED,MAAM,OAAO,KAAK,OAAO;CAC7B;CAEA,MAAM,YAAY,QAAgB,SAIH;EAC3B,MAAM,iBAAiB,KAAK,UAAU,SAAS,MAAM;EAErD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,qBAAqB;GACxC,QAAQ;GACR,QAAQ,UAAU,KAAA;GAClB,SAAS,SAAS,cAAc;GAChC,mBAAmB,SAAS;GAC5B,WAAW;EACf,CAAC;EAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;EAoB1C,OAAO;GACH,QAnB+B,SAAS,YAAY,CAAC,EAAA,CAAG,KAAI,SAAQ;IACpE,QAAQ;IACR,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IAC1C,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,IAAI;GAClD,EAYI;GACA,WAXkC,SAAS,kBAAkB,CAAC,EAAA,CAAG,KAAI,YAAW;IAChF,QAAQ;IACR,UAAU,OAAO,UAAU;IAC3B,OAAO,OAAO,UAAU,GAAA,CAAI,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IACnE,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,OAAO;GACrD,EAII;GACA,eAAe,SAAS;EAC5B;CACJ;AACJ"}
+{"version":3,"file":"S3StorageController-B2EDXXMH.js","names":[],"sources":["../src/storage/S3StorageController.ts"],"sourcesContent":["/**\n * S3-compatible storage controller (works with AWS S3 and MinIO)\n */\n\nimport type { S3Client as S3ClientType, } from \"@aws-sdk/client-s3\";\nimport { DEFAULT_MAX_FILE_SIZE, S3StorageConfig, StorageController } from \"./types\";\nimport {\n    DownloadConfig,\n    DownloadMetadata,\n    StorageListResult,\n    StorageReference,\n    UploadFileProps,\n    UploadFileResult\n} from \"@rebasepro/types\";\n\nlet _s3Module: typeof import(\"@aws-sdk/client-s3\") | undefined;\nlet _presignerModule: typeof import(\"@aws-sdk/s3-request-presigner\") | undefined;\n\nasync function loadS3() {\n    if (!_s3Module) {\n        try {\n            _s3Module = await import(\"@aws-sdk/client-s3\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/client-s3 is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _s3Module;\n}\n\nasync function loadPresigner() {\n    if (!_presignerModule) {\n        try {\n            _presignerModule = await import(\"@aws-sdk/s3-request-presigner\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/s3-request-presigner is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _presignerModule;\n}\n\n/**\n * S3-compatible storage implementation\n * Works with AWS S3 and MinIO (with forcePathStyle option)\n */\nexport class S3StorageController implements StorageController {\n    private config: S3StorageConfig;\n    private _client: S3ClientType | undefined;\n\n    constructor(config: S3StorageConfig) {\n        this.config = config;\n    }\n\n    /**\n     * Lazily create and cache the S3 client on first use\n     */\n    private async getClient(): Promise<S3ClientType> {\n        if (!this._client) {\n            const s3 = await loadS3();\n            this._client = new s3.S3Client({\n                region: this.config.region || \"us-east-1\",\n                endpoint: this.config.endpoint,\n                forcePathStyle: this.config.forcePathStyle ?? !!this.config.endpoint, // Auto-enable for custom endpoints (MinIO)\n                credentials: {\n                    accessKeyId: this.config.accessKeyId,\n                    secretAccessKey: this.config.secretAccessKey\n                }\n            });\n        }\n        return this._client;\n    }\n\n    getType(): \"s3\" {\n        return \"s3\";\n    }\n\n    /**\n     * Validate file before upload\n     */\n    private validateFile(file: File): void {\n        const maxSize = this.config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n        if (file.size > maxSize) {\n            throw new Error(`File size ${file.size} exceeds maximum allowed size ${maxSize}`);\n        }\n\n        if (this.config.allowedMimeTypes && this.config.allowedMimeTypes.length > 0) {\n            if (!this.config.allowedMimeTypes.includes(file.type)) {\n                throw new Error(`File type ${file.type} is not allowed. Allowed types: ${this.config.allowedMimeTypes.join(\", \")}`);\n            }\n        }\n    }\n\n    /**\n     * Get the bucket name - either from parameter or config\n     */\n    private getBucket(bucket?: string): string {\n        // \"default\" is a logical bucket name used by local storage;\n        // for S3 it should resolve to the configured bucket.\n        if (!bucket || bucket === \"default\") return this.config.bucket;\n        return bucket;\n    }\n\n    async putObject({\n        file,\n        key,\n        metadata,\n        bucket\n    }: UploadFileProps): Promise<UploadFileResult> {\n        this.validateFile(file);\n\n        const usedBucket = this.getBucket(bucket);\n\n        // Convert File to Buffer\n        const arrayBuffer = await file.arrayBuffer();\n        const buffer = Buffer.from(arrayBuffer);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.PutObjectCommand({\n            Bucket: usedBucket,\n            Key: key,\n            Body: buffer,\n            ContentType: file.type,\n            Metadata: metadata ? this.flattenMetadata(metadata) : undefined\n        });\n\n        await client.send(command);\n\n        return {\n            key,\n            bucket: usedBucket,\n            storageUrl: `s3://${usedBucket}/${key}`\n        };\n    }\n\n    /**\n     * Flatten nested metadata to string values (S3 requirement)\n     */\n    private flattenMetadata(metadata: Record<string, unknown>): Record<string, string> {\n        const flattened: Record<string, string> = {};\n        for (const [key, value] of Object.entries(metadata)) {\n            if (typeof value === \"string\") {\n                flattened[key] = value;\n            } else if (value !== undefined && value !== null) {\n                flattened[key] = JSON.stringify(value);\n            }\n        }\n        return flattened;\n    }\n\n    async getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig> {\n        // Handle s3:// and gs:// URLs for backward compatibility\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const presigner = await loadPresigner();\n            const client = await this.getClient();\n\n            // First check if the object exists and get metadata\n            const headCommand = new s3.HeadObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const headResult = await client.send(headCommand);\n\n            // Generate a signed URL\n            const getCommand = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const expiresIn = this.config.signedUrlExpiration ?? 3600;\n            const url = await presigner.getSignedUrl(client, getCommand, { expiresIn });\n\n            const metadata: DownloadMetadata = {\n                bucket: resolvedBucket,\n                fullPath: resolvedPath,\n                name: resolvedPath.split(\"/\").pop() || resolvedPath,\n                size: headResult.ContentLength || 0,\n                contentType: headResult.ContentType || \"application/octet-stream\",\n                customMetadata: headResult.Metadata || {}\n            };\n\n            return {\n                url,\n                metadata\n            };\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NotFound\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return {\n                    url: null,\n                    fileNotFound: true\n                };\n            }\n            throw error;\n        }\n    }\n\n    async getObject(key: string, bucket?: string): Promise<File | null> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const client = await this.getClient();\n\n            const command = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const response = await client.send(command);\n\n            if (!response.Body) {\n                return null;\n            }\n\n            // Convert stream to buffer\n            const chunks: Uint8Array[] = [];\n            for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {\n                chunks.push(chunk);\n            }\n            const buffer = Buffer.concat(chunks);\n\n            const contentType = response.ContentType || \"application/octet-stream\";\n            const fileName = resolvedPath.split(\"/\").pop() || resolvedPath;\n\n            const blob = new Blob([buffer], { type: contentType });\n            return new File([blob], fileName, { type: contentType });\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NoSuchKey\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return null;\n            }\n            throw error;\n        }\n    }\n\n    async deleteObject(key: string, bucket?: string): Promise<void> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.DeleteObjectCommand({\n            Bucket: resolvedBucket,\n            Key: resolvedPath\n        });\n\n        // Deleting something that is already gone is the outcome the caller\n        // wanted, so it is not an error. AWS itself answers DeleteObject with\n        // 204 for a key that never existed, but S3-compatible backends (MinIO,\n        // Ceph, R2 in some configurations) do raise NoSuchKey — and the local\n        // controller has always returned quietly in this case. Without this,\n        // which of those a deployment happens to run decides whether\n        // `DELETE /api/storage/:path` on a stale reference is a 200 or a 500.\n        try {\n            await client.send(command);\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NoSuchKey\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return;\n            }\n            throw error;\n        }\n    }\n\n    async listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult> {\n        const resolvedBucket = this.getBucket(options?.bucket);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.ListObjectsV2Command({\n            Bucket: resolvedBucket,\n            Prefix: prefix || undefined,\n            MaxKeys: options?.maxResults ?? 1000,\n            ContinuationToken: options?.pageToken,\n            Delimiter: \"/\" // This gives us folder-like behavior\n        });\n\n        const response = await client.send(command);\n\n        const items: StorageReference[] = (response.Contents || []).map(obj => ({\n            bucket: resolvedBucket,\n            fullPath: obj.Key || \"\",\n            name: (obj.Key || \"\").split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${obj.Key}`\n        }));\n\n        const prefixes: StorageReference[] = (response.CommonPrefixes || []).map(prefix => ({\n            bucket: resolvedBucket,\n            fullPath: prefix.Prefix || \"\",\n            name: (prefix.Prefix || \"\").replace(/\\/$/, \"\").split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${prefix.Prefix}`\n        }));\n\n        return {\n            items,\n            prefixes,\n            nextPageToken: response.NextContinuationToken\n        };\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAI;AACJ,IAAI;AAEJ,eAAe,SAAS;CACpB,IAAI,CAAC,WACD,IAAI;EACA,YAAY,MAAM,OAAO;CAC7B,QAAQ;EACJ,MAAM,IAAI,MACN,sHAEJ;CACJ;CAEJ,OAAO;AACX;AAEA,eAAe,gBAAgB;CAC3B,IAAI,CAAC,kBACD,IAAI;EACA,mBAAmB,MAAM,OAAO;CACpC,QAAQ;EACJ,MAAM,IAAI,MACN,iIAEJ;CACJ;CAEJ,OAAO;AACX;;;;;AAMA,IAAa,sBAAb,MAA8D;CAC1D;CACA;CAEA,YAAY,QAAyB;EACjC,KAAK,SAAS;CAClB;;;;CAKA,MAAc,YAAmC;EAC7C,IAAI,CAAC,KAAK,SAAS;GACf,MAAM,KAAK,MAAM,OAAO;GACxB,KAAK,UAAU,IAAI,GAAG,SAAS;IAC3B,QAAQ,KAAK,OAAO,UAAU;IAC9B,UAAU,KAAK,OAAO;IACtB,gBAAgB,KAAK,OAAO,kBAAkB,CAAC,CAAC,KAAK,OAAO;IAC5D,aAAa;KACT,aAAa,KAAK,OAAO;KACzB,iBAAiB,KAAK,OAAO;IACjC;GACJ,CAAC;EACL;EACA,OAAO,KAAK;CAChB;CAEA,UAAgB;EACZ,OAAO;CACX;;;;CAKA,aAAqB,MAAkB;EACnC,MAAM,UAAU,KAAK,OAAO,eAAA;EAC5B,IAAI,KAAK,OAAO,SACZ,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,gCAAgC,SAAS;EAGpF,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,iBAAiB,SAAS;OAClE,CAAC,KAAK,OAAO,iBAAiB,SAAS,KAAK,IAAI,GAChD,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,kCAAkC,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG;EAAA;CAG9H;;;;CAKA,UAAkB,QAAyB;EAGvC,IAAI,CAAC,UAAU,WAAW,WAAW,OAAO,KAAK,OAAO;EACxD,OAAO;CACX;CAEA,MAAM,UAAU,EACZ,MACA,KACA,UACA,UAC2C;EAC3C,KAAK,aAAa,IAAI;EAEtB,MAAM,aAAa,KAAK,UAAU,MAAM;EAGxC,MAAM,cAAc,MAAM,KAAK,YAAY;EAC3C,MAAM,SAAS,OAAO,KAAK,WAAW;EAEtC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;GACpC,QAAQ;GACR,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,UAAU,WAAW,KAAK,gBAAgB,QAAQ,IAAI,KAAA;EAC1D,CAAC;EAED,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;GACH;GACA,QAAQ;GACR,YAAY,QAAQ,WAAW,GAAG;EACtC;CACJ;;;;CAKA,gBAAwB,UAA2D;EAC/E,MAAM,YAAoC,CAAC;EAC3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAC9C,IAAI,OAAO,UAAU,UACjB,UAAU,OAAO;OACd,IAAI,UAAU,KAAA,KAAa,UAAU,MACxC,UAAU,OAAO,KAAK,UAAU,KAAK;EAG7C,OAAO;CACX;CAEA,MAAM,aAAa,KAAa,QAA0C;EAEtE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,YAAY,MAAM,cAAc;GACtC,MAAM,SAAS,MAAM,KAAK,UAAU;GAGpC,MAAM,cAAc,IAAI,GAAG,kBAAkB;IACzC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,aAAa,MAAM,OAAO,KAAK,WAAW;GAGhD,MAAM,aAAa,IAAI,GAAG,iBAAiB;IACvC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,YAAY,KAAK,OAAO,uBAAuB;GAYrD,OAAO;IACH,KAAA,MAZc,UAAU,aAAa,QAAQ,YAAY,EAAE,UAAU,CAAC;IAatE,UAAA;KAVA,QAAQ;KACR,UAAU;KACV,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACvC,MAAM,WAAW,iBAAiB;KAClC,aAAa,WAAW,eAAe;KACvC,gBAAgB,WAAW,YAAY,CAAC;IAKxC;GACJ;EACJ,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,cAAc,QAAQ,WAAW,mBAAmB,KACrE,OAAO;IACH,KAAK;IACL,cAAc;GAClB;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,UAAU,KAAa,QAAuC;EAEhE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,SAAS,MAAM,KAAK,UAAU;GAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;IACpC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;GAE1C,IAAI,CAAC,SAAS,MACV,OAAO;GAIX,MAAM,SAAuB,CAAC;GAC9B,WAAW,MAAM,SAAS,SAAS,MAC/B,OAAO,KAAK,KAAK;GAErB,MAAM,SAAS,OAAO,OAAO,MAAM;GAEnC,MAAM,cAAc,SAAS,eAAe;GAC5C,MAAM,WAAW,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAElD,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,YAAY,CAAC;GACrD,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,MAAM,YAAY,CAAC;EAC3D,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,eAAe,QAAQ,WAAW,mBAAmB,KACtE,OAAO;GAEX,MAAM;EACV;CACJ;CAEA,MAAM,aAAa,KAAa,QAAgC;EAE5D,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,oBAAoB;GACvC,QAAQ;GACR,KAAK;EACT,CAAC;EASD,IAAI;GACA,MAAM,OAAO,KAAK,OAAO;EAC7B,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,eAAe,QAAQ,WAAW,mBAAmB,KACtE;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,YAAY,QAAgB,SAIH;EAC3B,MAAM,iBAAiB,KAAK,UAAU,SAAS,MAAM;EAErD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,qBAAqB;GACxC,QAAQ;GACR,QAAQ,UAAU,KAAA;GAClB,SAAS,SAAS,cAAc;GAChC,mBAAmB,SAAS;GAC5B,WAAW;EACf,CAAC;EAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;EAoB1C,OAAO;GACH,QAnB+B,SAAS,YAAY,CAAC,EAAA,CAAG,KAAI,SAAQ;IACpE,QAAQ;IACR,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IAC1C,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,IAAI;GAClD,EAYI;GACA,WAXkC,SAAS,kBAAkB,CAAC,EAAA,CAAG,KAAI,YAAW;IAChF,QAAQ;IACR,UAAU,OAAO,UAAU;IAC3B,OAAO,OAAO,UAAU,GAAA,CAAI,QAAQ,OAAO,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IACnE,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,OAAO;GACrD,EAII;GACA,eAAe,SAAS;EAC5B;CACJ;AACJ"}

package/dist/api/rest/write-validation.d.ts

@@ -20,3 +20,25 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
     rowIndex?: number;
     extraKnownFields?: readonly string[];
 }): void;
+/**
+ * Narrow response rows to the fields the caller asked for.
+ *
+ * `?fields=id,title` is documented in the generated OpenAPI — "Comma-separated
+ * list of fields to return (field selection)" — and it is the first thing shown
+ * on every endpoint in the API Explorer. It was parsed into `options.fields`
+ * and then read by nothing at all: no driver referenced it, and every request
+ * came back with every column. A caller asking for two fields of a `posts` row
+ * still received its whole `content`.
+ *
+ * This shapes the *response*, which is what the parameter says it does; it is
+ * not a column pushdown, so it saves bandwidth rather than database work.
+ *
+ * `id` always survives. Rows are addressed by it everywhere above this layer —
+ * the admin table, realtime reconciliation, the offline cache — and a row that
+ * arrives without one is not a smaller row, it is an unusable one. Asking for
+ * `fields=title` and being unable to open the record you clicked is a worse
+ * answer than one extra key.
+ */
+export declare function projectResponseFields<T extends Record<string, unknown>>(rows: T[], fields: readonly string[] | undefined, collection: CollectionConfig, options?: {
+    include?: readonly string[];
+}): T[];

package/dist/auth/bearer-token.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Parsing of the `Authorization: Bearer <token>` header.
+ *
+ * Its own module rather than a helper inside `middleware.ts`, because the
+ * API-key middleware needs it too and `middleware.ts` already imports from
+ * there — putting it in either one would close an import cycle.
+ *
+ * @module
+ */
+/**
+ * Pull the token out of an `Authorization: Bearer <token>` header.
+ *
+ * RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
+ * clients send `bearer` — HTTP libraries that lower-case what they emit,
+ * hand-written curl, proxies that normalise headers. Matching `"Bearer "`
+ * exactly turned those into a 401 that, from the caller's side, is
+ * indistinguishable from a rejected token; people spend an afternoon
+ * regenerating credentials that were fine. Only the scheme is folded — the
+ * token itself is returned byte-for-byte.
+ *
+ * Returns `undefined` when there is no header or it names another scheme.
+ * That is deliberately distinct from an empty token (`Bearer ` with nothing
+ * after it), which callers still route into verification so it fails as a bad
+ * token rather than as a missing header.
+ */
+export declare function extractBearerToken(authHeader: string | undefined | null): string | undefined;

package/dist/auth/middleware.d.ts

@@ -3,6 +3,8 @@ import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
 import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
+import { extractBearerToken } from "./bearer-token";
+export { extractBearerToken };
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated

package/dist/auth/require-auth.d.ts

@@ -0,0 +1,39 @@
+import type { AuthAdapter } from "@rebasepro/types";
+import type { RebaseAuthConfig } from "../init";
+/**
+ * Whether the `auth` config is an `AuthAdapter` (it can verify a request) or a
+ * plain `RebaseAuthConfig`. Lives here rather than in `init.ts` so this module
+ * stays free of it; `init.ts` re-exports it under its original name.
+ */
+export declare function isAuthAdapter(auth: RebaseAuthConfig | AuthAdapter): auth is AuthAdapter;
+/**
+ * Does this server require an authenticated caller?
+ *
+ * One predicate, because there are two enforcement points — the HTTP data
+ * routes and the realtime socket — and they used to compute it separately. The
+ * socket's copy read
+ *
+ * ```ts
+ * authConfig?.requireAuth !== false && !!authConfig?.jwtSecret
+ * ```
+ *
+ * which differs from this in two ways, both of them open. With no auth config
+ * at all it returned `false` while the HTTP side returned `true`, so a server
+ * that answered 401 to every `/api/data` read served the same rows over the
+ * socket. And an explicit `requireAuth: true` was ANDed away whenever the
+ * credential came from an adapter rather than a local `jwtSecret` — asking for
+ * authentication was what switched it off.
+ *
+ * It is worth stating why that is worse than an ordinary missing check: the
+ * socket seeds each session with `authenticated: !requireAuth`, so a `false`
+ * here does not skip a gate, it marks every client that connects as already
+ * past it.
+ *
+ * Its own module rather than a helper in `init.ts` so the drivers can import it
+ * without pulling the backend entry point in behind it.
+ *
+ * - an `AuthAdapter` always implies auth is required (secure by default)
+ * - a `RebaseAuthConfig` is honoured, and only an explicit `false` opens it
+ * - no auth configuration at all defaults to required
+ */
+export declare function resolveRequireAuth(auth?: RebaseAuthConfig | AuthAdapter): boolean;

package/dist/{auth-DQv2_Z3S.js → auth-B9AJsH3u.js}

@@ -192,6 +192,40 @@ function safeCompare(a, b) {
 	}
 }
 //#endregion
+//#region src/auth/bearer-token.ts
+/**
+* Parsing of the `Authorization: Bearer <token>` header.
+*
+* Its own module rather than a helper inside `middleware.ts`, because the
+* API-key middleware needs it too and `middleware.ts` already imports from
+* there — putting it in either one would close an import cycle.
+*
+* @module
+*/
+/**
+* Pull the token out of an `Authorization: Bearer <token>` header.
+*
+* RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
+* clients send `bearer` — HTTP libraries that lower-case what they emit,
+* hand-written curl, proxies that normalise headers. Matching `"Bearer "`
+* exactly turned those into a 401 that, from the caller's side, is
+* indistinguishable from a rejected token; people spend an afternoon
+* regenerating credentials that were fine. Only the scheme is folded — the
+* token itself is returned byte-for-byte.
+*
+* Returns `undefined` when there is no header or it names another scheme.
+* That is deliberately distinct from an empty token (`Bearer ` with nothing
+* after it), which callers still route into verification so it fails as a bad
+* token rather than as a missing header.
+*/
+function extractBearerToken(authHeader) {
+	if (!authHeader) return void 0;
+	const separator = authHeader.indexOf(" ");
+	if (separator < 0) return void 0;
+	if (authHeader.slice(0, separator).toLowerCase() !== "bearer") return void 0;
+	return authHeader.slice(separator + 1);
+}
+//#endregion
 //#region src/auth/api-keys/api-key-middleware.ts
 /**
 * Hono middleware for authenticating requests via Service API Keys.
@@ -386,8 +420,7 @@ function createFunctionApiKeyGuard(mountPrefix) {
 function createApiKeyPreAuth(options) {
 	return async (c, next) => {
 		if (c.get("apiKey")) return next();
-		const authHeader = c.req.header("authorization") || "";
-		const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+		const token = extractBearerToken(c.req.header("authorization")) ?? "";
 		if (!token || !isApiKeyToken(token)) return next();
 		const result = await validateApiKey(c, token, options);
 		if (result !== true) return result;
@@ -408,12 +441,12 @@ function createApiKeyPreAuth(options) {
 */
 var requireAuth = async (c, next) => {
 	if (c.get("user")) return next();
-	const authHeader = c.req.header("authorization");
-	if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
+	const token = extractBearerToken(c.req.header("authorization"));
+	if (token === void 0) return c.json({ error: {
 		message: "Authorization header missing or invalid",
 		code: "UNAUTHORIZED"
 	} }, 401);
-	const payload = verifyAccessToken(authHeader.substring(7));
+	const payload = verifyAccessToken(token);
 	if (!payload) return c.json({ error: {
 		message: "Invalid or expired token",
 		code: "UNAUTHORIZED"
@@ -436,12 +469,11 @@ function createRequireAuth(options) {
 	const key = options.serviceKey;
 	return async (c, next) => {
 		if (c.get("user")) return next();
-		const authHeader = c.req.header("authorization");
-		if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
+		const token = extractBearerToken(c.req.header("authorization"));
+		if (token === void 0) return c.json({ error: {
 			message: "Authorization header missing or invalid",
 			code: "UNAUTHORIZED"
 		} }, 401);
-		const token = authHeader.substring(7);
 		if (safeCompare(token, key)) {
 			c.set("user", {
 				uid: "service",
@@ -485,9 +517,9 @@ var requireAdmin = async (c, next) => {
 */
 var optionalAuth = async (c, next) => {
 	if (c.get("user")) return next();
-	const authHeader = c.req.header("authorization");
-	if (authHeader && authHeader.startsWith("Bearer ")) {
-		const payload = verifyAccessToken(authHeader.substring(7));
+	const token = extractBearerToken(c.req.header("authorization"));
+	if (token !== void 0) {
+		const payload = verifyAccessToken(token);
 		if (payload) c.set("user", payload);
 	}
 	return next();
@@ -560,55 +592,53 @@ function createAuthMiddleware(options) {
 			} }, 401);
 		}
 		else {
-			const authHeader = c.req.header("authorization");
-			if (authHeader && authHeader.startsWith("Bearer ")) {
-				const token = authHeader.substring(7);
-				if (serviceKey && safeCompare(token, serviceKey)) {
-					c.set("user", {
+			const token = extractBearerToken(c.req.header("authorization"));
+			if (token !== void 0) if (serviceKey && safeCompare(token, serviceKey)) {
+				c.set("user", {
+					uid: "service",
+					roles: ["admin"]
+				});
+				try {
+					c.set("driver", await scopeDataDriver(driver, {
 						uid: "service",
 						roles: ["admin"]
-					});
+					}));
+				} catch (error) {
+					logger.error("[AUTH] RLS scoping failed for service key", { error });
+					return c.json({ error: {
+						message: "Internal authentication error",
+						code: "INTERNAL_ERROR"
+					} }, 500);
+				}
+			} else if (apiKeyStore && isApiKeyToken(token)) {
+				const result = await validateApiKey(c, token, {
+					store: apiKeyStore,
+					driver
+				});
+				if (result !== true) return result;
+			} else {
+				const payload = extractUserFromToken(token);
+				if (payload) {
+					c.set("user", payload);
 					try {
-						c.set("driver", await scopeDataDriver(driver, {
-							uid: "service",
-							roles: ["admin"]
-						}));
+						const user = {
+							uid: payload.uid,
+							roles: payload.roles
+						};
+						c.set("driver", await scopeDataDriver(driver, user));
 					} catch (error) {
-						logger.error("[AUTH] RLS scoping failed for service key", { error });
+						logger.error("[AUTH] RLS scoping failed for authenticated user", { error });
 						return c.json({ error: {
 							message: "Internal authentication error",
 							code: "INTERNAL_ERROR"
 						} }, 500);
 					}
-				} else if (apiKeyStore && isApiKeyToken(token)) {
-					const result = await validateApiKey(c, token, {
-						store: apiKeyStore,
-						driver
-					});
-					if (result !== true) return result;
-				} else {
-					const payload = extractUserFromToken(token);
-					if (payload) {
-						c.set("user", payload);
-						try {
-							const user = {
-								uid: payload.uid,
-								roles: payload.roles
-							};
-							c.set("driver", await scopeDataDriver(driver, user));
-						} catch (error) {
-							logger.error("[AUTH] RLS scoping failed for authenticated user", { error });
-							return c.json({ error: {
-								message: "Internal authentication error",
-								code: "INTERNAL_ERROR"
-							} }, 500);
-						}
-					} else return c.json({ error: {
-						message: "Invalid or expired token",
-						code: "UNAUTHORIZED"
-					} }, 401);
-				}
-			} else try {
+				} else return c.json({ error: {
+					message: "Invalid or expired token",
+					code: "UNAUTHORIZED"
+				} }, 401);
+			}
+			else try {
 				c.set("driver", await scopeDataDriver(driver, {
 					uid: ANONYMOUS_USER_ID,
 					roles: ["anon"]
@@ -646,8 +676,7 @@ function createAuthMiddleware(options) {
 * ```
 */
 var queryTokenAuth = async (c, next) => {
-	const authHeader = c.req.header("authorization");
-	if (authHeader && authHeader.startsWith("Bearer ")) return next();
+	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
 	const queryToken = c.req.query("token");
 	if (queryToken) {
 		const payload = verifyAccessToken(queryToken);
@@ -731,8 +760,9 @@ var fileTokenAuth = async (c, next) => {
 			resolvedPath: filePath
 		};
 	};
-	if (authHeader && authHeader.startsWith("Bearer ")) {
-		const payload = verifyDownloadToken(authHeader.substring(7));
+	const bearerToken = extractBearerToken(authHeader);
+	if (bearerToken !== void 0) {
+		const payload = verifyDownloadToken(bearerToken);
 		if (payload) {
 			const rawPath = extractWildcard(c);
 			if (rawPath) {
@@ -790,8 +820,7 @@ function createAdapterAuthMiddleware(options) {
 	return async (c, next) => {
 		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
 		if (apiKeyStore) {
-			const authHeader = c.req.header("authorization") || "";
-			const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+			const token = extractBearerToken(c.req.header("authorization")) ?? "";
 			if (token.startsWith("rk_")) {
 				const result = await validateApiKey(c, token, {
 					store: apiKeyStore,
@@ -6126,10 +6155,10 @@ function mountSessionRoutes(opts) {
 			else await authRepo.deleteRefreshToken(tokenHash);
 		}
 		clearRefreshCookie(c, config.cookieAuth);
-		const authHeader = c.req.header("authorization");
-		if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
+		const accessToken = extractBearerToken(c.req.header("authorization"));
+		if (ops.afterLogout && accessToken !== void 0) {
 			const { verifyAccessToken } = await import("./jwt-DD6EtpGj.js").then((n) => n.u);
-			const payload = verifyAccessToken(authHeader.substring(7));
+			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
 			});
@@ -7371,9 +7400,8 @@ function createBuiltinAuthAdapter(config) {
 		id: "rebase-builtin",
 		serviceKey,
 		async verifyRequest(request) {
-			const authHeader = request.headers.get("authorization");
-			if (!authHeader?.startsWith("Bearer ")) return null;
-			const token = authHeader.substring(7);
+			const token = extractBearerToken(request.headers.get("authorization"));
+			if (token === void 0) return null;
 			if (serviceKey && safeCompare(token, serviceKey)) return {
 				uid: "service",
 				email: "service@rebase.internal",
@@ -8918,6 +8946,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { isOperationAllowed as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, httpMethodToOperation as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, safeCompare as X, validateApiKey as Y, scopeDataDriver as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, PUBLIC_STORAGE_PREFIX as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, MAX_LIST_LIMIT as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, resolveClientListLimit as rt, createBitbucketProvider as s, auth_exports as t, isPublicStoragePath as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
+export { httpMethodToOperation as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, scopeDataDriver as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, extractBearerToken as X, validateApiKey as Y, safeCompare as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, isOperationAllowed as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, resolveClientListLimit as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isPublicStoragePath as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, MAX_LIST_LIMIT as rt, createBitbucketProvider as s, auth_exports as t, PUBLIC_STORAGE_PREFIX as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
 
-//# sourceMappingURL=auth-DQv2_Z3S.js.map
+//# sourceMappingURL=auth-B9AJsH3u.js.map