@rebasepro/server 0.24.0 → 0.24.1-canary.g19596ef

package/dist/S3StorageController-Btx-6bJ5.js

@@ -0,0 +1,480 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { t as ApiError } from "./errors-Cqp86KnA.js";
+import { c as listingPrefix, s as folderKey } from "./keys-COzQ2aE8.js";
+import { o as webStreamFrom, t as validateUploadedFile } from "./upload-validation-CVobI5xO.js";
+//#region src/storage/S3StorageController.ts
+var S3StorageController_exports = /* @__PURE__ */ __exportAll({ S3StorageController: () => S3StorageController });
+var _s3Module;
+var _presignerModule;
+async function loadS3() {
+	if (!_s3Module) try {
+		_s3Module = await import("@aws-sdk/client-s3");
+	} catch {
+		throw new Error("@aws-sdk/client-s3 is required for S3 storage. Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner");
+	}
+	return _s3Module;
+}
+async function loadPresigner() {
+	if (!_presignerModule) try {
+		_presignerModule = await import("@aws-sdk/s3-request-presigner");
+	} catch {
+		throw new Error("@aws-sdk/s3-request-presigner is required for S3 storage. Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner");
+	}
+	return _presignerModule;
+}
+/** Files up to this size are one `PutObject`; larger ones are uploaded in parts of (at least) this size. */
+var MULTIPART_PART_SIZE = 8 * 1024 * 1024;
+/** S3's limit on the parts of one upload. */
+var MAX_MULTIPART_PARTS = 1e4;
+/**
+* S3-compatible storage implementation
+* Works with AWS S3 and MinIO (with forcePathStyle option)
+*/
+var S3StorageController = class {
+	config;
+	_client;
+	constructor(config) {
+		this.config = config;
+	}
+	/**
+	* Lazily create and cache the S3 client on first use
+	*/
+	async getClient() {
+		if (!this._client) {
+			const s3 = await loadS3();
+			this._client = new s3.S3Client({
+				region: this.config.region || "us-east-1",
+				endpoint: this.config.endpoint,
+				forcePathStyle: this.config.forcePathStyle ?? !!this.config.endpoint,
+				credentials: {
+					accessKeyId: this.config.accessKeyId,
+					secretAccessKey: this.config.secretAccessKey
+				}
+			});
+		}
+		return this._client;
+	}
+	getType() {
+		return "s3";
+	}
+	/**
+	* The configured bucket, and the logical `default` that maps to it.
+	*
+	* Any other name went straight to S3 as a bucket name, so the request
+	* parameter was a way to address *any* bucket the deployment's credentials
+	* can reach — and a mistyped one came back as "file not found".
+	*/
+	knownBuckets() {
+		return ["default", this.config.bucket];
+	}
+	/** See {@link StorageController.maxFileSize}. */
+	maxFileSize() {
+		return this.config.maxFileSize ?? 52428800;
+	}
+	/**
+	* Validate file before upload
+	*/
+	validateFile(file) {
+		validateUploadedFile(file, this.maxFileSize(), this.config.allowedMimeTypes);
+	}
+	/**
+	* Get the bucket name - either from parameter or config
+	*/
+	getBucket(bucket) {
+		if (!bucket || bucket === "default") return this.config.bucket;
+		return bucket;
+	}
+	async putObject({ file, key, metadata, bucket }, options) {
+		if (options?.uploadLimits !== false) this.validateFile(file);
+		const usedBucket = this.getBucket(bucket);
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		const target = {
+			Bucket: usedBucket,
+			Key: key,
+			ContentType: file.type,
+			Metadata: metadata ? this.flattenMetadata(metadata) : void 0
+		};
+		if (file.size <= MULTIPART_PART_SIZE) await client.send(new s3.PutObjectCommand({
+			...target,
+			Body: Buffer.from(await file.arrayBuffer())
+		})).catch((error) => {
+			throw misconfiguredOr(error, usedBucket);
+		});
+		else await this.putMultipart(target, file);
+		return {
+			key,
+			bucket: usedBucket,
+			storageUrl: `s3://${usedBucket}/${key}`
+		};
+	}
+	/**
+	* Upload a large file in parts, one part in memory at a time.
+	*
+	* Reading the whole file into one buffer held it twice over (the
+	* `arrayBuffer()`, then the SDK's view and the multipart parser's copy
+	* before it), and `PutObject` stops at 5 GB regardless. A slice of a
+	* `File` reads only that range — from disk, for the disk-backed files TUS
+	* and backups hand over — so memory is one part whatever the file's size.
+	* A failure aborts the upload: no partial object appears at the key, and
+	* no orphaned parts are kept (and billed).
+	*/
+	async putMultipart(target, file) {
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		const partSize = Math.max(MULTIPART_PART_SIZE, Math.ceil(file.size / MAX_MULTIPART_PARTS));
+		const { UploadId } = await client.send(new s3.CreateMultipartUploadCommand(target)).catch((error) => {
+			throw misconfiguredOr(error, target.Bucket);
+		});
+		if (!UploadId) throw new Error(`S3 did not start a multipart upload for ${target.Key}.`);
+		const { Bucket, Key } = target;
+		try {
+			const parts = [];
+			for (let offset = 0, PartNumber = 1; offset < file.size; offset += partSize, PartNumber++) {
+				const Body = Buffer.from(await file.slice(offset, Math.min(offset + partSize, file.size)).arrayBuffer());
+				const { ETag } = await client.send(new s3.UploadPartCommand({
+					Bucket,
+					Key,
+					UploadId,
+					PartNumber,
+					Body
+				}));
+				parts.push({
+					ETag,
+					PartNumber
+				});
+			}
+			await client.send(new s3.CompleteMultipartUploadCommand({
+				Bucket,
+				Key,
+				UploadId,
+				MultipartUpload: { Parts: parts }
+			}));
+		} catch (error) {
+			await client.send(new s3.AbortMultipartUploadCommand({
+				Bucket,
+				Key,
+				UploadId
+			})).catch(() => void 0);
+			throw misconfiguredOr(error, Bucket);
+		}
+	}
+	/**
+	* Flatten nested metadata to string values (S3 requirement)
+	*/
+	flattenMetadata(metadata) {
+		const flattened = {};
+		for (const [key, value] of Object.entries(metadata)) if (typeof value === "string") flattened[key] = value;
+		else if (value !== void 0 && value !== null) flattened[key] = JSON.stringify(value);
+		return flattened;
+	}
+	async getSignedUrl(key, bucket) {
+		let resolvedPath = key;
+		let resolvedBucket = this.getBucket(bucket);
+		const match = key.match(/^(s3|gs):\/\//);
+		if (match) {
+			const protocolLength = match[0].length;
+			const withoutProtocol = key.substring(protocolLength);
+			const firstSlash = withoutProtocol.indexOf("/");
+			if (firstSlash > 0) {
+				resolvedBucket = withoutProtocol.substring(0, firstSlash);
+				resolvedPath = withoutProtocol.substring(firstSlash + 1);
+			}
+		}
+		try {
+			const s3 = await loadS3();
+			const presigner = await loadPresigner();
+			const client = await this.getClient();
+			const headCommand = new s3.HeadObjectCommand({
+				Bucket: resolvedBucket,
+				Key: resolvedPath
+			});
+			const headResult = await client.send(headCommand);
+			const getCommand = new s3.GetObjectCommand({
+				Bucket: resolvedBucket,
+				Key: resolvedPath
+			});
+			return {
+				url: await presigner.getSignedUrl(client, getCommand, { expiresIn: 3600 }),
+				metadata: {
+					bucket: resolvedBucket,
+					fullPath: resolvedPath,
+					name: resolvedPath.split("/").pop() || resolvedPath,
+					size: headResult.ContentLength || 0,
+					contentType: headResult.ContentType || "application/octet-stream",
+					customMetadata: headResult.Metadata || {}
+				}
+			};
+		} catch (error) {
+			if (isS3NotFound(error)) return {
+				url: null,
+				fileNotFound: true
+			};
+			throw misconfiguredOr(error, resolvedBucket);
+		}
+	}
+	async getObject(key, bucket) {
+		let resolvedPath = key;
+		let resolvedBucket = this.getBucket(bucket);
+		const match = key.match(/^(s3|gs):\/\//);
+		if (match) {
+			const protocolLength = match[0].length;
+			const withoutProtocol = key.substring(protocolLength);
+			const firstSlash = withoutProtocol.indexOf("/");
+			if (firstSlash > 0) {
+				resolvedBucket = withoutProtocol.substring(0, firstSlash);
+				resolvedPath = withoutProtocol.substring(firstSlash + 1);
+			}
+		}
+		try {
+			const s3 = await loadS3();
+			const client = await this.getClient();
+			const command = new s3.GetObjectCommand({
+				Bucket: resolvedBucket,
+				Key: resolvedPath
+			});
+			const response = await client.send(command);
+			if (!response.Body) return null;
+			const chunks = [];
+			for await (const chunk of response.Body) chunks.push(chunk);
+			const buffer = Buffer.concat(chunks);
+			const contentType = response.ContentType || "application/octet-stream";
+			const fileName = resolvedPath.split("/").pop() || resolvedPath;
+			const blob = new Blob([buffer], { type: contentType });
+			return new File([blob], fileName, {
+				type: contentType,
+				lastModified: response.LastModified?.getTime()
+			});
+		} catch (error) {
+			if (isS3NotFound(error)) return null;
+			throw misconfiguredOr(error, resolvedBucket);
+		}
+	}
+	/**
+	* The bucket and key a call addresses: an `s3://` or `gs://` URL names its
+	* own bucket, anything else is a key in the given (or configured) bucket.
+	*/
+	resolveLocation(key, bucket) {
+		const match = key.match(/^(s3|gs):\/\//);
+		if (match) {
+			const withoutProtocol = key.substring(match[0].length);
+			const firstSlash = withoutProtocol.indexOf("/");
+			if (firstSlash > 0) return {
+				bucket: withoutProtocol.substring(0, firstSlash),
+				key: withoutProtocol.substring(firstSlash + 1)
+			};
+		}
+		return {
+			bucket: this.getBucket(bucket),
+			key
+		};
+	}
+	/**
+	* See {@link StorageController.getMetadata}. One `HeadObject`. Without it,
+	* `GET /metadata/*` fell back to `getSignedUrl`, which signed a URL per
+	* call — ~134 µs of CPU — only for the route to throw it away.
+	*/
+	async getMetadata(key, bucket) {
+		const location = this.resolveLocation(key, bucket);
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		try {
+			const head = await client.send(new s3.HeadObjectCommand({
+				Bucket: location.bucket,
+				Key: location.key
+			}));
+			return {
+				bucket: location.bucket,
+				fullPath: location.key,
+				name: location.key.split("/").pop() || location.key,
+				size: head.ContentLength || 0,
+				contentType: head.ContentType || "application/octet-stream",
+				customMetadata: head.Metadata || {}
+			};
+		} catch (error) {
+			if (isS3NotFound(error)) return null;
+			throw misconfiguredOr(error, location.bucket);
+		}
+	}
+	/** See {@link StorageController.statObject}. One `HeadObject`; no body is read. */
+	async statObject(key, bucket) {
+		const location = this.resolveLocation(key, bucket);
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		try {
+			const head = await client.send(new s3.HeadObjectCommand({
+				Bucket: location.bucket,
+				Key: location.key
+			}));
+			return {
+				size: head.ContentLength ?? 0,
+				contentType: head.ContentType || "application/octet-stream",
+				lastModified: head.LastModified?.getTime() ?? Date.now()
+			};
+		} catch (error) {
+			if (isS3NotFound(error)) return null;
+			throw misconfiguredOr(error, location.bucket);
+		}
+	}
+	/**
+	* See {@link StorageController.getObjectStream}. One `GetObject`, with a
+	* `Range` when one is asked for, so only those bytes leave the bucket; the
+	* body is handed on as it arrives rather than collected first.
+	*/
+	async getObjectStream(key, options) {
+		const location = this.resolveLocation(key, options?.bucket);
+		const range = options?.range;
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		let response;
+		try {
+			response = await client.send(new s3.GetObjectCommand({
+				Bucket: location.bucket,
+				Key: location.key,
+				...range ? { Range: `bytes=${range.start}-${range.end}` } : {}
+			}));
+		} catch (error) {
+			if (isS3NotFound(error)) return null;
+			if (range && isS3RangeNotSatisfiable(error)) return this.getObjectStream(key, { bucket: options?.bucket });
+			throw misconfiguredOr(error, location.bucket);
+		}
+		const body = response.Body;
+		if (!body) return null;
+		const total = range ? /\/(\d+)\s*$/.exec(response.ContentRange ?? "")?.[1] : void 0;
+		const served = range && total !== void 0 ? range : void 0;
+		return {
+			stream: isByteIterable(body) ? webStreamFrom(body) : body.transformToWebStream(),
+			size: total !== void 0 ? Number(total) : response.ContentLength ?? 0,
+			contentType: response.ContentType || "application/octet-stream",
+			lastModified: response.LastModified?.getTime() ?? Date.now(),
+			...served ? { range: served } : {}
+		};
+	}
+	async deleteObject(key, bucket) {
+		let resolvedPath = key;
+		let resolvedBucket = this.getBucket(bucket);
+		const match = key.match(/^(s3|gs):\/\//);
+		if (match) {
+			const protocolLength = match[0].length;
+			const withoutProtocol = key.substring(protocolLength);
+			const firstSlash = withoutProtocol.indexOf("/");
+			if (firstSlash > 0) {
+				resolvedBucket = withoutProtocol.substring(0, firstSlash);
+				resolvedPath = withoutProtocol.substring(firstSlash + 1);
+			}
+		}
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		const command = new s3.DeleteObjectCommand({
+			Bucket: resolvedBucket,
+			Key: resolvedPath
+		});
+		try {
+			await client.send(command);
+		} catch (error) {
+			if (isS3NotFound(error)) return;
+			throw misconfiguredOr(error, resolvedBucket);
+		}
+	}
+	async listObjects(prefix, options) {
+		const resolvedBucket = this.getBucket(options?.bucket);
+		const s3 = await loadS3();
+		const client = await this.getClient();
+		const folderPrefix = listingPrefix(prefix);
+		const command = new s3.ListObjectsV2Command({
+			Bucket: resolvedBucket,
+			Prefix: folderPrefix,
+			MaxKeys: options?.maxResults ?? 1e3,
+			ContinuationToken: options?.pageToken,
+			Delimiter: "/"
+		});
+		const response = await client.send(command).catch((error) => {
+			throw misconfiguredOr(error, resolvedBucket);
+		});
+		return {
+			items: (response.Contents || []).filter((obj) => obj.Key !== folderPrefix).map((obj) => ({
+				bucket: resolvedBucket,
+				fullPath: obj.Key || "",
+				name: (obj.Key || "").split("/").pop() || "",
+				...typeof obj.Size === "number" ? { size: obj.Size } : {},
+				...obj.LastModified instanceof Date ? { updated: obj.LastModified.toISOString() } : {},
+				parent: null,
+				root: null,
+				toString: () => `s3://${resolvedBucket}/${obj.Key}`
+			})),
+			prefixes: (response.CommonPrefixes || []).map((common) => {
+				const folder = folderKey(common.Prefix || "");
+				return {
+					bucket: resolvedBucket,
+					fullPath: folder,
+					name: folder.split("/").pop() || "",
+					parent: null,
+					root: null,
+					toString: () => `s3://${resolvedBucket}/${folder}`
+				};
+			}),
+			nextPageToken: response.NextContinuationToken
+		};
+	}
+};
+/** The error name and HTTP status an SDK error carries, read without assuming its shape. */
+function s3ErrorFacts(error) {
+	if (typeof error !== "object" || error === null) return {};
+	const name = "name" in error && typeof error.name === "string" ? error.name : void 0;
+	const meta = "$metadata" in error ? error.$metadata : void 0;
+	return {
+		name,
+		status: typeof meta === "object" && meta !== null && "httpStatusCode" in meta && typeof meta.httpStatusCode === "number" ? meta.httpStatusCode : void 0
+	};
+}
+/**
+* A missing object, as `GetObject` (`NoSuchKey`) and `HeadObject` (`NotFound`, no body) report it.
+*
+* Not a missing bucket, which is a 404 too: read as a missing object, a typo in
+* `S3_BUCKET` made every file of the deployment "not found", and a delete
+* report success. (A `HeadObject` on a missing bucket carries no error name, so
+* that one call still cannot tell the two apart.)
+*/
+function isS3NotFound(error) {
+	const { name, status } = s3ErrorFacts(error);
+	if (name === "NoSuchBucket") return false;
+	return name === "NoSuchKey" || name === "NotFound" || status === 404;
+}
+/** What S3 answers when the deployment's configuration, not the request, is wrong. */
+var MISCONFIGURATION_ERRORS = /* @__PURE__ */ new Set([
+	"NoSuchBucket",
+	"AccessDenied",
+	"InvalidAccessKeyId",
+	"SignatureDoesNotMatch"
+]);
+/**
+* A provider error that says this deployment's storage is misconfigured, as a
+* `502 STORAGE_MISCONFIGURED` naming the bucket — or the error as it was.
+*
+* These used to reach the caller as a bare 500 "Internal Server Error", with
+* nothing to say the bucket or its credentials were the problem.
+*/
+function misconfiguredOr(error, bucket) {
+	const { name } = s3ErrorFacts(error);
+	if (!name || !MISCONFIGURATION_ERRORS.has(name)) return error;
+	return new ApiError(502, "STORAGE_MISCONFIGURED", name === "NoSuchBucket" ? `The storage bucket "${bucket}" does not exist. Check the bucket name this source is configured with (S3_BUCKET, or S3_BUCKET__<KEY> for a named source).` : `The storage provider refused this deployment's credentials for bucket "${bucket}" (${name}). Check the access key and its permissions on the bucket.`, {
+		bucket,
+		reason: name
+	});
+}
+function isS3RangeNotSatisfiable(error) {
+	const { name, status } = s3ErrorFacts(error);
+	return name === "InvalidRange" || status === 416;
+}
+/** A Node response body — what the SDK hands over on Node — rather than a browser one. */
+function isByteIterable(value) {
+	return typeof value === "object" && value !== null && Symbol.asyncIterator in value;
+}
+//#endregion
+export { S3StorageController_exports as n, S3StorageController as t };
+
+//# sourceMappingURL=S3StorageController-Btx-6bJ5.js.map

package/dist/S3StorageController-Btx-6bJ5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3StorageController-Btx-6bJ5.js","names":[],"sources":["../src/storage/S3StorageController.ts"],"sourcesContent":["/**\n * S3-compatible storage controller (works with AWS S3 and MinIO)\n */\n\nimport type { S3Client as S3ClientType, } from \"@aws-sdk/client-s3\";\nimport {\n    DEFAULT_MAX_FILE_SIZE,\n    S3StorageConfig,\n    StorageController,\n    type StoredObjectInfo,\n    type StoredObjectRange,\n    type PutObjectOptions,\n    type StoredObjectStream\n} from \"./types\";\nimport { folderKey, listingPrefix } from \"./keys\";\nimport { webStreamFrom } from \"./streams\";\nimport { ApiError } from \"../api/errors\";\nimport { validateUploadedFile } from \"./upload-validation\";\nimport {\n    DownloadConfig,\n    DownloadMetadata,\n    StorageListResult,\n    StorageReference,\n    UploadFileProps,\n    UploadFileResult\n} from \"@rebasepro/types\";\n\nlet _s3Module: typeof import(\"@aws-sdk/client-s3\") | undefined;\nlet _presignerModule: typeof import(\"@aws-sdk/s3-request-presigner\") | undefined;\n\nasync function loadS3() {\n    if (!_s3Module) {\n        try {\n            _s3Module = await import(\"@aws-sdk/client-s3\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/client-s3 is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _s3Module;\n}\n\nasync function loadPresigner() {\n    if (!_presignerModule) {\n        try {\n            _presignerModule = await import(\"@aws-sdk/s3-request-presigner\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/s3-request-presigner is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _presignerModule;\n}\n\n/** Files up to this size are one `PutObject`; larger ones are uploaded in parts of (at least) this size. */\nconst MULTIPART_PART_SIZE = 8 * 1024 * 1024;\n/** S3's limit on the parts of one upload. */\nconst MAX_MULTIPART_PARTS = 10_000;\n\n/**\n * S3-compatible storage implementation\n * Works with AWS S3 and MinIO (with forcePathStyle option)\n */\nexport class S3StorageController implements StorageController {\n    private config: S3StorageConfig;\n    private _client: S3ClientType | undefined;\n\n    constructor(config: S3StorageConfig) {\n        this.config = config;\n    }\n\n    /**\n     * Lazily create and cache the S3 client on first use\n     */\n    private async getClient(): Promise<S3ClientType> {\n        if (!this._client) {\n            const s3 = await loadS3();\n            this._client = new s3.S3Client({\n                region: this.config.region || \"us-east-1\",\n                endpoint: this.config.endpoint,\n                forcePathStyle: this.config.forcePathStyle ?? !!this.config.endpoint, // Auto-enable for custom endpoints (MinIO)\n                credentials: {\n                    accessKeyId: this.config.accessKeyId,\n                    secretAccessKey: this.config.secretAccessKey\n                }\n            });\n        }\n        return this._client;\n    }\n\n    getType(): \"s3\" {\n        return \"s3\";\n    }\n\n    /**\n     * The configured bucket, and the logical `default` that maps to it.\n     *\n     * Any other name went straight to S3 as a bucket name, so the request\n     * parameter was a way to address *any* bucket the deployment's credentials\n     * can reach — and a mistyped one came back as \"file not found\".\n     */\n    knownBuckets(): string[] {\n        return [\"default\", this.config.bucket];\n    }\n\n    /** See {@link StorageController.maxFileSize}. */\n    maxFileSize(): number {\n        return this.config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n    }\n\n    /**\n     * Validate file before upload\n     */\n    private validateFile(file: File): void {\n        validateUploadedFile(file, this.maxFileSize(), this.config.allowedMimeTypes);\n    }\n\n    /**\n     * Get the bucket name - either from parameter or config\n     */\n    private getBucket(bucket?: string): string {\n        // \"default\" is a logical bucket name used by local storage;\n        // for S3 it should resolve to the configured bucket.\n        if (!bucket || bucket === \"default\") return this.config.bucket;\n        return bucket;\n    }\n\n    async putObject({\n        file,\n        key,\n        metadata,\n        bucket\n    }: UploadFileProps, options?: PutObjectOptions): Promise<UploadFileResult> {\n        if (options?.uploadLimits !== false) this.validateFile(file);\n\n        const usedBucket = this.getBucket(bucket);\n        const s3 = await loadS3();\n        const client = await this.getClient();\n        const target = {\n            Bucket: usedBucket,\n            Key: key,\n            ContentType: file.type,\n            Metadata: metadata ? this.flattenMetadata(metadata) : undefined\n        };\n\n        if (file.size <= MULTIPART_PART_SIZE) {\n            // One request from one buffer, as always: a small file is no bigger\n            // than a part. `Buffer.from(arrayBuffer)` is a view, not a copy.\n            await client.send(new s3.PutObjectCommand({ ...target, Body: Buffer.from(await file.arrayBuffer()) }))\n                .catch((error: unknown) => { throw misconfiguredOr(error, usedBucket); });\n        } else {\n            await this.putMultipart(target, file);\n        }\n\n        return {\n            key,\n            bucket: usedBucket,\n            storageUrl: `s3://${usedBucket}/${key}`\n        };\n    }\n\n    /**\n     * Upload a large file in parts, one part in memory at a time.\n     *\n     * Reading the whole file into one buffer held it twice over (the\n     * `arrayBuffer()`, then the SDK's view and the multipart parser's copy\n     * before it), and `PutObject` stops at 5 GB regardless. A slice of a\n     * `File` reads only that range — from disk, for the disk-backed files TUS\n     * and backups hand over — so memory is one part whatever the file's size.\n     * A failure aborts the upload: no partial object appears at the key, and\n     * no orphaned parts are kept (and billed).\n     */\n    private async putMultipart(\n        target: { Bucket: string; Key: string; ContentType: string; Metadata?: Record<string, string> },\n        file: Blob\n    ): Promise<void> {\n        const s3 = await loadS3();\n        const client = await this.getClient();\n        // At most 10,000 parts: a part grows past 8 MiB only beyond 80 GB.\n        const partSize = Math.max(MULTIPART_PART_SIZE, Math.ceil(file.size / MAX_MULTIPART_PARTS));\n        const { UploadId } = await client.send(new s3.CreateMultipartUploadCommand(target))\n            .catch((error: unknown) => { throw misconfiguredOr(error, target.Bucket); });\n        if (!UploadId) throw new Error(`S3 did not start a multipart upload for ${target.Key}.`);\n        const { Bucket, Key } = target;\n        try {\n            const parts: { ETag?: string; PartNumber: number }[] = [];\n            for (let offset = 0, PartNumber = 1; offset < file.size; offset += partSize, PartNumber++) {\n                const Body = Buffer.from(await file.slice(offset, Math.min(offset + partSize, file.size)).arrayBuffer());\n                const { ETag } = await client.send(new s3.UploadPartCommand({ Bucket, Key, UploadId, PartNumber, Body }));\n                parts.push({ ETag, PartNumber });\n            }\n            await client.send(new s3.CompleteMultipartUploadCommand({ Bucket, Key, UploadId, MultipartUpload: { Parts: parts } }));\n        } catch (error: unknown) {\n            await client.send(new s3.AbortMultipartUploadCommand({ Bucket, Key, UploadId })).catch(() => undefined);\n            throw misconfiguredOr(error, Bucket);\n        }\n    }\n\n    /**\n     * Flatten nested metadata to string values (S3 requirement)\n     */\n    private flattenMetadata(metadata: Record<string, unknown>): Record<string, string> {\n        const flattened: Record<string, string> = {};\n        for (const [key, value] of Object.entries(metadata)) {\n            if (typeof value === \"string\") {\n                flattened[key] = value;\n            } else if (value !== undefined && value !== null) {\n                flattened[key] = JSON.stringify(value);\n            }\n        }\n        return flattened;\n    }\n\n    async getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig> {\n        // Handle s3:// and gs:// URLs for backward compatibility\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const presigner = await loadPresigner();\n            const client = await this.getClient();\n\n            // First check if the object exists and get metadata\n            const headCommand = new s3.HeadObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const headResult = await client.send(headCommand);\n\n            // Generate a signed URL\n            const getCommand = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            // Good for an hour. Server-side callers only: no route hands it out.\n            const url = await presigner.getSignedUrl(client, getCommand, { expiresIn: 3600 });\n\n            const metadata: DownloadMetadata = {\n                bucket: resolvedBucket,\n                fullPath: resolvedPath,\n                name: resolvedPath.split(\"/\").pop() || resolvedPath,\n                size: headResult.ContentLength || 0,\n                contentType: headResult.ContentType || \"application/octet-stream\",\n                customMetadata: headResult.Metadata || {}\n            };\n\n            return {\n                url,\n                metadata\n            };\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) {\n                return {\n                    url: null,\n                    fileNotFound: true\n                };\n            }\n            throw misconfiguredOr(error, resolvedBucket);\n        }\n    }\n\n    async getObject(key: string, bucket?: string): Promise<File | null> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const client = await this.getClient();\n\n            const command = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const response = await client.send(command);\n\n            if (!response.Body) {\n                return null;\n            }\n\n            // Convert stream to buffer\n            const chunks: Uint8Array[] = [];\n            for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {\n                chunks.push(chunk);\n            }\n            const buffer = Buffer.concat(chunks);\n\n            const contentType = response.ContentType || \"application/octet-stream\";\n            const fileName = resolvedPath.split(\"/\").pop() || resolvedPath;\n\n            const blob = new Blob([buffer], { type: contentType });\n            // The object's own version. Left out, `File` stamps `Date.now()`,\n            // and the routes build the `ETag`, `Last-Modified` and the\n            // transform cache key from this — so every read was a new version:\n            // no 304, no cache hit, and a fresh rendition written per request.\n            return new File([blob], fileName, {\n                type: contentType,\n                lastModified: response.LastModified?.getTime()\n            });\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) {\n                return null;\n            }\n            throw misconfiguredOr(error, resolvedBucket);\n        }\n    }\n\n    /**\n     * The bucket and key a call addresses: an `s3://` or `gs://` URL names its\n     * own bucket, anything else is a key in the given (or configured) bucket.\n     */\n    private resolveLocation(key: string, bucket?: string): { bucket: string; key: string } {\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const withoutProtocol = key.substring(match[0].length);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                return { bucket: withoutProtocol.substring(0, firstSlash), key: withoutProtocol.substring(firstSlash + 1) };\n            }\n        }\n        return { bucket: this.getBucket(bucket), key };\n    }\n\n    /**\n     * See {@link StorageController.getMetadata}. One `HeadObject`. Without it,\n     * `GET /metadata/*` fell back to `getSignedUrl`, which signed a URL per\n     * call — ~134 µs of CPU — only for the route to throw it away.\n     */\n    async getMetadata(key: string, bucket?: string): Promise<DownloadMetadata | null> {\n        const location = this.resolveLocation(key, bucket);\n        const s3 = await loadS3();\n        const client = await this.getClient();\n        try {\n            const head = await client.send(new s3.HeadObjectCommand({ Bucket: location.bucket, Key: location.key }));\n            return {\n                bucket: location.bucket,\n                fullPath: location.key,\n                name: location.key.split(\"/\").pop() || location.key,\n                size: head.ContentLength || 0,\n                contentType: head.ContentType || \"application/octet-stream\",\n                customMetadata: head.Metadata || {}\n            };\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) return null;\n            throw misconfiguredOr(error, location.bucket);\n        }\n    }\n\n    /** See {@link StorageController.statObject}. One `HeadObject`; no body is read. */\n    async statObject(key: string, bucket?: string): Promise<StoredObjectInfo | null> {\n        const location = this.resolveLocation(key, bucket);\n        const s3 = await loadS3();\n        const client = await this.getClient();\n        try {\n            const head = await client.send(new s3.HeadObjectCommand({ Bucket: location.bucket, Key: location.key }));\n            return {\n                size: head.ContentLength ?? 0,\n                contentType: head.ContentType || \"application/octet-stream\",\n                // The object's version — see `getObject` on why a missing one\n                // must not become a stable value.\n                lastModified: head.LastModified?.getTime() ?? Date.now()\n            };\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) return null;\n            throw misconfiguredOr(error, location.bucket);\n        }\n    }\n\n    /**\n     * See {@link StorageController.getObjectStream}. One `GetObject`, with a\n     * `Range` when one is asked for, so only those bytes leave the bucket; the\n     * body is handed on as it arrives rather than collected first.\n     */\n    async getObjectStream(\n        key: string,\n        options?: { bucket?: string; range?: StoredObjectRange }\n    ): Promise<StoredObjectStream | null> {\n        const location = this.resolveLocation(key, options?.bucket);\n        const range = options?.range;\n        const s3 = await loadS3();\n        const client = await this.getClient();\n        let response;\n        try {\n            response = await client.send(new s3.GetObjectCommand({\n                Bucket: location.bucket,\n                Key: location.key,\n                ...(range ? { Range: `bytes=${range.start}-${range.end}` } : {})\n            }));\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) return null;\n            // The object shrank below the range since it was described. Read\n            // it whole: the caller serves a whole object as a 200, which HTTP\n            // allows for any range request.\n            if (range && isS3RangeNotSatisfiable(error)) return this.getObjectStream(key, { bucket: options?.bucket });\n            throw misconfiguredOr(error, location.bucket);\n        }\n        const body = response.Body;\n        if (!body) return null;\n\n        // A ranged answer says the whole object's size after the slash of its\n        // `Content-Range`. A store that ignored the `Range` sent no\n        // `Content-Range` and the whole object, which is what this then says.\n        const total = range ? /\\/(\\d+)\\s*$/.exec(response.ContentRange ?? \"\")?.[1] : undefined;\n        const served = range && total !== undefined ? range : undefined;\n        return {\n            stream: isByteIterable(body) ? webStreamFrom(body) : body.transformToWebStream(),\n            size: total !== undefined ? Number(total) : response.ContentLength ?? 0,\n            contentType: response.ContentType || \"application/octet-stream\",\n            lastModified: response.LastModified?.getTime() ?? Date.now(),\n            ...(served ? { range: served } : {})\n        };\n    }\n\n    async deleteObject(key: string, bucket?: string): Promise<void> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.DeleteObjectCommand({\n            Bucket: resolvedBucket,\n            Key: resolvedPath\n        });\n\n        // Deleting something that is already gone is the outcome the caller\n        // wanted, so it is not an error. AWS itself answers DeleteObject with\n        // 204 for a key that never existed, but S3-compatible backends (MinIO,\n        // Ceph, R2 in some configurations) do raise NoSuchKey — and the local\n        // controller has always returned quietly in this case. Without this,\n        // which of those a deployment happens to run decides whether\n        // `DELETE /api/storage/:path` on a stale reference is a 200 or a 500.\n        try {\n            await client.send(command);\n        } catch (error: unknown) {\n            if (isS3NotFound(error)) {\n                return;\n            }\n            throw misconfiguredOr(error, resolvedBucket);\n        }\n    }\n\n    async listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult> {\n        const resolvedBucket = this.getBucket(options?.bucket);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const folderPrefix = listingPrefix(prefix);\n        const command = new s3.ListObjectsV2Command({\n            Bucket: resolvedBucket,\n            Prefix: folderPrefix,\n            MaxKeys: options?.maxResults ?? 1000,\n            ContinuationToken: options?.pageToken,\n            Delimiter: \"/\" // This gives us folder-like behavior\n        });\n\n        const response = await client.send(command)\n            .catch((error: unknown) => { throw misconfiguredOr(error, resolvedBucket); });\n\n        // The folder's own marker — the zero-byte `folder/` object that\n        // `POST /folder` writes — is in `Contents` when the listed prefix is\n        // that folder. It is how the folder exists, not something in it, and\n        // listed it is an entry with an empty name. Local storage has no such\n        // object to list.\n        const objects = (response.Contents || []).filter(obj => obj.Key !== folderPrefix);\n        const items: StorageReference[] = objects.map(obj => ({\n            bucket: resolvedBucket,\n            fullPath: obj.Key || \"\",\n            name: (obj.Key || \"\").split(\"/\").pop() || \"\",\n            // What the listing already carries, so a folder can be shown\n            // without a HEAD per file. ListObjectsV2 has no content type.\n            ...(typeof obj.Size === \"number\" ? { size: obj.Size } : {}),\n            ...(obj.LastModified instanceof Date ? { updated: obj.LastModified.toISOString() } : {}),\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${obj.Key}`\n        }));\n\n        const prefixes: StorageReference[] = (response.CommonPrefixes || []).map(common => {\n            // Without the trailing slash S3 puts on a common prefix, so a\n            // `fullPath` from a listing is a key any controller accepts.\n            const folder = folderKey(common.Prefix || \"\");\n            return {\n                bucket: resolvedBucket,\n                fullPath: folder,\n                name: folder.split(\"/\").pop() || \"\",\n                parent: null as never,\n                root: null as never,\n                toString: () => `s3://${resolvedBucket}/${folder}`\n            };\n        });\n\n        return {\n            items,\n            prefixes,\n            nextPageToken: response.NextContinuationToken\n        };\n    }\n}\n\n/** The error name and HTTP status an SDK error carries, read without assuming its shape. */\nfunction s3ErrorFacts(error: unknown): { name?: string; status?: number } {\n    if (typeof error !== \"object\" || error === null) return {};\n    const name = \"name\" in error && typeof error.name === \"string\" ? error.name : undefined;\n    const meta = \"$metadata\" in error ? error.$metadata : undefined;\n    const status = typeof meta === \"object\" && meta !== null && \"httpStatusCode\" in meta && typeof meta.httpStatusCode === \"number\"\n        ? meta.httpStatusCode\n        : undefined;\n    return { name, status };\n}\n\n/**\n * A missing object, as `GetObject` (`NoSuchKey`) and `HeadObject` (`NotFound`, no body) report it.\n *\n * Not a missing bucket, which is a 404 too: read as a missing object, a typo in\n * `S3_BUCKET` made every file of the deployment \"not found\", and a delete\n * report success. (A `HeadObject` on a missing bucket carries no error name, so\n * that one call still cannot tell the two apart.)\n */\nfunction isS3NotFound(error: unknown): boolean {\n    const { name, status } = s3ErrorFacts(error);\n    if (name === \"NoSuchBucket\") return false;\n    return name === \"NoSuchKey\" || name === \"NotFound\" || status === 404;\n}\n\n/** What S3 answers when the deployment's configuration, not the request, is wrong. */\nconst MISCONFIGURATION_ERRORS = new Set([\"NoSuchBucket\", \"AccessDenied\", \"InvalidAccessKeyId\", \"SignatureDoesNotMatch\"]);\n\n/**\n * A provider error that says this deployment's storage is misconfigured, as a\n * `502 STORAGE_MISCONFIGURED` naming the bucket — or the error as it was.\n *\n * These used to reach the caller as a bare 500 \"Internal Server Error\", with\n * nothing to say the bucket or its credentials were the problem.\n */\nfunction misconfiguredOr(error: unknown, bucket: string): unknown {\n    const { name } = s3ErrorFacts(error);\n    if (!name || !MISCONFIGURATION_ERRORS.has(name)) return error;\n    return new ApiError(\n        502,\n        \"STORAGE_MISCONFIGURED\",\n        name === \"NoSuchBucket\"\n            ? `The storage bucket \"${bucket}\" does not exist. Check the bucket name this source is configured with (S3_BUCKET, or S3_BUCKET__<KEY> for a named source).`\n            : `The storage provider refused this deployment's credentials for bucket \"${bucket}\" (${name}). Check the access key and its permissions on the bucket.`,\n        { bucket, reason: name }\n    );\n}\n\nfunction isS3RangeNotSatisfiable(error: unknown): boolean {\n    const { name, status } = s3ErrorFacts(error);\n    return name === \"InvalidRange\" || status === 416;\n}\n\n/** A Node response body — what the SDK hands over on Node — rather than a browser one. */\nfunction isByteIterable(value: unknown): value is AsyncIterable<Uint8Array> {\n    return typeof value === \"object\" && value !== null && Symbol.asyncIterator in value;\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAI;AACJ,IAAI;AAEJ,eAAe,SAAS;CACpB,IAAI,CAAC,WACD,IAAI;EACA,YAAY,MAAM,OAAO;CAC7B,QAAQ;EACJ,MAAM,IAAI,MACN,sHAEJ;CACJ;CAEJ,OAAO;AACX;AAEA,eAAe,gBAAgB;CAC3B,IAAI,CAAC,kBACD,IAAI;EACA,mBAAmB,MAAM,OAAO;CACpC,QAAQ;EACJ,MAAM,IAAI,MACN,iIAEJ;CACJ;CAEJ,OAAO;AACX;;AAGA,IAAM,sBAAsB,IAAI,OAAO;;AAEvC,IAAM,sBAAsB;;;;;AAM5B,IAAa,sBAAb,MAA8D;CAC1D;CACA;CAEA,YAAY,QAAyB;EACjC,KAAK,SAAS;CAClB;;;;CAKA,MAAc,YAAmC;EAC7C,IAAI,CAAC,KAAK,SAAS;GACf,MAAM,KAAK,MAAM,OAAO;GACxB,KAAK,UAAU,IAAI,GAAG,SAAS;IAC3B,QAAQ,KAAK,OAAO,UAAU;IAC9B,UAAU,KAAK,OAAO;IACtB,gBAAgB,KAAK,OAAO,kBAAkB,CAAC,CAAC,KAAK,OAAO;IAC5D,aAAa;KACT,aAAa,KAAK,OAAO;KACzB,iBAAiB,KAAK,OAAO;IACjC;GACJ,CAAC;EACL;EACA,OAAO,KAAK;CAChB;CAEA,UAAgB;EACZ,OAAO;CACX;;;;;;;;CASA,eAAyB;EACrB,OAAO,CAAC,WAAW,KAAK,OAAO,MAAM;CACzC;;CAGA,cAAsB;EAClB,OAAO,KAAK,OAAO,eAAA;CACvB;;;;CAKA,aAAqB,MAAkB;EACnC,qBAAqB,MAAM,KAAK,YAAY,GAAG,KAAK,OAAO,gBAAgB;CAC/E;;;;CAKA,UAAkB,QAAyB;EAGvC,IAAI,CAAC,UAAU,WAAW,WAAW,OAAO,KAAK,OAAO;EACxD,OAAO;CACX;CAEA,MAAM,UAAU,EACZ,MACA,KACA,UACA,UACgB,SAAuD;EACvE,IAAI,SAAS,iBAAiB,OAAO,KAAK,aAAa,IAAI;EAE3D,MAAM,aAAa,KAAK,UAAU,MAAM;EACxC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,SAAS;GACX,QAAQ;GACR,KAAK;GACL,aAAa,KAAK;GAClB,UAAU,WAAW,KAAK,gBAAgB,QAAQ,IAAI,KAAA;EAC1D;EAEA,IAAI,KAAK,QAAQ,qBAGb,MAAM,OAAO,KAAK,IAAI,GAAG,iBAAiB;GAAE,GAAG;GAAQ,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAAE,CAAC,CAAC,CAAC,CACjG,OAAO,UAAmB;GAAE,MAAM,gBAAgB,OAAO,UAAU;EAAG,CAAC;OAE5E,MAAM,KAAK,aAAa,QAAQ,IAAI;EAGxC,OAAO;GACH;GACA,QAAQ;GACR,YAAY,QAAQ,WAAW,GAAG;EACtC;CACJ;;;;;;;;;;;;CAaA,MAAc,aACV,QACA,MACa;EACb,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,WAAW,KAAK,IAAI,qBAAqB,KAAK,KAAK,KAAK,OAAO,mBAAmB,CAAC;EACzF,MAAM,EAAE,aAAa,MAAM,OAAO,KAAK,IAAI,GAAG,6BAA6B,MAAM,CAAC,CAAC,CAC9E,OAAO,UAAmB;GAAE,MAAM,gBAAgB,OAAO,OAAO,MAAM;EAAG,CAAC;EAC/E,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,2CAA2C,OAAO,IAAI,EAAE;EACvF,MAAM,EAAE,QAAQ,QAAQ;EACxB,IAAI;GACA,MAAM,QAAiD,CAAC;GACxD,KAAK,IAAI,SAAS,GAAG,aAAa,GAAG,SAAS,KAAK,MAAM,UAAU,UAAU,cAAc;IACvF,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,MAAM,QAAQ,KAAK,IAAI,SAAS,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACvG,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,IAAI,GAAG,kBAAkB;KAAE;KAAQ;KAAK;KAAU;KAAY;IAAK,CAAC,CAAC;IACxG,MAAM,KAAK;KAAE;KAAM;IAAW,CAAC;GACnC;GACA,MAAM,OAAO,KAAK,IAAI,GAAG,+BAA+B;IAAE;IAAQ;IAAK;IAAU,iBAAiB,EAAE,OAAO,MAAM;GAAE,CAAC,CAAC;EACzH,SAAS,OAAgB;GACrB,MAAM,OAAO,KAAK,IAAI,GAAG,4BAA4B;IAAE;IAAQ;IAAK;GAAS,CAAC,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACtG,MAAM,gBAAgB,OAAO,MAAM;EACvC;CACJ;;;;CAKA,gBAAwB,UAA2D;EAC/E,MAAM,YAAoC,CAAC;EAC3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAC9C,IAAI,OAAO,UAAU,UACjB,UAAU,OAAO;OACd,IAAI,UAAU,KAAA,KAAa,UAAU,MACxC,UAAU,OAAO,KAAK,UAAU,KAAK;EAG7C,OAAO;CACX;CAEA,MAAM,aAAa,KAAa,QAA0C;EAEtE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,YAAY,MAAM,cAAc;GACtC,MAAM,SAAS,MAAM,KAAK,UAAU;GAGpC,MAAM,cAAc,IAAI,GAAG,kBAAkB;IACzC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,aAAa,MAAM,OAAO,KAAK,WAAW;GAGhD,MAAM,aAAa,IAAI,GAAG,iBAAiB;IACvC,QAAQ;IACR,KAAK;GACT,CAAC;GAcD,OAAO;IACH,KAAA,MAZc,UAAU,aAAa,QAAQ,YAAY,EAAE,WAAW,KAAK,CAAC;IAa5E,UAAA;KAVA,QAAQ;KACR,UAAU;KACV,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACvC,MAAM,WAAW,iBAAiB;KAClC,aAAa,WAAW,eAAe;KACvC,gBAAgB,WAAW,YAAY,CAAC;IAKxC;GACJ;EACJ,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAClB,OAAO;IACH,KAAK;IACL,cAAc;GAClB;GAEJ,MAAM,gBAAgB,OAAO,cAAc;EAC/C;CACJ;CAEA,MAAM,UAAU,KAAa,QAAuC;EAEhE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,SAAS,MAAM,KAAK,UAAU;GAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;IACpC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;GAE1C,IAAI,CAAC,SAAS,MACV,OAAO;GAIX,MAAM,SAAuB,CAAC;GAC9B,WAAW,MAAM,SAAS,SAAS,MAC/B,OAAO,KAAK,KAAK;GAErB,MAAM,SAAS,OAAO,OAAO,MAAM;GAEnC,MAAM,cAAc,SAAS,eAAe;GAC5C,MAAM,WAAW,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAElD,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,YAAY,CAAC;GAKrD,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU;IAC9B,MAAM;IACN,cAAc,SAAS,cAAc,QAAQ;GACjD,CAAC;EACL,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAClB,OAAO;GAEX,MAAM,gBAAgB,OAAO,cAAc;EAC/C;CACJ;;;;;CAMA,gBAAwB,KAAa,QAAkD;EACnF,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,kBAAkB,IAAI,UAAU,MAAM,EAAE,CAAC,MAAM;GACrD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GACb,OAAO;IAAE,QAAQ,gBAAgB,UAAU,GAAG,UAAU;IAAG,KAAK,gBAAgB,UAAU,aAAa,CAAC;GAAE;EAElH;EACA,OAAO;GAAE,QAAQ,KAAK,UAAU,MAAM;GAAG;EAAI;CACjD;;;;;;CAOA,MAAM,YAAY,KAAa,QAAmD;EAC9E,MAAM,WAAW,KAAK,gBAAgB,KAAK,MAAM;EACjD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,IAAI;GACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,kBAAkB;IAAE,QAAQ,SAAS;IAAQ,KAAK,SAAS;GAAI,CAAC,CAAC;GACvG,OAAO;IACH,QAAQ,SAAS;IACjB,UAAU,SAAS;IACnB,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS;IAChD,MAAM,KAAK,iBAAiB;IAC5B,aAAa,KAAK,eAAe;IACjC,gBAAgB,KAAK,YAAY,CAAC;GACtC;EACJ,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAAG,OAAO;GAChC,MAAM,gBAAgB,OAAO,SAAS,MAAM;EAChD;CACJ;;CAGA,MAAM,WAAW,KAAa,QAAmD;EAC7E,MAAM,WAAW,KAAK,gBAAgB,KAAK,MAAM;EACjD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,IAAI;GACA,MAAM,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,kBAAkB;IAAE,QAAQ,SAAS;IAAQ,KAAK,SAAS;GAAI,CAAC,CAAC;GACvG,OAAO;IACH,MAAM,KAAK,iBAAiB;IAC5B,aAAa,KAAK,eAAe;IAGjC,cAAc,KAAK,cAAc,QAAQ,KAAK,KAAK,IAAI;GAC3D;EACJ,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAAG,OAAO;GAChC,MAAM,gBAAgB,OAAO,SAAS,MAAM;EAChD;CACJ;;;;;;CAOA,MAAM,gBACF,KACA,SACkC;EAClC,MAAM,WAAW,KAAK,gBAAgB,KAAK,SAAS,MAAM;EAC1D,MAAM,QAAQ,SAAS;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,IAAI;EACJ,IAAI;GACA,WAAW,MAAM,OAAO,KAAK,IAAI,GAAG,iBAAiB;IACjD,QAAQ,SAAS;IACjB,KAAK,SAAS;IACd,GAAI,QAAQ,EAAE,OAAO,SAAS,MAAM,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC;GAClE,CAAC,CAAC;EACN,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAAG,OAAO;GAIhC,IAAI,SAAS,wBAAwB,KAAK,GAAG,OAAO,KAAK,gBAAgB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;GACzG,MAAM,gBAAgB,OAAO,SAAS,MAAM;EAChD;EACA,MAAM,OAAO,SAAS;EACtB,IAAI,CAAC,MAAM,OAAO;EAKlB,MAAM,QAAQ,QAAQ,cAAc,KAAK,SAAS,gBAAgB,EAAE,CAAC,GAAG,KAAK,KAAA;EAC7E,MAAM,SAAS,SAAS,UAAU,KAAA,IAAY,QAAQ,KAAA;EACtD,OAAO;GACH,QAAQ,eAAe,IAAI,IAAI,cAAc,IAAI,IAAI,KAAK,qBAAqB;GAC/E,MAAM,UAAU,KAAA,IAAY,OAAO,KAAK,IAAI,SAAS,iBAAiB;GACtE,aAAa,SAAS,eAAe;GACrC,cAAc,SAAS,cAAc,QAAQ,KAAK,KAAK,IAAI;GAC3D,GAAI,SAAS,EAAE,OAAO,OAAO,IAAI,CAAC;EACtC;CACJ;CAEA,MAAM,aAAa,KAAa,QAAgC;EAE5D,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,oBAAoB;GACvC,QAAQ;GACR,KAAK;EACT,CAAC;EASD,IAAI;GACA,MAAM,OAAO,KAAK,OAAO;EAC7B,SAAS,OAAgB;GACrB,IAAI,aAAa,KAAK,GAClB;GAEJ,MAAM,gBAAgB,OAAO,cAAc;EAC/C;CACJ;CAEA,MAAM,YAAY,QAAgB,SAIH;EAC3B,MAAM,iBAAiB,KAAK,UAAU,SAAS,MAAM;EAErD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,eAAe,cAAc,MAAM;EACzC,MAAM,UAAU,IAAI,GAAG,qBAAqB;GACxC,QAAQ;GACR,QAAQ;GACR,SAAS,SAAS,cAAc;GAChC,mBAAmB,SAAS;GAC5B,WAAW;EACf,CAAC;EAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO,CAAC,CACtC,OAAO,UAAmB;GAAE,MAAM,gBAAgB,OAAO,cAAc;EAAG,CAAC;EAmChF,OAAO;GACH,QA7Ba,SAAS,YAAY,CAAC,EAAA,CAAG,QAAO,QAAO,IAAI,QAAQ,YAClC,CAAA,CAAQ,KAAI,SAAQ;IAClD,QAAQ;IACR,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IAG1C,GAAI,OAAO,IAAI,SAAS,WAAW,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACzD,GAAI,IAAI,wBAAwB,OAAO,EAAE,SAAS,IAAI,aAAa,YAAY,EAAE,IAAI,CAAC;IACtF,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,IAAI;GAClD,EAiBI;GACA,WAhBkC,SAAS,kBAAkB,CAAC,EAAA,CAAG,KAAI,WAAU;IAG/E,MAAM,SAAS,UAAU,OAAO,UAAU,EAAE;IAC5C,OAAO;KACH,QAAQ;KACR,UAAU;KACV,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACjC,QAAQ;KACR,MAAM;KACN,gBAAgB,QAAQ,eAAe,GAAG;IAC9C;GACJ,CAII;GACA,eAAe,SAAS;EAC5B;CACJ;AACJ;;AAGA,SAAS,aAAa,OAAoD;CACtE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,CAAC;CACzD,MAAM,OAAO,UAAU,SAAS,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAA;CAC9E,MAAM,OAAO,eAAe,QAAQ,MAAM,YAAY,KAAA;CAItD,OAAO;EAAE;EAAM,QAHA,OAAO,SAAS,YAAY,SAAS,QAAQ,oBAAoB,QAAQ,OAAO,KAAK,mBAAmB,WACjH,KAAK,iBACL,KAAA;CACgB;AAC1B;;;;;;;;;AAUA,SAAS,aAAa,OAAyB;CAC3C,MAAM,EAAE,MAAM,WAAW,aAAa,KAAK;CAC3C,IAAI,SAAS,gBAAgB,OAAO;CACpC,OAAO,SAAS,eAAe,SAAS,cAAc,WAAW;AACrE;;AAGA,IAAM,0CAA0B,IAAI,IAAI;CAAC;CAAgB;CAAgB;CAAsB;AAAuB,CAAC;;;;;;;;AASvH,SAAS,gBAAgB,OAAgB,QAAyB;CAC9D,MAAM,EAAE,SAAS,aAAa,KAAK;CACnC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,IAAI,IAAI,GAAG,OAAO;CACxD,OAAO,IAAI,SACP,KACA,yBACA,SAAS,iBACH,uBAAuB,OAAO,+HAC9B,0EAA0E,OAAO,KAAK,KAAK,6DACjG;EAAE;EAAQ,QAAQ;CAAK,CAC3B;AACJ;AAEA,SAAS,wBAAwB,OAAyB;CACtD,MAAM,EAAE,MAAM,WAAW,aAAa,KAAK;CAC3C,OAAO,SAAS,kBAAkB,WAAW;AACjD;;AAGA,SAAS,eAAe,OAAoD;CACxE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,iBAAiB;AAClF"}

package/dist/api/errors.d.ts

@@ -32,6 +32,29 @@ export declare function schemaDriftRemedy(): {
  * nobody has does.
  */
 export declare function isDataException(error: unknown): boolean;
+/**
+ * Did the request fail because the database could not be reached at all — not
+ * because it refused the statement, and not because some other service is down?
+ *
+ * Read off the error the database driver raised, wherever it sits in the cause
+ * chain:
+ *
+ * - a SQLSTATE that means the connection was refused or dropped (class `08`,
+ *   `57P01`–`57P03`). The database's own word, so it settles the question
+ *   either way: a SQLSTATE of any other class is the database answering;
+ * - node-postgres's own sentence for a socket that closed under a query;
+ * - a socket failure (`ECONNREFUSED`, `ENOTFOUND`, …), but only where it can
+ *   only be the database's: thrown as it is, which is how node-postgres hands
+ *   back a pool connection it could not open, or as the cause of a failed
+ *   Drizzle query (the wrapper that carries the statement). Under any other
+ *   wrapper it belongs to another client: `fetch failed` is a `fetch()` to
+ *   some other host, and an S3 call that cannot connect carries the AWS SDK's
+ *   `$metadata`. Answering those "the database is unreachable" would send an
+ *   operator to a database that is fine.
+ */
+export declare function isDatabaseUnreachable(error: unknown): boolean;
+/** What a caller is told when the database cannot be reached. Retryable, and not about them. */
+export declare const DATABASE_UNAVAILABLE_MESSAGE: string;
 /**
  * Standardized API error class.
  * Throw this from any route handler — the errorHandler middleware
@@ -81,6 +104,15 @@ export declare class ApiError extends Error {
     static conflict(message: string, code?: string, details?: unknown): ApiError;
     static internal(message: string, code?: string): ApiError;
     static serviceUnavailable(message: string, code?: string): ApiError;
+    /**
+     * `503 DATABASE_UNAVAILABLE`: the database could not be reached. What
+     * every door answers then — the data API, sign-in, the admin routes and
+     * the realtime socket — so a client sees one retryable answer, sent with
+     * `Retry-After`, rather than a permission failure or a crash.
+     *
+     * @see isDatabaseUnreachable
+     */
+    static databaseUnavailable(message?: string): ApiError;
 }
 /**
  * Canonical error response shape:

package/dist/api/live-schema-routes.d.ts

@@ -29,7 +29,7 @@
  * — `applySchemaChange` re-checks rather than trusting the plan it is handed.
  */
 import { Hono } from "hono";
-import { type CollectionPatch, type CollectionConfig, type DatabaseAdmin, type SchemaCommitPaths } from "@rebasepro/types";
+import { type AuthAdapter, type CollectionPatch, type CollectionConfig, type DatabaseAdmin, type SchemaCommitPaths } from "@rebasepro/types";
 import { HonoEnv } from "./types.js";
 import { type SchemaEditRepository } from "../schema-edit/apply-schema-change.js";
 import { type SchemaEditPolicy } from "../schema-edit/schema-edit-permissions.js";
@@ -110,7 +110,27 @@ export interface LiveSchemaRoutesConfig {
      * commit, a commit needs an author, and a credential is not an author.
      */
     policy?: SchemaEditPolicy;
+    /**
+     * The account behind a uid, for the commit's author line.
+     *
+     * The request's user is what its access token carries, and the built-in
+     * token carries a uid and roles — no name, no address — so without this a
+     * commit is authored by the uid. Absent, or answering nothing, the commit
+     * falls back to what the request carries.
+     */
+    resolveAuthorIdentity?: (uid: string) => Promise<AccountIdentity | null>;
+}
+/** What a commit's author line is made of. */
+export interface AccountIdentity {
+    displayName?: string | null;
+    email?: string | null;
 }
+/**
+ * The account behind a uid, read through the auth in use: its user-management
+ * lookup when it has one — a plain read — else `resolveUser`. `null` when the
+ * auth has neither, or knows no such account.
+ */
+export declare function readAccountIdentity(adapter: Pick<AuthAdapter, "userManagement" | "resolveUser"> | undefined, uid: string): Promise<AccountIdentity | null>;
 /**
  * What the panel posts about one collection.
  *
@@ -143,11 +163,15 @@ export interface ProposedChange {
  * `undefined` when the request carries no user — a service key, say — which
  * lets the repository fall back to its own git config rather than inventing a
  * name for somebody.
+ *
+ * The name and address the request carries win; what it lacks is read from
+ * the account through `resolveAccount`. A lookup that fails costs the commit
+ * its name, never the commit: the author falls back to the uid.
  */
-export declare function commitAuthor(user: unknown): {
+export declare function commitAuthor(user: unknown, resolveAccount?: (uid: string) => Promise<AccountIdentity | null>): Promise<{
     name: string;
     email: string;
-} | undefined;
+} | undefined>;
 /**
  * The change as a patch against the collection as it is.
  *