@stacksjs/storage 0.70.45 → 0.70.53

package/dist/index.js

@@ -13,916 +13,2104 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/copy.ts
-import { contains } from "@stacksjs/arrays";
-import { join } from "@stacksjs/path";
-
-// src/fs.ts
-import * as fs from "fs";
-import { existsSync, watch as fsWatch, mkdirSync, readFileSync, watchFile, writeFileSync } from "fs";
-function exists(path) {
-  return existsSync(path);
-}
-
-// src/copy.ts
-function copy(src, dest, exclude = []) {
-  if (Array.isArray(src)) {
-    src.forEach((file) => {
-      copy(file, dest, exclude);
-    });
-  } else {
-    if (fs.statSync(src).isDirectory())
-      copyFolder(src, dest, exclude);
-    else
-      copyFile(src, dest);
+// src/types.ts
+async function* createDirectoryListing(entries) {
+  for (const entry of entries) {
+    yield entry;
   }
 }
-function copyFile(src, dest) {
-  fs.copyFileSync(src, dest);
-}
-function copyFolder(src, dest, exclude = []) {
-  if (!fs.existsSync(dest))
-    fs.mkdirSync(dest, { recursive: true });
-  if (fs.existsSync(src)) {
-    fs.readdirSync(src).forEach((file) => {
-      if (!contains(join(src, file), exclude)) {
-        const srcPath = join(src, file);
-        const destPath = join(dest, file);
-        if (fs.statSync(srcPath).isDirectory())
-          copyFolder(srcPath, destPath, exclude);
-        else
-          fs.copyFileSync(srcPath, destPath);
-      }
-    });
+function normalizeExpiryToMilliseconds(expiry) {
+  if (expiry instanceof Date) {
+    return expiry.getTime() - Date.now();
   }
+  return expiry * 1000;
 }
-// src/delete.ts
-import { italic, log } from "@stacksjs/cli";
-import { err, handleError, ok } from "@stacksjs/error-handling";
-import { join as join3 } from "@stacksjs/path";
-
-// src/folders.ts
-import { join as join2 } from "@stacksjs/path";
-function isFolder(path) {
-  try {
-    return fs.statSync(path).isDirectory();
-  } catch {
-    return false;
+function normalizeExpiryToDate(expiry) {
+  if (expiry instanceof Date) {
+    return expiry;
   }
+  return new Date(Date.now() + expiry * 1000);
 }
-function isDir(path) {
-  return isFolder(path);
-}
-function doesFolderExist(path) {
-  return fs.existsSync(path);
-}
-function createFolder(dir) {
-  return new Promise((resolve, reject) => {
-    try {
-      fs.mkdirSync(dir, { recursive: true });
-      resolve();
-    } catch (err) {
-      reject(err);
-    }
-  });
+function isFile2(entry) {
+  return entry.type === "file";
 }
-function getFolders(dir) {
-  return fs.readdirSync(dir).filter((file) => {
-    return fs.statSync(join2(dir, file)).isDirectory();
-  });
+function isDirectory(entry) {
+  return entry.type === "directory";
 }
-var folders = {
-  isFolder,
-  doesFolderExist,
-  createFolder,
-  getFolders
-};
+var Visibility;
+var init_types = __esm(() => {
+  ((Visibility2) => {
+    Visibility2["PUBLIC"] = "public";
+    Visibility2["PRIVATE"] = "private";
+  })(Visibility ||= {});
+});
 
-// src/glob.ts
-var {Glob: BunGlob } = globalThis.Bun;
-function globSync(patterns, options) {
-  const patternArray = typeof patterns === "string" ? [patterns] : patterns;
-  const results = [];
-  for (const pattern of patternArray) {
-    const globInstance = new BunGlob(pattern);
-    const matches = globInstance.scanSync({
-      cwd: options?.cwd,
-      absolute: options?.absolute,
-      dot: options?.dot,
-      onlyFiles: options?.onlyFiles
-    });
-    for (const match of matches) {
-      results.push(match);
+// src/signed-url.ts
+import { Buffer } from "buffer";
+import { createHmac, timingSafeEqual } from "crypto";
+import process2 from "process";
+function getAppKey() {
+  const k = process2.env.APP_KEY;
+  if (!k || k.length < 16) {
+    if (process2.env.APP_ENV === "production" || process2.env.NODE_ENV === "production") {
+      throw new Error("[storage/signed-url] APP_KEY is missing or too short (need \u226516 chars). Cannot sign URL.");
     }
   }
-  return results;
+  return k || "stacks-default-key-dev-only-do-not-use-prod";
 }
-async function glob(patterns, options) {
-  const patternArray = typeof patterns === "string" ? [patterns] : patterns;
-  const results = [];
-  for (const pattern of patternArray) {
-    const globInstance = new BunGlob(pattern);
-    const matches = globInstance.scan({
-      cwd: options?.cwd,
-      absolute: options?.absolute,
-      dot: options?.dot,
-      onlyFiles: options?.onlyFiles
-    });
-    for await (const match of matches) {
-      results.push(match);
-    }
-  }
-  return results;
+function base64UrlEncode(buf) {
+  return buf.toString("base64url");
 }
-
-// src/delete.ts
-function deleteFolder(path) {
-  return new Promise((resolve, reject) => {
-    try {
-      if (isFolder(path)) {
-        fs.rmSync(path, { recursive: true, force: true });
-        return resolve(ok(`Deleted ${path}`));
-      }
-      return resolve(ok(`Path ${path} was not a directory`));
-    } catch (error) {
-      return reject(err(error));
-    }
-  });
+function base64UrlDecode(str) {
+  return Buffer.from(str, "base64url");
 }
-async function isDirectoryEmpty(path) {
-  return new Promise((resolve, reject) => {
-    try {
-      if (fs.statSync(path).isDirectory()) {
-        if (fs.readdirSync(path).length === 0)
-          return resolve(ok(true));
-        return resolve(ok(false));
-      }
-      return resolve(ok(false));
-    } catch (error) {
-      return reject(err(error));
-    }
-  });
+function normalizeExpiry(expiresIn) {
+  if (expiresIn instanceof Date)
+    return Math.floor(expiresIn.getTime() / 1000);
+  return Math.floor(Date.now() / 1000) + Math.floor(expiresIn);
 }
-async function deleteEmptyFolder(path) {
-  return new Promise((resolve, reject) => {
-    try {
-      if (fs.statSync(path).isDirectory()) {
-        if (fs.readdirSync(path).length === 0) {
-          fs.rmSync(path, { recursive: true, force: true });
-          return resolve(ok(`Deleted ${path}`));
-        }
-        return resolve(ok(`Path ${path} was not empty`));
-      }
-      return resolve(ok(`Path ${path} was not a directory`));
-    } catch (error) {
-      return reject(err(error));
-    }
-  });
+function createSignedStorageToken(path2, options) {
+  const exp = normalizeExpiry(options.expiresIn);
+  const iat = Math.floor(Date.now() / 1000);
+  const header = { alg: ALG, typ: "JWT" };
+  const payload = {
+    iss: options.issuer || "stacks",
+    iat,
+    exp,
+    path: path2
+  };
+  const headerPart = base64UrlEncode(Buffer.from(JSON.stringify(header)));
+  const payloadPart = base64UrlEncode(Buffer.from(JSON.stringify(payload)));
+  const signingInput = `${headerPart}.${payloadPart}`;
+  const sig = base64UrlEncode(createHmac("sha256", getAppKey()).update(signingInput).digest());
+  return `${signingInput}.${sig}`;
 }
-async function deleteEmptyFolders(dir) {
-  try {
-    if (!fs.existsSync(dir))
-      return ok(`Path ${dir} does not exist`);
-    const files = fs.readdirSync(dir);
-    for (const file of files) {
-      const p = join3(dir, file);
-      if (isFolder(p)) {
-        if (fs.readdirSync(p).length === 0)
-          fs.rmSync(p, { recursive: true, force: true });
-        else
-          await deleteEmptyFolders(p);
-      }
-    }
-    return ok(`Deleted empty folders located in ${dir}`);
-  } catch (error) {
-    return err(error);
+function rememberRevoked(sigPart) {
+  if (revokedSignatures.has(sigPart))
+    return;
+  if (revokedSignatures.size >= REVOCATION_LIMIT) {
+    const oldest = revokedSignatures.values().next().value;
+    if (oldest !== undefined)
+      revokedSignatures.delete(oldest);
   }
+  revokedSignatures.add(sigPart);
 }
-function deleteFile(path) {
-  return new Promise((resolve, reject) => {
-    try {
-      if (fs.statSync(path).isFile()) {
-        fs.rmSync(path, { recursive: true, force: true });
-        return resolve(ok(`Deleted ${path}`));
-      }
-      return resolve(ok(`Path ${path} was not a file`));
-    } catch (error) {
-      return reject(err(error));
-    }
-  });
+function revokeSignedStorageToken(token) {
+  if (typeof token !== "string" || token.length === 0)
+    return;
+  const parts = token.split(".");
+  const sig = parts.length === 3 ? parts[2] : token;
+  if (sig)
+    rememberRevoked(sig);
 }
-async function deleteGlob(path) {
-  if (!path.includes("*"))
-    return err(handleError(`Path ${path} does not contain a glob`));
-  const directories = await glob([path], { onlyDirectories: true });
-  for (const directory of directories) {
-    const result = await deleteFolder(directory);
-    if (result.isErr) {
-      log.error(result.error);
-      return result;
-    }
-    log.info(`Deleted ${italic(directory)}`);
-  }
-  return ok(`Deleted ${directories.length} directories`);
+function isSignedStorageTokenRevoked(sigPart) {
+  return revokedSignatures.has(sigPart);
 }
-async function del(path) {
-  if (fs.existsSync(path) && fs.statSync(path).isFile())
-    return await deleteFile(path);
-  if (isFolder(path))
-    return await deleteFolder(path);
-  if (path.includes("*"))
-    return await deleteGlob(path);
-  return err(handleError(`Path ${path} cannot be deleted due to an unhandled condition. Please report this issue.`));
+function clearRevokedSignedStorageTokens() {
+  revokedSignatures.clear();
 }
-// src/files.ts
-import { contains as contains2 } from "@stacksjs/arrays";
-import { log as log2 } from "@stacksjs/logging";
-import { dirname, join as join4, path as p } from "@stacksjs/path";
-import { detectIndent, detectNewline } from "@stacksjs/strings";
-async function readJsonFile(name, cwd) {
-  const file = await readTextFile(name, cwd);
-  let data;
-  try {
-    data = JSON.parse(file.data);
-  } catch (error) {
-    throw new Error(`Failed to parse JSON file "${name}": ${error.message}`);
+function verifySignedStorageToken(token, requestedPath) {
+  if (typeof token !== "string") {
+    return { valid: false, reason: "malformed" };
   }
-  const indent = detectIndent(file.data).indent;
-  const newline = detectNewline(file.data);
-  return { ...file, data, indent, newline };
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return { valid: false, reason: "malformed" };
+  }
+  const headerPart = parts[0];
+  const payloadPart = parts[1];
+  const sigPart = parts[2];
+  const signingInput = `${headerPart}.${payloadPart}`;
+  const expectedSig = createHmac("sha256", getAppKey()).update(signingInput).digest();
+  let providedSig;
+  try {
+    providedSig = base64UrlDecode(sigPart);
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  if (providedSig.length !== expectedSig.length || !timingSafeEqual(providedSig, expectedSig)) {
+    return { valid: false, reason: "bad_signature" };
+  }
+  if (revokedSignatures.has(sigPart)) {
+    return { valid: false, reason: "revoked" };
+  }
+  let claims;
+  try {
+    claims = JSON.parse(base64UrlDecode(payloadPart).toString("utf8"));
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof claims.exp !== "number" || now >= claims.exp) {
+    return { valid: false, reason: "expired" };
+  }
+  if (claims.path !== requestedPath) {
+    return { valid: false, reason: "path_mismatch" };
+  }
+  return { valid: true, claims };
 }
-async function readPackageJson(name, cwd) {
-  const file = await readJsonFile(name, cwd);
-  return file.data;
+var ALG = "HS256", REVOCATION_LIMIT = 1e5, revokedSignatures;
+var init_signed_url = __esm(() => {
+  revokedSignatures = new Set;
+});
+
+// src/adapters/local.ts
+import { Buffer as Buffer2 } from "buffer";
+import { createHmac as createHmac2 } from "crypto";
+import { createReadStream, createWriteStream } from "fs";
+import { access, chmod, constants, copyFile as copyFile2, lstat, mkdir, readdir, readFile, rename as rename2, rm, stat, unlink, writeFile as writeFile2 } from "fs/promises";
+import { basename, dirname as dirname3, join as join5, relative } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+class LocalStorageAdapter {
+  root;
+  constructor(config = {}) {
+    this.root = config.root || process.cwd();
+  }
+  resolvePath(path2) {
+    const resolved = join5(this.root, path2);
+    const rel = relative(this.root, resolved);
+    if (rel.startsWith("..") || rel.startsWith("../") || rel.startsWith("..\\")) {
+      throw new Error(`Path traversal detected: '${path2}' resolves outside storage root`);
+    }
+    return resolved;
+  }
+  async write(path2, contents) {
+    const fullPath = this.resolvePath(path2);
+    const dir = dirname3(fullPath);
+    await mkdir(dir, { recursive: true });
+    if (typeof contents === "string") {
+      await writeFile2(fullPath, contents, "utf8");
+    } else if (contents instanceof Buffer2) {
+      await writeFile2(fullPath, contents);
+    } else if (contents instanceof Uint8Array) {
+      await writeFile2(fullPath, contents);
+    } else {
+      const writeStream = createWriteStream(fullPath);
+      await pipeline(contents, writeStream);
+    }
+    const st = await stat(fullPath);
+    return {
+      path: path2,
+      size: st.size,
+      lastModified: st.mtimeMs
+    };
+  }
+  async read(path2) {
+    const fullPath = this.resolvePath(path2);
+    return await readFile(fullPath);
+  }
+  async getStream(path2, options) {
+    const fullPath = this.resolvePath(path2);
+    await access(fullPath, constants.R_OK);
+    const nodeStream = createReadStream(fullPath, { signal: options?.signal });
+    return Readable.toWeb(nodeStream);
+  }
+  async putStream(path2, stream, options) {
+    const fullPath = this.resolvePath(path2);
+    const dir = dirname3(fullPath);
+    await mkdir(dir, { recursive: true });
+    const nodeReadable = Readable.fromWeb(stream);
+    const writeStream = createWriteStream(fullPath);
+    try {
+      await pipeline(nodeReadable, writeStream, { signal: options?.signal });
+    } catch (err3) {
+      try {
+        await unlink(fullPath);
+      } catch {}
+      throw err3;
+    }
+    const st = await stat(fullPath);
+    return {
+      path: path2,
+      size: st.size,
+      contentType: options?.contentType,
+      lastModified: st.mtimeMs
+    };
+  }
+  async readToString(path2) {
+    const fullPath = this.resolvePath(path2);
+    return await readFile(fullPath, "utf8");
+  }
+  async readToBuffer(path2) {
+    const fullPath = this.resolvePath(path2);
+    return await readFile(fullPath);
+  }
+  async readToUint8Array(path2) {
+    const fullPath = this.resolvePath(path2);
+    const buffer = await readFile(fullPath);
+    return new Uint8Array(buffer);
+  }
+  async deleteFile(path2) {
+    const fullPath = this.resolvePath(path2);
+    await unlink(fullPath);
+  }
+  async deleteDirectory(path2) {
+    const fullPath = this.resolvePath(path2);
+    await rm(fullPath, { recursive: true, force: true });
+  }
+  async createDirectory(path2) {
+    const fullPath = this.resolvePath(path2);
+    await mkdir(fullPath, { recursive: true });
+  }
+  async moveFile(from, to) {
+    const fromPath = this.resolvePath(from);
+    const toPath = this.resolvePath(to);
+    const toDir = dirname3(toPath);
+    await mkdir(toDir, { recursive: true });
+    await rename2(fromPath, toPath);
+  }
+  async copyFile(from, to) {
+    const fromPath = this.resolvePath(from);
+    const toPath = this.resolvePath(to);
+    const toDir = dirname3(toPath);
+    await mkdir(toDir, { recursive: true });
+    await copyFile2(fromPath, toPath);
+  }
+  async stat(path2) {
+    const fullPath = this.resolvePath(path2);
+    const stats = await lstat(fullPath);
+    return {
+      path: path2,
+      type: stats.isDirectory() ? "directory" : "file",
+      visibility: await this.visibility(path2),
+      size: stats.size,
+      lastModified: stats.mtimeMs,
+      mimeType: stats.isFile() ? await this.detectMimeType(fullPath) : undefined
+    };
+  }
+  list(path2, options = {}) {
+    return this.createAsyncIterator(path2, options.deep || false);
+  }
+  async* createAsyncIterator(path2, deep) {
+    const fullPath = this.resolvePath(path2);
+    try {
+      await access(fullPath, constants.R_OK);
+    } catch {
+      return;
+    }
+    const entries = await this.readDirectoryRecursive(fullPath, deep);
+    yield* createDirectoryListing(entries);
+  }
+  async readDirectoryRecursive(dirPath, deep) {
+    const entries = [];
+    try {
+      const items = await readdir(dirPath, { withFileTypes: true });
+      for (const item of items) {
+        const itemPath = join5(dirPath, item.name);
+        const relativePath = relative(this.root, itemPath);
+        entries.push({
+          path: relativePath,
+          type: item.isDirectory() ? "directory" : "file"
+        });
+        if (deep && item.isDirectory()) {
+          const subEntries = await this.readDirectoryRecursive(itemPath, true);
+          entries.push(...subEntries);
+        }
+      }
+    } catch (error) {
+      if (error?.code !== "EACCES" && error?.code !== "EPERM") {
+        throw error;
+      }
+    }
+    return entries;
+  }
+  async changeVisibility(path2, vis) {
+    const fullPath = this.resolvePath(path2);
+    const stats = await lstat(fullPath);
+    const isDir2 = stats.isDirectory();
+    const mode = vis === "public" ? isDir2 ? 493 : 420 : isDir2 ? 448 : 384;
+    await chmod(fullPath, mode);
+  }
+  async visibility(path2) {
+    const fullPath = this.resolvePath(path2);
+    const stats = await lstat(fullPath);
+    const perms = stats.mode & 511;
+    return perms & 4 ? "public" : "private";
+  }
+  async fileExists(path2) {
+    const fullPath = this.resolvePath(path2);
+    try {
+      const stats = await lstat(fullPath);
+      return stats.isFile();
+    } catch {
+      return false;
+    }
+  }
+  async directoryExists(path2) {
+    const fullPath = this.resolvePath(path2);
+    try {
+      const stats = await lstat(fullPath);
+      return stats.isDirectory();
+    } catch {
+      return false;
+    }
+  }
+  async publicUrl(path2, options = {}) {
+    const base = (options.domain || process.env.APP_URL || "http://localhost").replace(/\/$/, "");
+    return `${base}/${path2}`;
+  }
+  async temporaryUrl(path2, options) {
+    const expiry = normalizeExpiryToDate(options.expiresIn);
+    const payload = `${path2}:${expiry.getTime()}`;
+    const appKey = process.env.APP_KEY || "stacks-default-key";
+    const signature = createHmac2("sha256", appKey).update(payload).digest("hex");
+    const token = Buffer2.from(`${payload}:${signature}`).toString("base64url");
+    return `http://localhost/temp/${token}`;
+  }
+  async signedUrl(path2, options) {
+    const token = createSignedStorageToken(path2, options);
+    const baseUrl = (options.baseUrl || process.env.APP_URL || "http://localhost").replace(/\/$/, "");
+    return `${baseUrl}/__storage/${encodeURIComponent(path2)}?token=${token}`;
+  }
+  async checksum(path2, options = {}) {
+    const algorithm = options.algorithm || "sha256";
+    const fullPath = this.resolvePath(path2);
+    const content = await readFile(fullPath);
+    const hasher = new Bun.CryptoHasher(algorithm);
+    hasher.update(content);
+    return hasher.digest("hex");
+  }
+  async mimeType(path2, options = {}) {
+    const fullPath = this.resolvePath(path2);
+    return await this.detectMimeType(fullPath);
+  }
+  async detectMimeType(filePath) {
+    const ext = basename(filePath).split(".").pop()?.toLowerCase();
+    const mimeTypes = {
+      txt: "text/plain",
+      html: "text/html",
+      css: "text/css",
+      js: "application/javascript",
+      json: "application/json",
+      xml: "application/xml",
+      pdf: "application/pdf",
+      zip: "application/zip",
+      jpg: "image/jpeg",
+      jpeg: "image/jpeg",
+      png: "image/png",
+      gif: "image/gif",
+      svg: "image/svg+xml",
+      mp4: "video/mp4",
+      mp3: "audio/mpeg",
+      wav: "audio/wav"
+    };
+    return mimeTypes[ext || ""] || "application/octet-stream";
+  }
+  async lastModified(path2) {
+    const stats = await this.stat(path2);
+    return stats.lastModified;
+  }
+  async fileSize(path2) {
+    const stats = await this.stat(path2);
+    return stats.size;
+  }
 }
-async function writeFile(path, data) {
-  if (typeof path === "string") {
-    const dirPath = dirname(path);
-    if (!await existsSync(dirPath))
-      await createFolder(dirPath);
-    return await Bun.write(Bun.file(path), data);
+function createLocalStorage(config = {}) {
+  return new LocalStorageAdapter(config);
+}
+var init_local = __esm(() => {
+  init_types();
+  init_signed_url();
+});
+
+// src/path-sanitize.ts
+function sanitizePresignedDir(dir) {
+  if (dir === undefined || dir === "")
+    return "";
+  if (typeof dir !== "string")
+    throw new PathSanitizeError(`dir must be a string, got ${typeof dir}`, "not-string");
+  const trimmed = dir.replace(/^\/+/, "").replace(/\/+$/, "");
+  if (dir.startsWith("/"))
+    throw new PathSanitizeError(`dir must not be absolute: '${dir}'`, "absolute-path");
+  if (trimmed === "")
+    return "";
+  if (trimmed.includes("\x00"))
+    throw new PathSanitizeError(`dir contains null byte`, "null-byte");
+  if (/[\x00-\x1F\x7F]/.test(trimmed))
+    throw new PathSanitizeError(`dir contains control character`, "control-char");
+  const segments = trimmed.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..")
+      throw new PathSanitizeError(`dir contains traversal or empty segment: '${dir}'`, "traversal");
+    if (segment.length > MAX_COMPONENT_LENGTH)
+      throw new PathSanitizeError(`dir segment exceeds ${MAX_COMPONENT_LENGTH} chars`, "too-long");
+    if (!ALLOWED_DIR_CHAR.test(segment))
+      throw new PathSanitizeError(`dir segment contains disallowed character: '${segment}'`, "invalid-char");
+  }
+  return segments.join("/");
+}
+function sanitizePresignedFilename(filename) {
+  if (typeof filename !== "string")
+    throw new PathSanitizeError(`filename must be a string, got ${typeof filename}`, "not-string");
+  if (filename === "")
+    throw new PathSanitizeError(`filename must not be empty`, "empty");
+  if (filename.length > MAX_COMPONENT_LENGTH)
+    throw new PathSanitizeError(`filename exceeds ${MAX_COMPONENT_LENGTH} chars`, "too-long");
+  if (filename.includes("\x00"))
+    throw new PathSanitizeError(`filename contains null byte`, "null-byte");
+  if (/[\x00-\x1F\x7F]/.test(filename))
+    throw new PathSanitizeError(`filename contains control character`, "control-char");
+  if (filename.includes("/") || filename.includes("\\"))
+    throw new PathSanitizeError(`filename must not contain path separators: '${filename}'`, "traversal");
+  if (filename === "." || filename === ".." || filename.startsWith("../") || filename.includes("/.."))
+    throw new PathSanitizeError(`filename contains traversal token: '${filename}'`, "traversal");
+  if (!ALLOWED_FILENAME_CHAR.test(filename))
+    throw new PathSanitizeError(`filename contains disallowed character: '${filename}'`, "invalid-char");
+  const dotIdx = filename.lastIndexOf(".");
+  if (dotIdx > 0 && dotIdx < filename.length - 1) {
+    const ext = filename.slice(dotIdx + 1).toLowerCase();
+    if (!ALLOWED_EXTENSION.test(ext))
+      throw new PathSanitizeError(`filename has invalid extension: '.${ext}'`, "invalid-extension");
+  }
+  return filename;
+}
+function parseDiskPath(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new PathSanitizeError("disk-path reference is empty", "empty");
+  }
+  if (input.includes("\x00")) {
+    throw new PathSanitizeError("disk-path reference contains a null byte", "null-byte");
+  }
+  const colonIdx = input.indexOf(":");
+  if (colonIdx <= 0 || colonIdx === input.length - 1) {
+    throw new PathSanitizeError(`disk-path reference must use '<disk>:<path>' format, got '${input}'`, "invalid-char");
+  }
+  const disk = input.slice(0, colonIdx);
+  const path2 = input.slice(colonIdx + 1);
+  if (!DISK_NAME_RE.test(disk)) {
+    throw new PathSanitizeError(`disk name '${disk}' is invalid (alphanumeric + '-' / '_' only)`, "invalid-char");
+  }
+  if (path2.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path2)) {
+    throw new PathSanitizeError(`disk-path '${path2}' is absolute`, "absolute-path");
+  }
+  if (path2.includes("\x00")) {
+    throw new PathSanitizeError("disk-path contains a null byte", "null-byte");
+  }
+  for (let i = 0;i < path2.length; i++) {
+    const code = path2.charCodeAt(i);
+    if (code < 32 || code === 127) {
+      throw new PathSanitizeError(`disk-path contains a control character at index ${i}`, "control-char");
+    }
+  }
+  const segments = path2.split(/[/\\]/);
+  if (segments.some((seg) => seg === "..")) {
+    throw new PathSanitizeError(`disk-path '${path2}' contains a '..' segment`, "traversal");
+  }
+  return { disk, path: path2 };
+}
+var PathSanitizeError, MAX_COMPONENT_LENGTH = 255, ALLOWED_DIR_CHAR, ALLOWED_FILENAME_CHAR, ALLOWED_EXTENSION, DISK_NAME_RE;
+var init_path_sanitize = __esm(() => {
+  PathSanitizeError = class PathSanitizeError extends Error {
+    reason;
+    constructor(message, reason) {
+      super(message);
+      this.name = "PathSanitizeError";
+      this.reason = reason;
+    }
+  };
+  ALLOWED_DIR_CHAR = /^[A-Za-z0-9._-]+$/;
+  ALLOWED_FILENAME_CHAR = /^[A-Za-z0-9._-]+$/;
+  ALLOWED_EXTENSION = /^[a-z0-9]+$/;
+  DISK_NAME_RE = /^[a-z0-9_-]+$/i;
+});
+
+// src/s3-presigned-post.ts
+import { createHmac as createHmac3 } from "crypto";
+import { Buffer as Buffer4 } from "buffer";
+function hmac(key, data) {
+  return createHmac3("sha256", key).update(data, "utf8").digest();
+}
+function deriveSigningKey(secretAccessKey, dateStamp, region) {
+  const kDate = hmac(`AWS4${secretAccessKey}`, dateStamp);
+  const kRegion = hmac(kDate, region);
+  const kService = hmac(kRegion, "s3");
+  const kSigning = hmac(kService, "aws4_request");
+  return kSigning;
+}
+function isoDate(now) {
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const dateStamp = amzDate.slice(0, 8);
+  return { amzDate, dateStamp };
+}
+function signS3PresignedPost(input) {
+  const expiresIn = Math.floor(input.expiresIn);
+  if (!Number.isFinite(expiresIn) || expiresIn < MIN_EXPIRY || expiresIn > MAX_EXPIRY) {
+    throw new RangeError(`[storage/s3-post] expiresIn must be between ${MIN_EXPIRY}s and ${MAX_EXPIRY}s (got ${expiresIn}s)`);
+  }
+  if (!input.bucket)
+    throw new Error("[storage/s3-post] bucket is required");
+  if (!input.credentials?.accessKeyId || !input.credentials?.secretAccessKey) {
+    throw new Error("[storage/s3-post] credentials.accessKeyId and credentials.secretAccessKey are required");
+  }
+  const now = new Date;
+  const { amzDate, dateStamp } = isoDate(now);
+  const credentialScope = `${dateStamp}/${input.region}/s3/aws4_request`;
+  const credentialField = `${input.credentials.accessKeyId}/${credentialScope}`;
+  const expirationDate = new Date(now.getTime() + expiresIn * 1000).toISOString().replace(/\.\d{3}Z$/, "Z");
+  const conditions = [];
+  conditions.push({ bucket: input.bucket });
+  if (typeof input.key === "string") {
+    conditions.push({ key: input.key });
+  } else {
+    conditions.push(["starts-with", "$key", input.key.startsWith]);
+  }
+  const acl = input.acl ?? "private";
+  conditions.push({ acl });
+  if (typeof input.contentType === "string") {
+    conditions.push({ "Content-Type": input.contentType });
+  } else {
+    conditions.push(["starts-with", "$Content-Type", input.contentType.startsWith]);
+  }
+  if (input.contentLengthRange) {
+    if (!Number.isFinite(input.contentLengthRange.min) || input.contentLengthRange.min < 0 || !Number.isFinite(input.contentLengthRange.max) || input.contentLengthRange.max < input.contentLengthRange.min) {
+      throw new RangeError("[storage/s3-post] contentLengthRange must satisfy 0 <= min <= max");
+    }
+    conditions.push(["content-length-range", input.contentLengthRange.min, input.contentLengthRange.max]);
+  }
+  if (input.fields) {
+    for (const [k, v] of Object.entries(input.fields)) {
+      conditions.push({ [k]: v });
+    }
+  }
+  conditions.push({ "x-amz-credential": credentialField });
+  conditions.push({ "x-amz-algorithm": ALGORITHM });
+  conditions.push({ "x-amz-date": amzDate });
+  if (input.credentials.sessionToken) {
+    conditions.push({ "x-amz-security-token": input.credentials.sessionToken });
+  }
+  const policy = {
+    expiration: expirationDate,
+    conditions
+  };
+  const policyBase64 = Buffer4.from(JSON.stringify(policy), "utf8").toString("base64");
+  const signingKey = deriveSigningKey(input.credentials.secretAccessKey, dateStamp, input.region);
+  const signature = createHmac3("sha256", signingKey).update(policyBase64, "utf8").digest("hex");
+  const fields = {
+    key: typeof input.key === "string" ? input.key : `${input.key.startsWith}\${filename}`,
+    acl,
+    "Content-Type": typeof input.contentType === "string" ? input.contentType : input.contentType.startsWith,
+    "x-amz-credential": credentialField,
+    "x-amz-algorithm": ALGORITHM,
+    "x-amz-date": amzDate,
+    policy: policyBase64,
+    "x-amz-signature": signature,
+    ...input.credentials.sessionToken ? { "x-amz-security-token": input.credentials.sessionToken } : {},
+    ...input.fields ?? {}
+  };
+  return {
+    url: `https://${input.bucket}.s3.${input.region}.amazonaws.com/`,
+    fields,
+    key: typeof input.key === "string" ? input.key : input.key.startsWith
+  };
+}
+var ALGORITHM = "AWS4-HMAC-SHA256", MIN_EXPIRY = 60, MAX_EXPIRY;
+var init_s3_presigned_post = __esm(() => {
+  MAX_EXPIRY = 7 * 24 * 60 * 60;
+});
+
+// src/adapters/s3.ts
+import { Buffer as Buffer5 } from "buffer";
+import { basename as basename3 } from "path";
+import process3 from "process";
+function clampPartSize(requested) {
+  if (!Number.isFinite(requested))
+    return S3_MIN_PART_SIZE;
+  return Math.max(S3_MIN_PART_SIZE, Math.min(Math.floor(requested), S3_MAX_PART_SIZE));
+}
+
+class ChunkBuffer {
+  chunks = [];
+  total = 0;
+  constructor(_partSize) {}
+  get length() {
+    return this.total;
+  }
+  push(c) {
+    this.chunks.push(c);
+    this.total += c.length;
+  }
+  take(n) {
+    const out = new Uint8Array(n);
+    let written = 0;
+    while (written < n && this.chunks.length > 0) {
+      const head = this.chunks[0];
+      const need = n - written;
+      if (head.length <= need) {
+        out.set(head, written);
+        written += head.length;
+        this.chunks.shift();
+      } else {
+        out.set(head.subarray(0, need), written);
+        this.chunks[0] = head.subarray(need);
+        written += need;
+      }
+    }
+    this.total -= n;
+    return out;
+  }
+  flush() {
+    const out = new Uint8Array(this.total);
+    let off = 0;
+    for (const c of this.chunks) {
+      out.set(c, off);
+      off += c.length;
+    }
+    this.chunks = [];
+    this.total = 0;
+    return out;
+  }
+}
+async function isSettled(p3) {
+  const sentinel = Symbol("pending");
+  const result = await Promise.race([
+    p3.then(() => "settled", () => "settled"),
+    Promise.resolve(sentinel)
+  ]);
+  return result !== sentinel;
+}
+
+class S3StorageAdapter {
+  _client;
+  _clientPromise = null;
+  bucket;
+  prefix;
+  region;
+  credentials;
+  constructor(client, config) {
+    this._client = client;
+    this.bucket = config.bucket || "";
+    this.prefix = config.prefix || "";
+    this.region = config.region || "us-east-1";
+    this.credentials = config.credentials;
+    if (!this.bucket) {
+      throw new Error("S3 bucket name is required");
+    }
+  }
+  async getClient() {
+    if (this._client)
+      return this._client;
+    if (!this._clientPromise) {
+      this._clientPromise = import("@stacksjs/ts-cloud").then((cloud) => {
+        this._client = new cloud.S3Client(this.region);
+        return this._client;
+      });
+    }
+    return this._clientPromise;
+  }
+  resolveCredentials() {
+    if (this.credentials?.accessKeyId && this.credentials.secretAccessKey)
+      return this.credentials;
+    const accessKeyId = process3.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process3.env.AWS_SECRET_ACCESS_KEY;
+    const sessionToken = process3.env.AWS_SESSION_TOKEN;
+    if (!accessKeyId || !secretAccessKey) {
+      throw new Error("[storage/s3] presignedUploadPolicy requires AWS credentials \u2014 " + "pass them via S3DiskConfig.credentials or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY.");
+    }
+    return { accessKeyId, secretAccessKey, sessionToken };
+  }
+  prefixPath(path2) {
+    if (!this.prefix)
+      return path2;
+    return `${this.prefix}/${path2}`.replace(/\/+/g, "/");
+  }
+  stripPrefix(path2) {
+    if (!this.prefix)
+      return path2;
+    const prefixWithSlash = `${this.prefix}/`;
+    return path2.startsWith(prefixWithSlash) ? path2.slice(prefixWithSlash.length) : path2;
+  }
+  async contentsToBuffer(contents) {
+    if (typeof contents === "string") {
+      return Buffer5.from(contents, "utf8");
+    } else if (contents instanceof Buffer5) {
+      return contents;
+    } else if (contents instanceof Uint8Array) {
+      return Buffer5.from(contents);
+    } else {
+      const stream = contents;
+      if (typeof stream.getReader !== "function") {
+        throw new TypeError("[storage/s3] contents must be a web-standard ReadableStream (with .getReader()), not a Node stream.Readable. Convert via Readable.toWeb(nodeStream) before passing.");
+      }
+      const reader = stream.getReader.call(contents);
+      const chunks = [];
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        if (value)
+          chunks.push(value);
+      }
+      return Buffer5.concat(chunks.map((c) => Buffer5.from(c)));
+    }
   }
-  return await Bun.write(path, data);
-}
-async function writeJsonFile(file) {
-  let json = JSON.stringify(file.data, undefined, file.indent);
-  if (file.newline)
-    json += file.newline;
-  return writeTextFile({ ...file, data: json });
-}
-function readTextFile(name, cwd) {
-  return new Promise((resolve, reject) => {
-    let filePath;
-    if (cwd)
-      filePath = join4(cwd, name);
-    else
-      filePath = name;
-    fs.readFile(filePath, "utf8", (err2, text) => {
-      if (err2) {
-        reject(err2);
-      } else {
-        resolve({
-          path: filePath,
-          data: text
+  async write(path2, contents) {
+    const key = this.prefixPath(path2);
+    const body = await this.contentsToBuffer(contents);
+    const contentType = this.detectMimeType(path2);
+    await (await this.getClient()).putObject({
+      bucket: this.bucket,
+      key,
+      body,
+      contentType
+    });
+    return {
+      path: path2,
+      size: body.length,
+      contentType,
+      lastModified: Date.now()
+    };
+  }
+  async read(path2) {
+    const key = this.prefixPath(path2);
+    const response = await (await this.getClient()).getObject(this.bucket, key);
+    if (!response) {
+      throw new Error(`Failed to read file: ${path2}`);
+    }
+    return Buffer5.from(response);
+  }
+  async getStream(path2, _options) {
+    const key = this.prefixPath(path2);
+    const buf = await (await this.getClient()).getObjectBuffer(this.bucket, key);
+    if (!buf)
+      throw new Error(`Failed to read file: ${path2}`);
+    const bytes = new Uint8Array(buf);
+    return new ReadableStream({
+      start(controller) {
+        controller.enqueue(bytes);
+        controller.close();
+      }
+    });
+  }
+  async putStream(path2, stream, options) {
+    const key = this.prefixPath(path2);
+    const contentType = options?.contentType ?? this.detectMimeType(path2);
+    const partSize = clampPartSize(options?.partSize ?? 5242880);
+    const concurrency = Math.max(1, Math.min(options?.concurrency ?? 4, 100));
+    const maxRetries = Math.max(0, options?.maxRetries ?? 3);
+    const signal = options?.signal;
+    const reader = stream.getReader();
+    let firstChunk = null;
+    let firstDone = false;
+    {
+      const buf = new ChunkBuffer(partSize);
+      while (!firstDone && buf.length < partSize) {
+        if (signal?.aborted) {
+          try {
+            reader.releaseLock();
+          } catch {}
+          throw new Error("aborted");
+        }
+        const { value, done } = await reader.read();
+        if (done) {
+          firstDone = true;
+          break;
+        }
+        if (value)
+          buf.push(value);
+      }
+      firstChunk = buf.flush();
+    }
+    if (firstDone) {
+      try {
+        reader.releaseLock();
+      } catch {}
+      await (await this.getClient()).putObject({
+        bucket: this.bucket,
+        key,
+        body: Buffer5.from(firstChunk),
+        contentType
+      });
+      return { path: path2, size: firstChunk.length, contentType, lastModified: Date.now() };
+    }
+    const { UploadId: uploadId } = await (await this.getClient()).createMultipartUpload(this.bucket, key, { contentType });
+    const completedParts = [];
+    let totalBytes = 0;
+    let partNumber = 1;
+    const inflight = [];
+    const uploadOne = async (body, n) => {
+      let attempt = 0;
+      while (true) {
+        if (signal?.aborted)
+          throw new Error("aborted");
+        try {
+          const { ETag } = await (await this.getClient()).uploadPart(this.bucket, key, uploadId, n, Buffer5.from(body));
+          completedParts.push({ PartNumber: n, ETag });
+          totalBytes += body.length;
+          return;
+        } catch (err3) {
+          if (attempt >= maxRetries)
+            throw err3;
+          attempt += 1;
+        }
+      }
+    };
+    try {
+      inflight.push(uploadOne(firstChunk, partNumber++));
+      firstChunk = null;
+      const buf = new ChunkBuffer(partSize);
+      while (true) {
+        if (signal?.aborted)
+          throw new Error("aborted");
+        const { value, done } = await reader.read();
+        if (done)
+          break;
+        if (value)
+          buf.push(value);
+        while (buf.length >= partSize) {
+          const part = buf.take(partSize);
+          if (inflight.length >= concurrency) {
+            await Promise.race(inflight.map((p3, i) => p3.then(() => i)));
+            for (let i = inflight.length - 1;i >= 0; i--) {
+              if (await isSettled(inflight[i]))
+                inflight.splice(i, 1);
+            }
+          }
+          inflight.push(uploadOne(part, partNumber++));
+        }
+      }
+      try {
+        reader.releaseLock();
+      } catch {}
+      const tail = buf.flush();
+      if (tail.length > 0)
+        inflight.push(uploadOne(tail, partNumber++));
+      await Promise.all(inflight);
+      completedParts.sort((a, b) => a.PartNumber - b.PartNumber);
+      await (await this.getClient()).completeMultipartUpload(this.bucket, key, uploadId, completedParts);
+      return { path: path2, size: totalBytes, contentType, lastModified: Date.now() };
+    } catch (err3) {
+      try {
+        await (await this.getClient()).abortMultipartUpload(this.bucket, key, uploadId);
+      } catch {}
+      throw err3;
+    }
+  }
+  async readToString(path2) {
+    const key = this.prefixPath(path2);
+    const response = await (await this.getClient()).getObject(this.bucket, key);
+    if (!response) {
+      throw new Error(`Failed to read file: ${path2}`);
+    }
+    return response;
+  }
+  async readToBuffer(path2) {
+    const contents = await this.read(path2);
+    return contents;
+  }
+  async readToUint8Array(path2) {
+    const buffer = await this.readToBuffer(path2);
+    return new Uint8Array(buffer);
+  }
+  async deleteFile(path2) {
+    const key = this.prefixPath(path2);
+    await (await this.getClient()).deleteObject(this.bucket, key);
+  }
+  async deleteDirectory(path2) {
+    const prefix = this.prefixPath(path2);
+    const normalizedPrefix = prefix.endsWith("/") ? prefix : `${prefix}/`;
+    const objects = await (await this.getClient()).listAllObjects({ bucket: this.bucket, prefix: normalizedPrefix });
+    const keys = objects.map((obj) => obj.Key).filter((k) => typeof k === "string");
+    if (keys.length === 0) {
+      return;
+    }
+    await (await this.getClient()).deleteObjects(this.bucket, keys);
+  }
+  async createDirectory(_path) {}
+  async moveFile(from, to) {
+    await this.copyFile(from, to);
+    await this.deleteFile(from);
+  }
+  async copyFile(from, to) {
+    const fromKey = this.prefixPath(from);
+    const toKey = this.prefixPath(to);
+    await (await this.getClient()).copyObject({
+      sourceBucket: this.bucket,
+      sourceKey: fromKey,
+      destinationBucket: this.bucket,
+      destinationKey: toKey
+    });
+  }
+  async stat(path2) {
+    const key = this.prefixPath(path2);
+    const result = await (await this.getClient()).headObject(this.bucket, key);
+    if (!result) {
+      throw new Error(`File not found: ${path2}`);
+    }
+    return {
+      path: path2,
+      type: "file",
+      visibility: "private",
+      size: result.ContentLength || 0,
+      lastModified: result.LastModified ? new Date(result.LastModified).getTime() : Date.now(),
+      mimeType: result.ContentType
+    };
+  }
+  list(path2, options = {}) {
+    return this.createAsyncIterator(path2, options.deep || false);
+  }
+  async* createAsyncIterator(path2, deep) {
+    const prefix = this.prefixPath(path2);
+    const normalizedPrefix = prefix ? `${prefix}/` : undefined;
+    if (deep) {
+      const objects = await (await this.getClient()).listAllObjects({ bucket: this.bucket, prefix: normalizedPrefix });
+      for (const obj of objects) {
+        yield {
+          path: this.stripPrefix(obj.Key),
+          type: "file"
+        };
+      }
+    } else {
+      let continuationToken;
+      do {
+        const result = await (await this.getClient()).listObjects({
+          bucket: this.bucket,
+          prefix: normalizedPrefix,
+          continuationToken
         });
+        for (const obj of result.objects || []) {
+          yield {
+            path: this.stripPrefix(obj.Key),
+            type: "file"
+          };
+        }
+        continuationToken = result.nextContinuationToken;
+      } while (continuationToken);
+    }
+  }
+  async changeVisibility(path2, vis) {
+    const key = this.prefixPath(path2);
+    const acl = vis === "public" ? "public-read" : "private";
+    await (await this.getClient()).putObjectAcl(this.bucket, key, acl);
+  }
+  async visibility(path2) {
+    const key = this.prefixPath(path2);
+    const acl = await (await this.getClient()).getObjectAcl(this.bucket, key);
+    const grants = acl?.Grants ?? [];
+    const isPublic = grants.some((g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL"));
+    return isPublic ? "public" : "private";
+  }
+  async fileExists(path2) {
+    const key = this.prefixPath(path2);
+    try {
+      const result = await (await this.getClient()).headObject(this.bucket, key);
+      return !!result;
+    } catch (error) {
+      if (!error.message?.includes("404") && !error.message?.includes("NoSuchKey") && !error.message?.includes("NotFound")) {
+        console.debug(`[s3] Unexpected error checking file existence for ${path2}: ${error.message}`);
       }
+      return false;
+    }
+  }
+  async directoryExists(path2) {
+    const prefix = this.prefixPath(path2);
+    const result = await (await this.getClient()).listObjects({
+      bucket: this.bucket,
+      prefix: `${prefix}/`,
+      maxKeys: 1
     });
-  });
+    return (result.objects || []).length > 0;
+  }
+  async publicUrl(path2, options = {}) {
+    const key = this.prefixPath(path2);
+    const domain = options.domain || `https://${this.bucket}.s3.${this.region}.amazonaws.com`;
+    return `${domain}/${key}`;
+  }
+  async temporaryUrl(path2, options) {
+    const key = this.prefixPath(path2);
+    const expiresIn = Math.floor(normalizeExpiryToMilliseconds(options.expiresIn) / 1000);
+    const MIN_EXPIRY2 = 60;
+    const MAX_EXPIRY2 = 604800;
+    if (!Number.isFinite(expiresIn) || expiresIn < MIN_EXPIRY2 || expiresIn > MAX_EXPIRY2) {
+      throw new RangeError(`[storage/s3] temporaryUrl expiresIn must be between 60s and 7 days (got ${expiresIn}s)`);
+    }
+    return await (await this.getClient()).getSignedUrl({
+      bucket: this.bucket,
+      key,
+      expiresIn,
+      operation: "getObject"
+    });
+  }
+  async signedUrl(path2, options) {
+    return this.temporaryUrl(path2, { expiresIn: options.expiresIn });
+  }
+  async presignedUploadUrl(options) {
+    if (!options.contentType)
+      throw new Error("[storage/s3] presignedUploadUrl requires `contentType` \u2014 S3 signs against the exact header.");
+    const expiresIn = Math.floor(options.expiresIn);
+    const MIN_EXPIRY2 = 60;
+    const MAX_EXPIRY2 = 604800;
+    if (!Number.isFinite(expiresIn) || expiresIn < MIN_EXPIRY2 || expiresIn > MAX_EXPIRY2) {
+      throw new RangeError(`[storage/s3] presignedUploadUrl expiresIn must be between 60s and 7 days (got ${expiresIn}s)`);
+    }
+    const safeDir = sanitizePresignedDir(options.dir);
+    const safeFilename = options.filename !== undefined ? sanitizePresignedFilename(options.filename) : `${crypto.randomUUID().replace(/-/g, "")}${this.extensionForContentType(options.contentType)}`;
+    const path2 = safeDir ? `${safeDir}/${safeFilename}` : safeFilename;
+    const key = this.prefixPath(path2);
+    const url = await (await this.getClient()).getSignedUrl({
+      bucket: this.bucket,
+      key,
+      expiresIn,
+      operation: "putObject"
+    });
+    return {
+      url,
+      path: path2,
+      key,
+      contentType: options.contentType,
+      maxBytes: options.maxBytes
+    };
+  }
+  async presignedUploadPolicy(options) {
+    const credentials = this.resolveCredentials();
+    const scopedKey = typeof options.key === "string" ? this.prefixPath(options.key) : { startsWith: this.prefixPath(options.key.startsWith) };
+    return signS3PresignedPost({
+      bucket: this.bucket,
+      region: this.region,
+      credentials,
+      key: scopedKey,
+      contentType: options.contentType,
+      contentLengthRange: options.contentLengthRange,
+      acl: options.acl,
+      expiresIn: options.expiresIn,
+      fields: options.fields
+    });
+  }
+  extensionForContentType(contentType) {
+    const mime = contentType.toLowerCase().split(";")[0]?.trim() ?? "";
+    const map = {
+      "image/jpeg": ".jpg",
+      "image/jpg": ".jpg",
+      "image/png": ".png",
+      "image/webp": ".webp",
+      "image/gif": ".gif",
+      "image/avif": ".avif",
+      "image/svg+xml": ".svg",
+      "application/pdf": ".pdf",
+      "application/json": ".json",
+      "application/zip": ".zip",
+      "text/plain": ".txt",
+      "text/csv": ".csv",
+      "video/mp4": ".mp4",
+      "video/webm": ".webm",
+      "audio/mpeg": ".mp3",
+      "audio/wav": ".wav"
+    };
+    return map[mime] ?? "";
+  }
+  async checksum(path2, options = {}) {
+    const algorithm = options.algorithm || "sha256";
+    const content = await this.readToUint8Array(path2);
+    const hasher = new Bun.CryptoHasher(algorithm);
+    hasher.update(content);
+    return hasher.digest("hex");
+  }
+  async mimeType(path2, _options = {}) {
+    const stats = await this.stat(path2);
+    return stats.mimeType || this.detectMimeType(path2);
+  }
+  detectMimeType(path2) {
+    const ext = basename3(path2).split(".").pop()?.toLowerCase();
+    const mimeTypes = {
+      txt: "text/plain",
+      html: "text/html",
+      css: "text/css",
+      js: "application/javascript",
+      json: "application/json",
+      xml: "application/xml",
+      pdf: "application/pdf",
+      zip: "application/zip",
+      jpg: "image/jpeg",
+      jpeg: "image/jpeg",
+      png: "image/png",
+      gif: "image/gif",
+      svg: "image/svg+xml",
+      mp4: "video/mp4",
+      mp3: "audio/mpeg",
+      wav: "audio/wav"
+    };
+    return mimeTypes[ext || ""] || "application/octet-stream";
+  }
+  async lastModified(path2) {
+    const stats = await this.stat(path2);
+    return stats.lastModified;
+  }
+  async fileSize(path2) {
+    const stats = await this.stat(path2);
+    return stats.size;
+  }
 }
-async function writeTextFile(file) {
-  return await Bun.write(file.path, file.data);
+function createS3Storage(client, config) {
+  return new S3StorageAdapter(client, config);
 }
-function isFile(path) {
-  return fs.existsSync(path);
+var S3_MIN_PART_SIZE, S3_MAX_PART_SIZE;
+var init_s3 = __esm(() => {
+  init_types();
+  init_path_sanitize();
+  init_s3_presigned_post();
+  S3_MIN_PART_SIZE = 5 * 1024 * 1024;
+  S3_MAX_PART_SIZE = 5 * 1024 * 1024 * 1024;
+});
+
+// src/put-file.ts
+function extFromOriginalName(name) {
+  if (!name)
+    return null;
+  const idx = name.lastIndexOf(".");
+  if (idx <= 0 || idx === name.length - 1)
+    return null;
+  const ext = name.slice(idx + 1).toLowerCase();
+  if (!/^[a-z0-9]+$/.test(ext))
+    return null;
+  return ext;
+}
+function originalNameOf(file2) {
+  return file2.originalName ?? file2.name;
+}
+function mimetypeOf(file2) {
+  return file2.mimetype ?? file2.mimeType;
+}
+function deriveExtension(file2) {
+  const mime = mimetypeOf(file2);
+  return extFromOriginalName(originalNameOf(file2)) ?? (mime && MIME_TO_EXT[mime.toLowerCase()]) ?? null;
+}
+async function readBytes(file2) {
+  if (file2.buffer !== undefined)
+    return file2.buffer;
+  if (typeof file2.bytes === "function")
+    return await file2.bytes();
+  if (typeof file2.arrayBuffer === "function")
+    return await file2.arrayBuffer();
+  throw new Error("UploadedFile is missing both `buffer` and `bytes()`/`arrayBuffer()` accessors \u2014 cannot read file contents.");
+}
+function bufferLikeToHash(buffer) {
+  const view = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : buffer;
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(view);
+  return hasher.digest("hex").slice(0, 32);
+}
+function sanitizeOriginalName(name) {
+  const stripped = name.replace(/[/\\]/g, "_").replace(/\.{2,}/g, "_");
+  return stripped.replace(/[^A-Za-z0-9._-]/g, "_").replace(/_+/g, "_");
+}
+async function resolveFilename(file2, strategy) {
+  if (typeof strategy === "function")
+    return strategy(file2);
+  switch (strategy) {
+    case "uuid":
+      return crypto.randomUUID().replace(/-/g, "");
+    case "hash": {
+      const bytes = await readBytes(file2);
+      return bufferLikeToHash(bytes);
+    }
+    case "original": {
+      const name = originalNameOf(file2);
+      return name ? sanitizeOriginalName(name) : crypto.randomUUID().replace(/-/g, "");
+    }
+  }
+}
+function joinPath(...parts) {
+  return parts.filter(Boolean).map((p3, i) => i === 0 ? p3.replace(/\/+$/, "") : p3.replace(/^\/+/, "").replace(/\/+$/, "")).filter(Boolean).join("/");
+}
+async function putUploadedFile(manager, file2, opts) {
+  const disk = manager.disk(opts.disk);
+  const baseName = await resolveFilename(file2, opts.filename ?? "uuid");
+  const wantExt = opts.preserveExtension !== false;
+  const baseHasExt = /\.[A-Za-z0-9]+$/.test(baseName);
+  const ext = wantExt && !baseHasExt ? deriveExtension(file2) : null;
+  const finalName = ext ? `${baseName}.${ext}` : baseName;
+  const fullPath = joinPath(opts.dir ?? "", finalName);
+  const raw = await readBytes(file2);
+  let contents = raw instanceof ArrayBuffer ? new Uint8Array(raw) : raw;
+  if (opts.transform) {
+    contents = await opts.transform(contents);
+  }
+  const written = await disk.write(fullPath, contents);
+  const url = await disk.publicUrl(fullPath);
+  return { ...written, path: fullPath, url };
+}
+var MIME_TO_EXT;
+var init_put_file = __esm(() => {
+  MIME_TO_EXT = {
+    "image/jpeg": "jpg",
+    "image/jpg": "jpg",
+    "image/png": "png",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "image/svg+xml": "svg",
+    "image/avif": "avif",
+    "application/pdf": "pdf",
+    "application/json": "json",
+    "application/zip": "zip",
+    "application/octet-stream": "bin",
+    "text/plain": "txt",
+    "text/csv": "csv",
+    "text/html": "html",
+    "video/mp4": "mp4",
+    "video/webm": "webm",
+    "audio/mpeg": "mp3",
+    "audio/wav": "wav"
+  };
+});
+
+// src/facade.ts
+var exports_facade = {};
+__export(exports_facade, {
+  StorageManager: () => StorageManager,
+  Storage: () => Storage
+});
+import { resolve as resolve3 } from "path";
+import process6 from "process";
+import { filesystems, app as appConfig } from "@stacksjs/config";
+function buildConfig() {
+  const cwd = process6.cwd();
+  const rootDir = filesystems.root || cwd;
+  const s3Config = filesystems.s3;
+  const appUrl = appConfig?.url || "";
+  const config = {
+    default: filesystems.driver || "local",
+    disks: {
+      local: {
+        driver: "local",
+        root: resolve3(rootDir, "storage/app"),
+        visibility: filesystems.defaultVisibility || "private"
+      },
+      public: {
+        driver: "local",
+        root: resolve3(rootDir, "public"),
+        url: appUrl ? `${appUrl}/storage` : "/storage",
+        visibility: "public"
+      }
+    }
+  };
+  if (s3Config?.bucket) {
+    config.disks.s3 = {
+      driver: "s3",
+      bucket: s3Config.bucket,
+      region: s3Config.region || "us-east-1",
+      prefix: s3Config.prefix,
+      endpoint: s3Config.endpoint,
+      url: filesystems.publicUrl?.domain,
+      usePathStyleEndpoint: !!s3Config.endpoint,
+      visibility: filesystems.defaultVisibility || "private",
+      credentials: s3Config.credentials ? { key: s3Config.credentials.accessKeyId, secret: s3Config.credentials.secretAccessKey } : undefined
+    };
+  }
+  return config;
 }
-function doesExist(path) {
-  return isFile(path) || isFolder(path);
+
+class StorageManager {
+  _config = null;
+  disks = new Map;
+  customConfig = null;
+  get config() {
+    if (!this._config) {
+      const builtConfig = buildConfig();
+      this._config = this.customConfig ? {
+        default: this.customConfig.default || builtConfig.default,
+        disks: { ...builtConfig.disks, ...this.customConfig.disks }
+      } : builtConfig;
+    }
+    return this._config;
+  }
+  init(config) {
+    this.customConfig = config;
+    this._config = null;
+    this.disks.clear();
+    return this;
+  }
+  disk(name) {
+    const diskName = name || this.config.default;
+    if (this.disks.has(diskName)) {
+      return this.disks.get(diskName);
+    }
+    const diskConfig = this.config.disks[diskName];
+    if (!diskConfig) {
+      const available = Object.keys(this.config.disks).join(", ");
+      throw new Error(`Disk [${diskName}] is not configured. Available: ${available}`);
+    }
+    const adapter2 = this.createAdapter(diskName, diskConfig);
+    this.disks.set(diskName, adapter2);
+    return adapter2;
+  }
+  createAdapter(name, config) {
+    switch (config.driver) {
+      case "local":
+        return this.createLocalAdapter(config);
+      case "s3":
+        return this.createS3Adapter(name, config);
+      default:
+        throw new Error(`Unsupported driver: ${config.driver}`);
+    }
+  }
+  createLocalAdapter(config) {
+    return createLocalStorage({ root: config.root });
+  }
+  createS3Adapter(_name, config) {
+    return new S3StorageAdapter(null, {
+      bucket: config.bucket,
+      region: config.region,
+      prefix: config.prefix
+    });
+  }
+  async put(pathOrFile, contentsOrOpts) {
+    if (typeof pathOrFile === "string") {
+      return this.disk().write(pathOrFile, contentsOrOpts);
+    }
+    const opts = contentsOrOpts ?? {};
+    return putUploadedFile(this, pathOrFile, opts);
+  }
+  async stat(path2) {
+    return this.disk().stat(path2);
+  }
+  async getStream(path2, options) {
+    const adapter2 = this.disk();
+    if (typeof adapter2.getStream !== "function") {
+      throw new Error(`[storage] disk '${this.config.default}' does not support getStream \u2014 adapter is missing the optional method`);
+    }
+    return adapter2.getStream(path2, options);
+  }
+  async putStream(path2, stream, options) {
+    const adapter2 = this.disk();
+    if (typeof adapter2.putStream !== "function") {
+      throw new Error(`[storage] disk '${this.config.default}' does not support putStream \u2014 adapter is missing the optional method`);
+    }
+    return adapter2.putStream(path2, stream, options);
+  }
+  async copyAcross(source, dest) {
+    const src = parseDiskPath(source);
+    const dst = parseDiskPath(dest);
+    if (src.disk === dst.disk) {
+      const adapter2 = this.disk(src.disk);
+      await adapter2.copyFile(src.path, dst.path);
+      return adapter2.stat(dst.path).then((entry) => ({
+        path: dst.path,
+        size: entry.size,
+        contentType: entry.mimeType,
+        lastModified: entry.lastModified
+      }));
+    }
+    const contents = await this.disk(src.disk).read(src.path);
+    return this.disk(dst.disk).write(dst.path, contents);
+  }
+  async moveAcross(source, dest) {
+    const src = parseDiskPath(source);
+    const result = await this.copyAcross(source, dest);
+    await this.disk(src.disk).deleteFile(src.path);
+    return result;
+  }
+  async get(path2) {
+    return this.disk().readToString(path2);
+  }
+  async exists(path2) {
+    return this.disk().fileExists(path2);
+  }
+  async missing(path2) {
+    return !await this.exists(path2);
+  }
+  async delete(path2) {
+    return this.disk().deleteFile(path2);
+  }
+  async copy(from, to) {
+    return this.disk().copyFile(from, to);
+  }
+  async move(from, to) {
+    return this.disk().moveFile(from, to);
+  }
+  async url(path2) {
+    return this.disk().publicUrl(path2);
+  }
+  async signedUrl(path2, options) {
+    const adapter2 = this.disk();
+    if (typeof adapter2.signedUrl !== "function") {
+      throw new Error(`[storage] disk '${this.config.default}' does not support signedUrl`);
+    }
+    return adapter2.signedUrl(path2, options);
+  }
+  async presignedUploadUrl(options) {
+    const adapter2 = this.disk();
+    if (typeof adapter2.presignedUploadUrl !== "function") {
+      throw new Error(`[storage] disk '${this.config.default}' does not support presignedUploadUrl \u2014 only S3-style adapters do. Use \`Storage.put(file, opts)\` for local/proxied uploads.`);
+    }
+    return adapter2.presignedUploadUrl(options);
+  }
+  async presignedUploadPolicy(options) {
+    const adapter2 = this.disk();
+    if (typeof adapter2.presignedUploadPolicy !== "function") {
+      throw new Error(`[storage] disk '${this.config.default}' does not support presignedUploadPolicy \u2014 S3-only. Use \`presignedUploadUrl\` for the PUT-form, or \`Storage.put(file, opts)\` for server-proxied uploads.`);
+    }
+    return adapter2.presignedUploadPolicy(options);
+  }
+  async size(path2) {
+    return this.disk().fileSize(path2);
+  }
+  async lastModified(path2) {
+    return this.disk().lastModified(path2);
+  }
+  async mimeType(path2) {
+    return this.disk().mimeType(path2);
+  }
+  async checksum(path2, algorithm) {
+    return this.disk().checksum(path2, { algorithm });
+  }
+  async makeDirectory(path2) {
+    return this.disk().createDirectory(path2);
+  }
+  async deleteDirectory(path2) {
+    return this.disk().deleteDirectory(path2);
+  }
+  files(path2 = "") {
+    return this.disk().list(path2);
+  }
+  allFiles(path2 = "") {
+    return this.disk().list(path2, { deep: true });
+  }
+  configure(name, config) {
+    const currentConfig = this.config;
+    currentConfig.disks[name] = config;
+    this.disks.delete(name);
+    return this;
+  }
+  setDefaultDisk(name) {
+    if (!this.config.disks[name]) {
+      throw new Error(`Disk [${name}] is not configured`);
+    }
+    this.config.default = name;
+    return this;
+  }
+  getDiskConfig(name) {
+    return this.config.disks[name || this.config.default];
+  }
+  getConfiguredDisks() {
+    return Object.keys(this.config.disks);
+  }
+  getDefaultDisk() {
+    return this.config.default;
+  }
+  reset() {
+    this._config = null;
+    this.customConfig = null;
+    this.disks.clear();
+    return this;
+  }
 }
-function doesNotExist(path) {
-  return !isFile(path) && !isFolder(path);
+var Storage;
+var init_facade = __esm(() => {
+  init_local();
+  init_s3();
+  init_path_sanitize();
+  init_put_file();
+  Storage = new StorageManager;
+});
+
+// src/copy.ts
+import { contains } from "@stacksjs/arrays";
+import { join } from "@stacksjs/path";
+
+// src/fs.ts
+import * as fs from "fs";
+import { existsSync, watch as fsWatch, mkdirSync, readFileSync, watchFile, writeFileSync } from "fs";
+function exists(path) {
+  return existsSync(path);
 }
-function hasFiles(folder) {
-  try {
-    return fs.readdirSync(folder).length > 0;
-  } catch (err2) {
-    log2.debug(`Error reading folder: ${folder}`, err2);
-    return false;
+
+// src/copy.ts
+function copy(src, dest, exclude = []) {
+  if (Array.isArray(src)) {
+    src.forEach((file) => {
+      copy(file, dest, exclude);
+    });
+  } else {
+    if (fs.statSync(src).isDirectory())
+      copyFolder(src, dest, exclude);
+    else
+      copyFile(src, dest);
   }
 }
-function hasComponents() {
-  return hasFiles(p.componentsPath());
-}
-function hasFunctions() {
-  return hasFiles(p.functionsPath());
+function copyFile(src, dest) {
+  fs.copyFileSync(src, dest);
 }
-function deleteFiles(dir, exclude = []) {
-  if (fs.existsSync(dir)) {
-    fs.readdirSync(dir).forEach((file) => {
-      const p2 = join4(dir, file);
-      if (fs.statSync(p2).isDirectory()) {
-        if (fs.readdirSync(p2).length === 0)
-          fs.rmSync(p2, { recursive: true, force: true });
+function copyFolder(src, dest, exclude = []) {
+  if (!fs.existsSync(dest))
+    fs.mkdirSync(dest, { recursive: true });
+  if (fs.existsSync(src)) {
+    fs.readdirSync(src).forEach((file) => {
+      if (!contains(join(src, file), exclude)) {
+        const srcPath = join(src, file);
+        const destPath = join(dest, file);
+        if (fs.statSync(srcPath).isDirectory())
+          copyFolder(srcPath, destPath, exclude);
         else
-          deleteFiles(p2, exclude);
-      } else if (!contains2(p2, exclude)) {
-        fs.rmSync(p2);
+          fs.copyFileSync(srcPath, destPath);
       }
     });
   }
 }
-function getFiles(dir, exclude = []) {
-  let results = [];
-  const list = fs.readdirSync(dir);
-  list.forEach((file) => {
-    file = join4(dir, file);
-    const stat = fs.statSync(file);
-    if (stat.isDirectory())
-      results = results.concat(getFiles(file, exclude));
-    else if (!contains2(file, exclude))
-      results.push(file);
-  });
-  return results;
+// src/delete.ts
+import { italic, log } from "@stacksjs/cli";
+import { err, handleError, ok } from "@stacksjs/error-handling";
+import { join as join3 } from "@stacksjs/path";
+
+// src/folders.ts
+import { join as join2 } from "@stacksjs/path";
+function isFolder(path) {
+  try {
+    return fs.statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
 }
-function put(path, contents) {
-  const dirPath = dirname(path);
-  if (!fs.existsSync(dirPath))
-    fs.mkdirSync(dirPath, { recursive: true });
-  fs.writeFileSync(path, contents, "utf-8");
+function isDir(path) {
+  return isFolder(path);
 }
-async function get(path) {
-  return Bun.file(path).text();
+function doesFolderExist(path) {
+  return fs.existsSync(path);
 }
-var files = {
-  readJsonFile,
-  readPackageJson,
-  readTextFile,
-  writeJsonFile,
-  writeTextFile,
-  hasFiles,
-  hasComponents,
-  hasFunctions,
-  deleteFiles,
-  getFiles,
-  put,
-  get
-};
-// src/hash.ts
-import { createHash } from "crypto";
-import { path as p2 } from "@stacksjs/path";
-function hashFileOrDirectory(path, hash) {
-  if (!fs.existsSync(path)) {
-    console.error(`Path does not exist: ${path}`);
-    return;
-  }
-  if (fs.statSync(path).isDirectory()) {
-    const files2 = fs.readdirSync(path);
-    for (const file of files2) {
-      const filePath = p2.join(path, file);
-      hashFileOrDirectory(filePath, hash);
+function createFolder(dir) {
+  return new Promise((resolve, reject) => {
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      resolve();
+    } catch (err) {
+      reject(err);
     }
-  } else {
-    hash.update(fs.readFileSync(path));
-  }
+  });
 }
-function hashDirectory(directory) {
-  const hash = createHash("sha256");
-  hashFileOrDirectory(directory, hash);
-  return hash.digest("hex");
+function getFolders(dir) {
+  return fs.readdirSync(dir).filter((file) => {
+    return fs.statSync(join2(dir, file)).isDirectory();
+  });
 }
-function hashPath(path) {
-  const hash = createHash("sha256");
-  hashFileOrDirectory(path, hash);
-  return hash.digest("hex");
+var folders = {
+  isFolder,
+  doesFolderExist,
+  createFolder,
+  getFolders
+};
+
+// src/glob.ts
+var {Glob: BunGlob } = globalThis.Bun;
+function isEnoent(err) {
+  return !!err && typeof err === "object" && err.code === "ENOENT";
 }
-function hashPaths(paths) {
-  const hash = createHash("sha256");
-  const pathsArray = Array.isArray(paths) ? paths : [paths];
-  for (const path of pathsArray)
-    hashFileOrDirectory(path, hash);
-  return hash.digest("hex");
+function globSync(patterns, options) {
+  const patternArray = typeof patterns === "string" ? [patterns] : patterns;
+  const results = [];
+  for (const pattern of patternArray) {
+    try {
+      const globInstance = new BunGlob(pattern);
+      const matches = globInstance.scanSync({
+        cwd: options?.cwd,
+        absolute: options?.absolute,
+        dot: options?.dot,
+        onlyFiles: options?.onlyFiles
+      });
+      for (const match of matches) {
+        results.push(match);
+      }
+    } catch (err) {
+      if (!isEnoent(err))
+        throw err;
+    }
+  }
+  return results;
 }
-// src/helpers.ts
-import { fileURLToPath } from "url";
-import { dirname as dirname2 } from "@stacksjs/path";
-var __dirname = "/home/runner/work/stacks/stacks/storage/framework/core/storage/src";
-var _dirname = typeof __dirname !== "undefined" ? __dirname : dirname2(fileURLToPath(import.meta.url));
-function updateConfigFile(filePath, newConfig) {
+async function glob(patterns, options) {
+  const patternArray = typeof patterns === "string" ? [patterns] : patterns;
+  const results = [];
+  for (const pattern of patternArray) {
+    try {
+      const globInstance = new BunGlob(pattern);
+      const matches = globInstance.scan({
+        cwd: options?.cwd,
+        absolute: options?.absolute,
+        dot: options?.dot,
+        onlyFiles: options?.onlyFiles
+      });
+      for await (const match of matches) {
+        results.push(match);
+      }
+    } catch (err) {
+      if (!isEnoent(err))
+        throw err;
+    }
+  }
+  return results;
+}
+
+// src/delete.ts
+function deleteFolder(path) {
   return new Promise((resolve, reject) => {
-    let config;
     try {
-      config = JSON.parse(fs.readFileSync(filePath, "utf8"));
+      if (isFolder(path)) {
+        fs.rmSync(path, { recursive: true, force: true });
+        return resolve(ok(`Deleted ${path}`));
+      }
+      return resolve(ok(`Path ${path} was not a directory`));
     } catch (error) {
-      reject(new Error(`Failed to parse config file "${filePath}": ${error.message}`));
-      return;
+      return reject(err(error));
     }
-    for (const key in newConfig)
-      config[key] = newConfig[key];
+  });
+}
+async function isDirectoryEmpty(path) {
+  return new Promise((resolve, reject) => {
     try {
-      fs.writeFileSync(filePath, JSON.stringify(config, null, 2));
-      resolve();
+      if (fs.statSync(path).isDirectory()) {
+        if (fs.readdirSync(path).length === 0)
+          return resolve(ok(true));
+        return resolve(ok(false));
+      }
+      return resolve(ok(false));
     } catch (error) {
-      reject(error);
+      return reject(err(error));
     }
   });
 }
-var helpers = {
-  _dirname,
-  updateConfigFile
-};
-// src/storage.ts
-var exports_storage = {};
-__export(exports_storage, {
-  zip: () => zip,
-  writeTextFile: () => writeTextFile,
-  writeJsonFile: () => writeJsonFile,
-  writeFileSync: () => writeFileSync,
-  writeFile: () => writeFile,
-  watchFile: () => watchFile,
-  updateConfigFile: () => updateConfigFile,
-  unzip: () => unzip,
-  unarchive: () => unarchive,
-  setVisibility: () => setVisibility,
-  rename: () => rename,
-  readTextFile: () => readTextFile,
-  readPackageJson: () => readPackageJson,
-  readJsonFile: () => readJsonFile,
-  readFileSync: () => readFileSync,
-  put: () => put,
-  move: () => move,
-  mkdirSync: () => mkdirSync,
-  isFolder: () => isFolder,
-  isDirectoryEmpty: () => isDirectoryEmpty,
-  isDir: () => isDir,
-  inflateSync: () => inflateSync,
-  helpers: () => helpers,
-  hasFunctions: () => hasFunctions,
-  hasFiles: () => hasFiles,
-  hasComponents: () => hasComponents,
-  gzipSync: () => gzipSync,
-  gunzipSync: () => gunzipSync,
-  getFolders: () => getFolders,
-  getFiles: () => getFiles,
-  get: () => get,
-  fsWatch: () => fsWatch,
-  fs: () => fs,
-  folders: () => folders,
-  files: () => files,
-  existsSync: () => existsSync,
-  exists: () => exists,
-  doesNotExist: () => doesNotExist,
-  doesFolderExist: () => doesFolderExist,
-  doesExist: () => doesExist,
-  deleteGlob: () => deleteGlob,
-  deleteFolder: () => deleteFolder,
-  deleteFiles: () => deleteFiles,
-  deleteFile: () => deleteFile,
-  deleteEmptyFolders: () => deleteEmptyFolders,
-  deleteEmptyFolder: () => deleteEmptyFolder,
-  del: () => del,
-  deflateSync: () => deflateSync,
-  decompress: () => decompress,
-  createFolder: () => createFolder,
-  copyFolder: () => copyFolder,
-  copyFile: () => copyFile,
-  copy: () => copy,
-  compress: () => compress,
-  archive: () => archive,
-  _dirname: () => _dirname
-});
-
-// src/move.ts
-import { err as err2, handleError as handleError2, ok as ok2 } from "@stacksjs/error-handling";
-import { log as log3 } from "@stacksjs/logging";
-import { path } from "@stacksjs/path";
-async function move(src, dest, options) {
-  try {
-    if (Array.isArray(src)) {
-      const errors = [];
-      const operations = src.map(async (file) => {
-        const from2 = file;
-        const to2 = path.resolve(dest, path.basename(file));
-        const result2 = await rename(from2, to2, options);
-        if (result2.isErr) {
-          log3.error(result2.error);
-          errors.push(result2.error);
-        }
-      });
-      await Promise.all(operations);
-      if (errors.length > 0)
-        return err2(handleError2(errors[0]));
-      return ok2({ message: "Files moved successfully" });
+async function deleteEmptyFolder(path) {
+  return new Promise((resolve, reject) => {
+    try {
+      if (fs.statSync(path).isDirectory()) {
+        if (fs.readdirSync(path).length === 0) {
+          fs.rmSync(path, { recursive: true, force: true });
+          return resolve(ok(`Deleted ${path}`));
+        }
+        return resolve(ok(`Path ${path} was not empty`));
+      }
+      return resolve(ok(`Path ${path} was not a directory`));
+    } catch (error) {
+      return reject(err(error));
     }
-    const from = src;
-    const to = dest;
-    const result = await rename(from, to, options);
-    if (result.isErr) {
-      log3.error(result.error);
-      return err2(handleError2(result.error));
+  });
+}
+async function deleteEmptyFolders(dir) {
+  try {
+    if (!fs.existsSync(dir))
+      return ok(`Path ${dir} does not exist`);
+    const files = fs.readdirSync(dir);
+    for (const file of files) {
+      const p = join3(dir, file);
+      if (isFolder(p)) {
+        if (fs.readdirSync(p).length === 0)
+          fs.rmSync(p, { recursive: true, force: true });
+        else
+          await deleteEmptyFolders(p);
+      }
     }
-    return ok2({ message: "File moved successfully" });
+    return ok(`Deleted empty folders located in ${dir}`);
   } catch (error) {
-    return err2(handleError2(error));
+    return err(error);
   }
 }
-async function rename(from, to, options) {
+function deleteFile(path) {
   return new Promise((resolve, reject) => {
     try {
-      const dir = path.dirname(to);
-      if (!fs.existsSync(dir))
-        fs.mkdirSync(dir, { recursive: true });
-      if (!fs.existsSync(from))
-        return reject(err2(new Error(`File or directory does not exist: ${from}`)));
-      if (fs.existsSync(to)) {
-        if (!options?.overwrite)
-          return reject(err2(new Error(`File or directory already exists: ${to}`)));
-        fs.rmSync(to, { recursive: true, force: true });
+      if (fs.statSync(path).isFile()) {
+        fs.rmSync(path, { recursive: true, force: true });
+        return resolve(ok(`Deleted ${path}`));
       }
-      fs.renameSync(from, to);
-      return resolve(ok2({ message: "File moved successfully" }));
+      return resolve(ok(`Path ${path} was not a file`));
     } catch (error) {
-      if (error.code === "ENOENT")
-        log3.error(`File or directory does not exist
-
-`, error);
-      else
-        log3.error(error);
-      return reject(err2(new Error(error)));
+      return reject(err(error));
     }
   });
 }
-// src/visibility.ts
-function setVisibility() {
-  return "wip";
-}
-// src/zip.ts
-import { runCommand } from "@stacksjs/cli";
-function shellEscape(_arg) {
-  return `'${_arg.replace(/'/g, "'\\''")}'`;
-}
-async function zip(from, to, options) {
-  const toPath = to || "archive.zip";
-  if (Array.isArray(from)) {
-    const fromPath = from.map((f) => shellEscape(f)).join(" ");
-    return runCommand(`zip -r ${shellEscape(toPath)} ${fromPath}`, options);
-  }
-  return runCommand(`zip -r ${shellEscape(toPath)} ${shellEscape(from)}`, options);
-}
-async function unzip(paths) {
-  if (Array.isArray(paths))
-    return runCommand(`unzip ${paths.map((p3) => shellEscape(p3)).join(" ")}`);
-  return runCommand(`unzip ${shellEscape(paths)}`);
-}
-function archive(paths) {
-  return zip(paths);
-}
-function unarchive(paths) {
-  return unzip(paths);
-}
-function compress(paths) {
-  return zip(paths);
-}
-function decompress(paths) {
-  return unzip(paths);
-}
-function gzipSync(data, options) {
-  return Bun.gzipSync(data, options);
-}
-function gunzipSync(data) {
-  return Bun.gunzipSync(data);
-}
-function deflateSync(data, options) {
-  return Bun.deflateSync(data, options);
-}
-function inflateSync(data) {
-  return Bun.inflateSync(data);
-}
-// src/adapters/local.ts
-import { Buffer as Buffer2 } from "buffer";
-import { createHmac as createHmac2 } from "crypto";
-import { createWriteStream } from "fs";
-import { access, constants, copyFile as copyFile2, lstat, mkdir, readdir, readFile, rename as rename2, rm, unlink, writeFile as writeFile2 } from "fs/promises";
-import { basename, dirname as dirname3, join as join5, relative } from "path";
-import { pipeline } from "stream/promises";
-
-// src/types.ts
-var Visibility;
-((Visibility2) => {
-  Visibility2["PUBLIC"] = "public";
-  Visibility2["PRIVATE"] = "private";
-})(Visibility ||= {});
-async function* createDirectoryListing(entries) {
-  for (const entry of entries) {
-    yield entry;
+async function deleteGlob(path) {
+  if (!path.includes("*"))
+    return err(handleError(`Path ${path} does not contain a glob`));
+  const directories = await glob([path], { onlyDirectories: true });
+  for (const directory of directories) {
+    const result = await deleteFolder(directory);
+    if (result.isErr) {
+      log.error(result.error);
+      return result;
+    }
+    log.info(`Deleted ${italic(directory)}`);
   }
+  return ok(`Deleted ${directories.length} directories`);
 }
-function normalizeExpiryToMilliseconds(expiry) {
-  if (expiry instanceof Date) {
-    return expiry.getTime() - Date.now();
-  }
-  return expiry * 1000;
+async function del(path) {
+  if (fs.existsSync(path) && fs.statSync(path).isFile())
+    return await deleteFile(path);
+  if (isFolder(path))
+    return await deleteFolder(path);
+  if (path.includes("*"))
+    return await deleteGlob(path);
+  return err(handleError(`Path ${path} cannot be deleted due to an unhandled condition. Please report this issue.`));
 }
-function normalizeExpiryToDate(expiry) {
-  if (expiry instanceof Date) {
-    return expiry;
+// src/files.ts
+import { contains as contains2 } from "@stacksjs/arrays";
+import { log as log2 } from "@stacksjs/logging";
+import { dirname, join as join4, path as p } from "@stacksjs/path";
+import { detectIndent, detectNewline } from "@stacksjs/strings";
+async function readJsonFile(name, cwd) {
+  const file = await readTextFile(name, cwd);
+  let data;
+  try {
+    data = JSON.parse(file.data);
+  } catch (error) {
+    throw new Error(`Failed to parse JSON file "${name}": ${error.message}`);
   }
-  return new Date(Date.now() + expiry * 1000);
-}
-function isFile2(entry) {
-  return entry.type === "file";
+  const indent = detectIndent(file.data).indent;
+  const newline = detectNewline(file.data);
+  return { ...file, data, indent, newline };
 }
-function isDirectory(entry) {
-  return entry.type === "directory";
+async function readPackageJson(name, cwd) {
+  const file = await readJsonFile(name, cwd);
+  return file.data;
 }
-
-// src/signed-url.ts
-import { Buffer } from "buffer";
-import { createHmac, timingSafeEqual } from "crypto";
-import process2 from "process";
-var ALG = "HS256";
-function getAppKey() {
-  const k = process2.env.APP_KEY;
-  if (!k || k.length < 16) {
-    if (process2.env.APP_ENV === "production" || process2.env.NODE_ENV === "production") {
-      throw new Error("[storage/signed-url] APP_KEY is missing or too short (need \u226516 chars). Cannot sign URL.");
-    }
+async function writeFile(path, data) {
+  if (typeof path === "string") {
+    const dirPath = dirname(path);
+    if (!await existsSync(dirPath))
+      await createFolder(dirPath);
+    return await Bun.write(Bun.file(path), data);
   }
-  return k || "stacks-default-key-dev-only-do-not-use-prod";
-}
-function base64UrlEncode(buf) {
-  return buf.toString("base64url");
-}
-function base64UrlDecode(str) {
-  return Buffer.from(str, "base64url");
+  return await Bun.write(path, data);
 }
-function normalizeExpiry(expiresIn) {
-  if (expiresIn instanceof Date)
-    return Math.floor(expiresIn.getTime() / 1000);
-  return Math.floor(Date.now() / 1000) + Math.floor(expiresIn);
+async function writeJsonFile(file) {
+  let json = JSON.stringify(file.data, undefined, file.indent);
+  if (file.newline)
+    json += file.newline;
+  return writeTextFile({ ...file, data: json });
 }
-function createSignedStorageToken(path2, options) {
-  const exp = normalizeExpiry(options.expiresIn);
-  const iat = Math.floor(Date.now() / 1000);
-  const header = { alg: ALG, typ: "JWT" };
-  const payload = {
-    iss: options.issuer || "stacks",
-    iat,
-    exp,
-    path: path2
-  };
-  const headerPart = base64UrlEncode(Buffer.from(JSON.stringify(header)));
-  const payloadPart = base64UrlEncode(Buffer.from(JSON.stringify(payload)));
-  const signingInput = `${headerPart}.${payloadPart}`;
-  const sig = base64UrlEncode(createHmac("sha256", getAppKey()).update(signingInput).digest());
-  return `${signingInput}.${sig}`;
+function readTextFile(name, cwd) {
+  return new Promise((resolve, reject) => {
+    let filePath;
+    if (cwd)
+      filePath = join4(cwd, name);
+    else
+      filePath = name;
+    fs.readFile(filePath, "utf8", (err2, text) => {
+      if (err2) {
+        reject(err2);
+      } else {
+        resolve({
+          path: filePath,
+          data: text
+        });
+      }
+    });
+  });
 }
-function verifySignedStorageToken(token, requestedPath) {
-  if (typeof token !== "string") {
-    return { valid: false, reason: "malformed" };
-  }
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    return { valid: false, reason: "malformed" };
-  }
-  const headerPart = parts[0];
-  const payloadPart = parts[1];
-  const sigPart = parts[2];
-  const signingInput = `${headerPart}.${payloadPart}`;
-  const expectedSig = createHmac("sha256", getAppKey()).update(signingInput).digest();
-  let providedSig;
-  try {
-    providedSig = base64UrlDecode(sigPart);
-  } catch {
-    return { valid: false, reason: "malformed" };
-  }
-  if (providedSig.length !== expectedSig.length || !timingSafeEqual(providedSig, expectedSig)) {
-    return { valid: false, reason: "bad_signature" };
-  }
-  let claims;
+async function writeTextFile(file) {
+  return await Bun.write(file.path, file.data);
+}
+function isFile(path) {
+  return fs.existsSync(path);
+}
+function doesExist(path) {
+  return isFile(path) || isFolder(path);
+}
+function doesNotExist(path) {
+  return !isFile(path) && !isFolder(path);
+}
+function hasFiles(folder) {
   try {
-    claims = JSON.parse(base64UrlDecode(payloadPart).toString("utf8"));
-  } catch {
-    return { valid: false, reason: "malformed" };
-  }
-  const now = Math.floor(Date.now() / 1000);
-  if (typeof claims.exp !== "number" || now >= claims.exp) {
-    return { valid: false, reason: "expired" };
-  }
-  if (claims.path !== requestedPath) {
-    return { valid: false, reason: "path_mismatch" };
+    return fs.readdirSync(folder).length > 0;
+  } catch (err2) {
+    log2.debug(`Error reading folder: ${folder}`, err2);
+    return false;
   }
-  return { valid: true, claims };
 }
-
-// src/adapters/local.ts
-class LocalStorageAdapter {
-  root;
-  constructor(config = {}) {
-    this.root = config.root || process.cwd();
+function hasComponents() {
+  return hasFiles(p.componentsPath());
+}
+function hasFunctions() {
+  return hasFiles(p.functionsPath());
+}
+function deleteFiles(dir, exclude = []) {
+  if (fs.existsSync(dir)) {
+    fs.readdirSync(dir).forEach((file) => {
+      const p2 = join4(dir, file);
+      if (fs.statSync(p2).isDirectory()) {
+        if (fs.readdirSync(p2).length === 0)
+          fs.rmSync(p2, { recursive: true, force: true });
+        else
+          deleteFiles(p2, exclude);
+      } else if (!contains2(p2, exclude)) {
+        fs.rmSync(p2);
+      }
+    });
   }
-  resolvePath(path2) {
-    const resolved = join5(this.root, path2);
-    const rel = relative(this.root, resolved);
-    if (rel.startsWith("..") || rel.startsWith("../") || rel.startsWith("..\\")) {
-      throw new Error(`Path traversal detected: '${path2}' resolves outside storage root`);
-    }
-    return resolved;
+}
+function getFiles(dir, exclude = []) {
+  let results = [];
+  const list = fs.readdirSync(dir);
+  list.forEach((file) => {
+    file = join4(dir, file);
+    const stat = fs.statSync(file);
+    if (stat.isDirectory())
+      results = results.concat(getFiles(file, exclude));
+    else if (!contains2(file, exclude))
+      results.push(file);
+  });
+  return results;
+}
+function put(path, contents) {
+  const dirPath = dirname(path);
+  if (!fs.existsSync(dirPath))
+    fs.mkdirSync(dirPath, { recursive: true });
+  fs.writeFileSync(path, contents, "utf-8");
+}
+async function get(path) {
+  return Bun.file(path).text();
+}
+var files = {
+  readJsonFile,
+  readPackageJson,
+  readTextFile,
+  writeJsonFile,
+  writeTextFile,
+  hasFiles,
+  hasComponents,
+  hasFunctions,
+  deleteFiles,
+  getFiles,
+  put,
+  get
+};
+// src/hash.ts
+import { createHash } from "crypto";
+import { path as p2 } from "@stacksjs/path";
+function hashFileOrDirectory(path, hash) {
+  if (!fs.existsSync(path)) {
+    console.error(`Path does not exist: ${path}`);
+    return;
   }
-  async write(path2, contents) {
-    const fullPath = this.resolvePath(path2);
-    const dir = dirname3(fullPath);
-    await mkdir(dir, { recursive: true });
-    if (typeof contents === "string") {
-      await writeFile2(fullPath, contents, "utf8");
-    } else if (contents instanceof Buffer2) {
-      await writeFile2(fullPath, contents);
-    } else if (contents instanceof Uint8Array) {
-      await writeFile2(fullPath, contents);
-    } else {
-      const writeStream = createWriteStream(fullPath);
-      await pipeline(contents, writeStream);
+  if (fs.statSync(path).isDirectory()) {
+    const files2 = fs.readdirSync(path);
+    for (const file of files2) {
+      const filePath = p2.join(path, file);
+      hashFileOrDirectory(filePath, hash);
     }
+  } else {
+    hash.update(fs.readFileSync(path));
   }
-  async read(path2) {
-    const fullPath = this.resolvePath(path2);
-    return await readFile(fullPath);
-  }
-  async readToString(path2) {
-    const fullPath = this.resolvePath(path2);
-    return await readFile(fullPath, "utf8");
-  }
-  async readToBuffer(path2) {
-    const fullPath = this.resolvePath(path2);
-    return await readFile(fullPath);
-  }
-  async readToUint8Array(path2) {
-    const fullPath = this.resolvePath(path2);
-    const buffer = await readFile(fullPath);
-    return new Uint8Array(buffer);
-  }
-  async deleteFile(path2) {
-    const fullPath = this.resolvePath(path2);
-    await unlink(fullPath);
-  }
-  async deleteDirectory(path2) {
-    const fullPath = this.resolvePath(path2);
-    await rm(fullPath, { recursive: true, force: true });
-  }
-  async createDirectory(path2) {
-    const fullPath = this.resolvePath(path2);
-    await mkdir(fullPath, { recursive: true });
-  }
-  async moveFile(from, to) {
-    const fromPath = this.resolvePath(from);
-    const toPath = this.resolvePath(to);
-    const toDir = dirname3(toPath);
-    await mkdir(toDir, { recursive: true });
-    await rename2(fromPath, toPath);
-  }
-  async copyFile(from, to) {
-    const fromPath = this.resolvePath(from);
-    const toPath = this.resolvePath(to);
-    const toDir = dirname3(toPath);
-    await mkdir(toDir, { recursive: true });
-    await copyFile2(fromPath, toPath);
-  }
-  async stat(path2) {
-    const fullPath = this.resolvePath(path2);
-    const stats = await lstat(fullPath);
-    return {
-      path: path2,
-      type: stats.isDirectory() ? "directory" : "file",
-      visibility: await this.visibility(path2),
-      size: stats.size,
-      lastModified: stats.mtimeMs,
-      mimeType: stats.isFile() ? await this.detectMimeType(fullPath) : undefined
-    };
-  }
-  list(path2, options = {}) {
-    return this.createAsyncIterator(path2, options.deep || false);
-  }
-  async* createAsyncIterator(path2, deep) {
-    const fullPath = this.resolvePath(path2);
+}
+function hashDirectory(directory) {
+  const hash = createHash("sha256");
+  hashFileOrDirectory(directory, hash);
+  return hash.digest("hex");
+}
+function hashPath(path) {
+  const hash = createHash("sha256");
+  hashFileOrDirectory(path, hash);
+  return hash.digest("hex");
+}
+function hashPaths(paths) {
+  const hash = createHash("sha256");
+  const pathsArray = Array.isArray(paths) ? paths : [paths];
+  for (const path of pathsArray)
+    hashFileOrDirectory(path, hash);
+  return hash.digest("hex");
+}
+// src/helpers.ts
+import { fileURLToPath } from "url";
+import { dirname as dirname2 } from "@stacksjs/path";
+var __dirname = "/home/runner/work/stacks/stacks/storage/framework/core/storage/src";
+var _dirname = typeof __dirname !== "undefined" ? __dirname : dirname2(fileURLToPath(import.meta.url));
+function updateConfigFile(filePath, newConfig) {
+  return new Promise((resolve, reject) => {
+    let config;
     try {
-      await access(fullPath, constants.R_OK);
-    } catch {
+      config = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    } catch (error) {
+      reject(new Error(`Failed to parse config file "${filePath}": ${error.message}`));
       return;
     }
-    const entries = await this.readDirectoryRecursive(fullPath, deep);
-    yield* createDirectoryListing(entries);
-  }
-  async readDirectoryRecursive(dirPath, deep) {
-    const entries = [];
+    for (const key in newConfig)
+      config[key] = newConfig[key];
     try {
-      const items = await readdir(dirPath, { withFileTypes: true });
-      for (const item of items) {
-        const itemPath = join5(dirPath, item.name);
-        const relativePath = relative(this.root, itemPath);
-        entries.push({
-          path: relativePath,
-          type: item.isDirectory() ? "directory" : "file"
-        });
-        if (deep && item.isDirectory()) {
-          const subEntries = await this.readDirectoryRecursive(itemPath, true);
-          entries.push(...subEntries);
+      fs.writeFileSync(filePath, JSON.stringify(config, null, 2));
+      resolve();
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+var helpers = {
+  _dirname,
+  updateConfigFile
+};
+// src/storage.ts
+var exports_storage = {};
+__export(exports_storage, {
+  zip: () => zip,
+  writeTextFile: () => writeTextFile,
+  writeJsonFile: () => writeJsonFile,
+  writeFileSync: () => writeFileSync,
+  writeFile: () => writeFile,
+  watchFile: () => watchFile,
+  updateConfigFile: () => updateConfigFile,
+  unzip: () => unzip,
+  unarchive: () => unarchive,
+  setVisibility: () => setVisibility,
+  rename: () => rename,
+  readTextFile: () => readTextFile,
+  readPackageJson: () => readPackageJson,
+  readJsonFile: () => readJsonFile,
+  readFileSync: () => readFileSync,
+  put: () => put,
+  move: () => move,
+  mkdirSync: () => mkdirSync,
+  isFolder: () => isFolder,
+  isDirectoryEmpty: () => isDirectoryEmpty,
+  isDir: () => isDir,
+  inflateSync: () => inflateSync,
+  helpers: () => helpers,
+  hasFunctions: () => hasFunctions,
+  hasFiles: () => hasFiles,
+  hasComponents: () => hasComponents,
+  gzipSync: () => gzipSync,
+  gunzipSync: () => gunzipSync,
+  getFolders: () => getFolders,
+  getFiles: () => getFiles,
+  get: () => get,
+  fsWatch: () => fsWatch,
+  fs: () => fs,
+  folders: () => folders,
+  files: () => files,
+  existsSync: () => existsSync,
+  exists: () => exists,
+  doesNotExist: () => doesNotExist,
+  doesFolderExist: () => doesFolderExist,
+  doesExist: () => doesExist,
+  deleteGlob: () => deleteGlob,
+  deleteFolder: () => deleteFolder,
+  deleteFiles: () => deleteFiles,
+  deleteFile: () => deleteFile,
+  deleteEmptyFolders: () => deleteEmptyFolders,
+  deleteEmptyFolder: () => deleteEmptyFolder,
+  del: () => del,
+  deflateSync: () => deflateSync,
+  decompress: () => decompress,
+  createFolder: () => createFolder,
+  copyFolder: () => copyFolder,
+  copyFile: () => copyFile,
+  copy: () => copy,
+  compress: () => compress,
+  archive: () => archive,
+  _dirname: () => _dirname
+});
+
+// src/move.ts
+import { err as err2, handleError as handleError2, ok as ok2 } from "@stacksjs/error-handling";
+import { log as log3 } from "@stacksjs/logging";
+import { path } from "@stacksjs/path";
+async function move(src, dest, options) {
+  try {
+    if (Array.isArray(src)) {
+      const errors = [];
+      const operations = src.map(async (file) => {
+        const from2 = file;
+        const to2 = path.resolve(dest, path.basename(file));
+        const result2 = await rename(from2, to2, options);
+        if (result2.isErr) {
+          log3.error(result2.error);
+          errors.push(result2.error);
         }
-      }
-    } catch (error) {
-      if (error?.code !== "EACCES" && error?.code !== "EPERM") {
-        throw error;
-      }
+      });
+      await Promise.all(operations);
+      if (errors.length > 0)
+        return err2(handleError2(errors[0]));
+      return ok2({ message: "Files moved successfully" });
     }
-    return entries;
-  }
-  async changeVisibility(_path, _visibility) {}
-  async visibility(_path) {
-    return "private";
-  }
-  async fileExists(path2) {
-    const fullPath = this.resolvePath(path2);
-    try {
-      const stats = await lstat(fullPath);
-      return stats.isFile();
-    } catch {
-      return false;
+    const from = src;
+    const to = dest;
+    const result = await rename(from, to, options);
+    if (result.isErr) {
+      log3.error(result.error);
+      return err2(handleError2(result.error));
     }
+    return ok2({ message: "File moved successfully" });
+  } catch (error) {
+    return err2(handleError2(error));
   }
-  async directoryExists(path2) {
-    const fullPath = this.resolvePath(path2);
+}
+async function rename(from, to, options) {
+  return new Promise((resolve, reject) => {
     try {
-      const stats = await lstat(fullPath);
-      return stats.isDirectory();
-    } catch {
-      return false;
+      const dir = path.dirname(to);
+      if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+      if (!fs.existsSync(from))
+        return reject(err2(new Error(`File or directory does not exist: ${from}`)));
+      if (fs.existsSync(to)) {
+        if (!options?.overwrite)
+          return reject(err2(new Error(`File or directory already exists: ${to}`)));
+        fs.rmSync(to, { recursive: true, force: true });
+      }
+      fs.renameSync(from, to);
+      return resolve(ok2({ message: "File moved successfully" }));
+    } catch (error) {
+      if (error.code === "ENOENT")
+        log3.error(`File or directory does not exist
+
+`, error);
+      else
+        log3.error(error);
+      return reject(err2(new Error(error)));
     }
+  });
+}
+// src/visibility.ts
+function setVisibility() {
+  return "wip";
+}
+// src/zip.ts
+import { runCommand } from "@stacksjs/cli";
+function shellEscape(_arg) {
+  return `'${_arg.replace(/'/g, "'\\''")}'`;
+}
+async function zip(from, to, options) {
+  const toPath = to || "archive.zip";
+  if (Array.isArray(from)) {
+    const fromPath = from.map((f) => shellEscape(f)).join(" ");
+    return runCommand(`zip -r ${shellEscape(toPath)} ${fromPath}`, options);
   }
-  async publicUrl(path2, options = {}) {
-    const domain = options.domain || "http://localhost";
-    return `${domain}/${path2}`;
-  }
-  async temporaryUrl(path2, options) {
-    const expiry = normalizeExpiryToDate(options.expiresIn);
-    const payload = `${path2}:${expiry.getTime()}`;
-    const appKey = process.env.APP_KEY || "stacks-default-key";
-    const signature = createHmac2("sha256", appKey).update(payload).digest("hex");
-    const token = Buffer2.from(`${payload}:${signature}`).toString("base64url");
-    return `http://localhost/temp/${token}`;
-  }
-  async signedUrl(path2, options) {
-    const token = createSignedStorageToken(path2, options);
-    const baseUrl = (options.baseUrl || process.env.APP_URL || "http://localhost").replace(/\/$/, "");
-    return `${baseUrl}/__storage/${encodeURIComponent(path2)}?token=${token}`;
-  }
-  async checksum(path2, options = {}) {
-    const algorithm = options.algorithm || "sha256";
-    const fullPath = this.resolvePath(path2);
-    const content = await readFile(fullPath);
-    const hasher = new Bun.CryptoHasher(algorithm);
-    hasher.update(content);
-    return hasher.digest("hex");
-  }
-  async mimeType(path2, options = {}) {
-    const fullPath = this.resolvePath(path2);
-    return await this.detectMimeType(fullPath);
-  }
-  async detectMimeType(filePath) {
-    const ext = basename(filePath).split(".").pop()?.toLowerCase();
-    const mimeTypes = {
-      txt: "text/plain",
-      html: "text/html",
-      css: "text/css",
-      js: "application/javascript",
-      json: "application/json",
-      xml: "application/xml",
-      pdf: "application/pdf",
-      zip: "application/zip",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      png: "image/png",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      mp4: "video/mp4",
-      mp3: "audio/mpeg",
-      wav: "audio/wav"
-    };
-    return mimeTypes[ext || ""] || "application/octet-stream";
-  }
-  async lastModified(path2) {
-    const stats = await this.stat(path2);
-    return stats.lastModified;
-  }
-  async fileSize(path2) {
-    const stats = await this.stat(path2);
-    return stats.size;
-  }
+  return runCommand(`zip -r ${shellEscape(toPath)} ${shellEscape(from)}`, options);
 }
-function createLocalStorage(config = {}) {
-  return new LocalStorageAdapter(config);
+async function unzip(paths) {
+  if (Array.isArray(paths))
+    return runCommand(`unzip ${paths.map((p3) => shellEscape(p3)).join(" ")}`);
+  return runCommand(`unzip ${shellEscape(paths)}`);
+}
+function archive(paths) {
+  return zip(paths);
+}
+function unarchive(paths) {
+  return unzip(paths);
+}
+function compress(paths) {
+  return zip(paths);
+}
+function decompress(paths) {
+  return unzip(paths);
+}
+function gzipSync(data, options) {
+  return Bun.gzipSync(data, options);
+}
+function gunzipSync(data) {
+  return Bun.gunzipSync(data);
+}
+function deflateSync(data, options) {
+  return Bun.deflateSync(data, options);
 }
+function inflateSync(data) {
+  return Bun.inflateSync(data);
+}
+// src/adapters/index.ts
+init_local();
+
 // src/adapters/memory.ts
+init_types();
 import { Buffer as Buffer3 } from "buffer";
 import { basename as basename2 } from "path";
+
 class InMemoryStorageAdapter {
   files;
   directories;
@@ -947,7 +2135,11 @@ class InMemoryStorageAdapter {
     } else if (contents instanceof Uint8Array) {
       return contents;
     } else {
-      const reader = contents.getReader();
+      const stream = contents;
+      if (typeof stream.getReader !== "function") {
+        throw new TypeError("[storage/memory] contents must be a web-standard ReadableStream " + "(with .getReader()), not a Node stream.Readable. " + "Convert via Readable.toWeb(nodeStream) before passing.");
+      }
+      const reader = stream.getReader.call(contents);
       const chunks = [];
       while (true) {
         const { done, value } = await reader.read();
@@ -973,20 +2165,81 @@ class InMemoryStorageAdapter {
       await this.createDirectory(dirPath);
     }
     const data = await this.contentsToUint8Array(contents);
+    const lastModified = Date.now();
+    const mimeType = this.detectMimeType(normalized);
+    this.files.set(normalized, {
+      contents: data,
+      visibility: "private",
+      mimeType,
+      lastModified
+    });
+    return {
+      path: normalized,
+      size: data.length,
+      contentType: mimeType,
+      lastModified
+    };
+  }
+  async read(path2) {
+    const normalized = this.normalizePath(path2);
+    const file = this.files.get(normalized);
+    if (!file) {
+      throw new Error(`File not found: ${path2}`);
+    }
+    return file.contents;
+  }
+  async getStream(path2, _options) {
+    const normalized = this.normalizePath(path2);
+    const file = this.files.get(normalized);
+    if (!file)
+      throw new Error(`File not found: ${path2}`);
+    const bytes = file.contents;
+    return new ReadableStream({
+      start(controller) {
+        controller.enqueue(bytes);
+        controller.close();
+      }
+    });
+  }
+  async putStream(path2, stream, options) {
+    const normalized = this.normalizePath(path2);
+    const dirPath = this.getDirectoryPath(normalized);
+    if (dirPath)
+      await this.createDirectory(dirPath);
+    const chunks = [];
+    const reader = stream.getReader();
+    const abort = options?.signal;
+    try {
+      while (true) {
+        if (abort?.aborted)
+          throw new Error("aborted");
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        if (value)
+          chunks.push(value);
+      }
+    } finally {
+      try {
+        reader.releaseLock();
+      } catch {}
+    }
+    const totalLength = chunks.reduce((sum, c) => sum + c.length, 0);
+    const data = new Uint8Array(totalLength);
+    let offset = 0;
+    for (const c of chunks) {
+      data.set(c, offset);
+      offset += c.length;
+    }
+    const lastModified = Date.now();
+    const mimeType = options?.contentType ?? this.detectMimeType(normalized);
     this.files.set(normalized, {
       contents: data,
       visibility: "private",
-      mimeType: this.detectMimeType(normalized),
-      lastModified: Date.now()
+      mimeType,
+      lastModified
     });
-  }
-  async read(path2) {
-    const normalized = this.normalizePath(path2);
-    const file = this.files.get(normalized);
-    if (!file) {
-      throw new Error(`File not found: ${path2}`);
-    }
-    return file.contents;
+    return { path: normalized, size: data.length, contentType: mimeType, lastModified };
   }
   async readToString(path2) {
     const data = await this.read(path2);
@@ -1163,8 +2416,8 @@ class InMemoryStorageAdapter {
     return this.directories.has(normalized) || normalized === "";
   }
   async publicUrl(path2, options = {}) {
-    const domain = options.domain || "http://localhost";
-    return `${domain}/${this.normalizePath(path2)}`;
+    const base = (options.domain || process.env.APP_URL || "http://localhost").replace(/\/$/, "");
+    return `${base}/${this.normalizePath(path2)}`;
   }
   async temporaryUrl(path2, options) {
     const expiry = normalizeExpiryToDate(options.expiresIn);
@@ -1228,261 +2481,18 @@ class InMemoryStorageAdapter {
 function createMemoryStorage() {
   return new InMemoryStorageAdapter;
 }
-// src/adapters/s3.ts
-import { Buffer as Buffer4 } from "buffer";
-import { basename as basename3 } from "path";
-class S3StorageAdapter {
-  client;
-  bucket;
-  prefix;
-  region;
-  constructor(client, config) {
-    this.client = client;
-    this.bucket = config.bucket || "";
-    this.prefix = config.prefix || "";
-    this.region = config.region || "us-east-1";
-    if (!this.bucket) {
-      throw new Error("S3 bucket name is required");
-    }
-  }
-  prefixPath(path2) {
-    if (!this.prefix)
-      return path2;
-    return `${this.prefix}/${path2}`.replace(/\/+/g, "/");
-  }
-  stripPrefix(path2) {
-    if (!this.prefix)
-      return path2;
-    const prefixWithSlash = `${this.prefix}/`;
-    return path2.startsWith(prefixWithSlash) ? path2.slice(prefixWithSlash.length) : path2;
-  }
-  async contentsToBuffer(contents) {
-    if (typeof contents === "string") {
-      return Buffer4.from(contents, "utf8");
-    } else if (contents instanceof Buffer4) {
-      return contents;
-    } else if (contents instanceof Uint8Array) {
-      return Buffer4.from(contents);
-    } else {
-      const reader = contents.getReader();
-      const chunks = [];
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-          break;
-        if (value)
-          chunks.push(value);
-      }
-      return Buffer4.concat(chunks.map((c) => Buffer4.from(c)));
-    }
-  }
-  async write(path2, contents) {
-    const key = this.prefixPath(path2);
-    const body = await this.contentsToBuffer(contents);
-    await this.client.putObject({
-      bucket: this.bucket,
-      key,
-      body,
-      contentType: this.detectMimeType(path2)
-    });
-  }
-  async read(path2) {
-    const key = this.prefixPath(path2);
-    const response = await this.client.getObject(this.bucket, key);
-    if (!response) {
-      throw new Error(`Failed to read file: ${path2}`);
-    }
-    return Buffer4.from(response);
-  }
-  async readToString(path2) {
-    const key = this.prefixPath(path2);
-    const response = await this.client.getObject(this.bucket, key);
-    if (!response) {
-      throw new Error(`Failed to read file: ${path2}`);
-    }
-    return response;
-  }
-  async readToBuffer(path2) {
-    const contents = await this.read(path2);
-    return contents;
-  }
-  async readToUint8Array(path2) {
-    const buffer = await this.readToBuffer(path2);
-    return new Uint8Array(buffer);
-  }
-  async deleteFile(path2) {
-    const key = this.prefixPath(path2);
-    await this.client.deleteObject(this.bucket, key);
-  }
-  async deleteDirectory(path2) {
-    const prefix = this.prefixPath(path2);
-    const normalizedPrefix = prefix.endsWith("/") ? prefix : `${prefix}/`;
-    const objects = await this.client.listAllObjects({ bucket: this.bucket, prefix: normalizedPrefix });
-    const keys = objects.map((obj) => obj.Key).filter((k) => typeof k === "string");
-    if (keys.length === 0) {
-      return;
-    }
-    await this.client.deleteObjects(this.bucket, keys);
-  }
-  async createDirectory(_path) {}
-  async moveFile(from, to) {
-    await this.copyFile(from, to);
-    await this.deleteFile(from);
-  }
-  async copyFile(from, to) {
-    const fromKey = this.prefixPath(from);
-    const toKey = this.prefixPath(to);
-    await this.client.copyObject({
-      sourceBucket: this.bucket,
-      sourceKey: fromKey,
-      destinationBucket: this.bucket,
-      destinationKey: toKey
-    });
-  }
-  async stat(path2) {
-    const key = this.prefixPath(path2);
-    const result = await this.client.headObject(this.bucket, key);
-    if (!result) {
-      throw new Error(`File not found: ${path2}`);
-    }
-    return {
-      path: path2,
-      type: "file",
-      visibility: "private",
-      size: result.ContentLength || 0,
-      lastModified: result.LastModified ? new Date(result.LastModified).getTime() : Date.now(),
-      mimeType: result.ContentType
-    };
-  }
-  list(path2, options = {}) {
-    return this.createAsyncIterator(path2, options.deep || false);
-  }
-  async* createAsyncIterator(path2, deep) {
-    const prefix = this.prefixPath(path2);
-    const normalizedPrefix = prefix ? `${prefix}/` : undefined;
-    if (deep) {
-      const objects = await this.client.listAllObjects({ bucket: this.bucket, prefix: normalizedPrefix });
-      for (const obj of objects) {
-        yield {
-          path: this.stripPrefix(obj.Key),
-          type: "file"
-        };
-      }
-    } else {
-      let continuationToken;
-      do {
-        const result = await this.client.listObjects({
-          bucket: this.bucket,
-          prefix: normalizedPrefix,
-          continuationToken
-        });
-        for (const obj of result.objects || []) {
-          yield {
-            path: this.stripPrefix(obj.Key),
-            type: "file"
-          };
-        }
-        continuationToken = result.nextContinuationToken;
-      } while (continuationToken);
-    }
-  }
-  async changeVisibility(_path, _visibility) {}
-  async visibility(_path) {
-    return "private";
-  }
-  async fileExists(path2) {
-    const key = this.prefixPath(path2);
-    try {
-      const result = await this.client.headObject(this.bucket, key);
-      return !!result;
-    } catch (error) {
-      if (!error.message?.includes("404") && !error.message?.includes("NoSuchKey") && !error.message?.includes("NotFound")) {
-        console.debug(`[s3] Unexpected error checking file existence for ${path2}: ${error.message}`);
-      }
-      return false;
-    }
-  }
-  async directoryExists(path2) {
-    const prefix = this.prefixPath(path2);
-    const result = await this.client.listObjects({
-      bucket: this.bucket,
-      prefix: `${prefix}/`,
-      maxKeys: 1
-    });
-    return (result.objects || []).length > 0;
-  }
-  async publicUrl(path2, options = {}) {
-    const key = this.prefixPath(path2);
-    const domain = options.domain || `https://${this.bucket}.s3.${this.region}.amazonaws.com`;
-    return `${domain}/${key}`;
-  }
-  async temporaryUrl(path2, options) {
-    const key = this.prefixPath(path2);
-    const expiresIn = Math.floor(normalizeExpiryToMilliseconds(options.expiresIn) / 1000);
-    const MIN_EXPIRY = 60;
-    const MAX_EXPIRY = 7 * 24 * 60 * 60;
-    if (!Number.isFinite(expiresIn) || expiresIn < MIN_EXPIRY || expiresIn > MAX_EXPIRY) {
-      throw new RangeError(`[storage/s3] temporaryUrl expiresIn must be between 60s and 7 days (got ${expiresIn}s)`);
-    }
-    return await this.client.getSignedUrl({
-      bucket: this.bucket,
-      key,
-      expiresIn,
-      operation: "getObject"
-    });
-  }
-  async signedUrl(path2, options) {
-    return this.temporaryUrl(path2, { expiresIn: options.expiresIn });
-  }
-  async checksum(path2, options = {}) {
-    const algorithm = options.algorithm || "sha256";
-    const content = await this.readToUint8Array(path2);
-    const hasher = new Bun.CryptoHasher(algorithm);
-    hasher.update(content);
-    return hasher.digest("hex");
-  }
-  async mimeType(path2, _options = {}) {
-    const stats = await this.stat(path2);
-    return stats.mimeType || this.detectMimeType(path2);
-  }
-  detectMimeType(path2) {
-    const ext = basename3(path2).split(".").pop()?.toLowerCase();
-    const mimeTypes = {
-      txt: "text/plain",
-      html: "text/html",
-      css: "text/css",
-      js: "application/javascript",
-      json: "application/json",
-      xml: "application/xml",
-      pdf: "application/pdf",
-      zip: "application/zip",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      png: "image/png",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      mp4: "video/mp4",
-      mp3: "audio/mpeg",
-      wav: "audio/wav"
-    };
-    return mimeTypes[ext || ""] || "application/octet-stream";
-  }
-  async lastModified(path2) {
-    const stats = await this.stat(path2);
-    return stats.lastModified;
-  }
-  async fileSize(path2) {
-    const stats = await this.stat(path2);
-    return stats.size;
-  }
-}
-function createS3Storage(client, config) {
-  return new S3StorageAdapter(client, config);
-}
+
+// src/adapters/index.ts
+init_s3();
+
 // src/adapters/bun.ts
-import { Buffer as Buffer5 } from "buffer";
+init_types();
+init_signed_url();
+import { Buffer as Buffer6 } from "buffer";
 var {file, write: bunWrite } = globalThis.Bun;
+import { chmod as chmod2, lstat as lstat2 } from "fs/promises";
 import { dirname as dirname4, join as join6, relative as relative2 } from "path";
+
 class BunStorageAdapter {
   root;
   constructor(config = {}) {
@@ -1502,12 +2512,16 @@ class BunStorageAdapter {
     await this.createDirectory(relative2(this.root, dir));
     if (typeof contents === "string") {
       await bunWrite(fullPath, contents);
-    } else if (contents instanceof Buffer5) {
+    } else if (contents instanceof Buffer6) {
       await bunWrite(fullPath, contents);
     } else if (contents instanceof Uint8Array) {
       await bunWrite(fullPath, contents);
     } else {
-      const reader = contents.getReader();
+      const stream = contents;
+      if (typeof stream.getReader !== "function") {
+        throw new TypeError("[storage/bun] contents must be a web-standard ReadableStream " + "(with .getReader()), not a Node stream.Readable. " + "Convert via Readable.toWeb(nodeStream) before passing.");
+      }
+      const reader = stream.getReader.call(contents);
       const chunks = [];
       while (true) {
         const { done, value } = await reader.read();
@@ -1525,6 +2539,12 @@ class BunStorageAdapter {
       }
       await bunWrite(fullPath, result);
     }
+    const written = file(fullPath);
+    return {
+      path: path2,
+      size: written.size,
+      lastModified: written.lastModified
+    };
   }
   async read(path2) {
     const fullPath = this.resolvePath(path2);
@@ -1532,7 +2552,46 @@ class BunStorageAdapter {
     if (!await bunFile.exists()) {
       throw new Error(`File not found: ${path2}`);
     }
-    return await bunFile.arrayBuffer().then((buf) => new Uint8Array(buf));
+    return await bunFile.arrayBuffer().then((buf) => new Uint8Array(buf));
+  }
+  async getStream(path2, _options) {
+    const fullPath = this.resolvePath(path2);
+    const bunFile = file(fullPath);
+    if (!await bunFile.exists())
+      throw new Error(`File not found: ${path2}`);
+    return bunFile.stream();
+  }
+  async putStream(path2, stream, options) {
+    const fullPath = this.resolvePath(path2);
+    const dir = dirname4(fullPath);
+    await this.createDirectory(relative2(this.root, dir));
+    try {
+      const body = new Response(stream);
+      const writePromise = bunWrite(fullPath, body);
+      if (options?.signal) {
+        const abortHandler = () => {};
+        options.signal.addEventListener("abort", abortHandler, { once: true });
+        try {
+          await writePromise;
+        } finally {
+          options.signal.removeEventListener("abort", abortHandler);
+        }
+      } else {
+        await writePromise;
+      }
+    } catch (err3) {
+      try {
+        await Bun.$.throws(false)`rm -f ${fullPath}`;
+      } catch {}
+      throw err3;
+    }
+    const written = file(fullPath);
+    return {
+      path: path2,
+      size: written.size,
+      contentType: options?.contentType,
+      lastModified: written.lastModified
+    };
   }
   async readToString(path2) {
     const fullPath = this.resolvePath(path2);
@@ -1549,7 +2608,7 @@ class BunStorageAdapter {
       throw new Error(`File not found: ${path2}`);
     }
     const arrayBuffer = await bunFile.arrayBuffer();
-    return Buffer5.from(arrayBuffer);
+    return Buffer6.from(arrayBuffer);
   }
   async readToUint8Array(path2) {
     const fullPath = this.resolvePath(path2);
@@ -1627,9 +2686,18 @@ class BunStorageAdapter {
     }
     yield* createDirectoryListing(entries);
   }
-  async changeVisibility(_path, _visibility) {}
-  async visibility(_path) {
-    return "private";
+  async changeVisibility(path2, vis) {
+    const fullPath = this.resolvePath(path2);
+    const stats = await lstat2(fullPath);
+    const isDir2 = stats.isDirectory();
+    const mode = vis === "public" ? isDir2 ? 493 : 420 : isDir2 ? 448 : 384;
+    await chmod2(fullPath, mode);
+  }
+  async visibility(path2) {
+    const fullPath = this.resolvePath(path2);
+    const stats = await lstat2(fullPath);
+    const perms = stats.mode & 511;
+    return perms & 4 ? "public" : "private";
   }
   async fileExists(path2) {
     const fullPath = this.resolvePath(path2);
@@ -1651,7 +2719,7 @@ class BunStorageAdapter {
   }
   async temporaryUrl(path2, options) {
     const expiry = normalizeExpiryToDate(options.expiresIn);
-    const token = Buffer5.from(`${path2}:${expiry.getTime()}`).toString("base64url");
+    const token = Buffer6.from(`${path2}:${expiry.getTime()}`).toString("base64url");
     return `http://localhost/temp/${token}`;
   }
   async signedUrl(path2, options) {
@@ -1691,23 +2759,173 @@ class BunStorageAdapter {
 function createBunStorage(config = {}) {
   return new BunStorageAdapter(config);
 }
+// src/adapters/scoped.ts
+var DEFAULT_SCOPE_PATTERN = /^[a-z0-9_-]+$/i;
+
+class ScopedStorageAdapter {
+  inner;
+  scope;
+  scopeWithSlash;
+  constructor(inner, options) {
+    const pattern = options.scopePattern ?? DEFAULT_SCOPE_PATTERN;
+    const cleaned = String(options.scope).replace(/^\/+|\/+$/g, "");
+    if (!cleaned)
+      throw new Error("[storage/scoped] scope is required");
+    if (!pattern.test(cleaned))
+      throw new Error(`[storage/scoped] scope '${cleaned}' contains disallowed characters`);
+    if (cleaned.includes("..") || cleaned.includes("/"))
+      throw new Error(`[storage/scoped] scope '${cleaned}' cannot contain path separators or traversal`);
+    this.inner = inner;
+    this.scope = cleaned;
+    this.scopeWithSlash = `${cleaned}/`;
+  }
+  scopePath(path2) {
+    if (typeof path2 !== "string")
+      throw new Error("[storage/scoped] path must be a string");
+    if (path2.length === 0)
+      return this.scope;
+    if (path2.includes("\x00"))
+      throw new Error("[storage/scoped] path contains a null byte");
+    if (path2.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path2))
+      throw new Error(`[storage/scoped] path '${path2}' is absolute \u2014 refusing to escape scope`);
+    const segments = path2.split(/[/\\]/);
+    if (segments.some((s) => s === ".."))
+      throw new Error(`[storage/scoped] path '${path2}' contains a '..' segment \u2014 refusing to escape scope`);
+    return `${this.scope}/${path2.replace(/^\/+/, "")}`;
+  }
+  unscopePath(path2) {
+    if (path2 === this.scope)
+      return "";
+    if (path2.startsWith(this.scopeWithSlash))
+      return path2.slice(this.scopeWithSlash.length);
+    return path2;
+  }
+  async write(path2, contents) {
+    const result = await this.inner.write(this.scopePath(path2), contents);
+    return { ...result, path: this.unscopePath(result.path) };
+  }
+  async read(path2) {
+    return this.inner.read(this.scopePath(path2));
+  }
+  async readToString(path2) {
+    return this.inner.readToString(this.scopePath(path2));
+  }
+  async readToBuffer(path2) {
+    return this.inner.readToBuffer(this.scopePath(path2));
+  }
+  async readToUint8Array(path2) {
+    return this.inner.readToUint8Array(this.scopePath(path2));
+  }
+  async deleteFile(path2) {
+    return this.inner.deleteFile(this.scopePath(path2));
+  }
+  async deleteDirectory(path2) {
+    return this.inner.deleteDirectory(this.scopePath(path2));
+  }
+  async createDirectory(path2) {
+    return this.inner.createDirectory(this.scopePath(path2));
+  }
+  async moveFile(from, to) {
+    return this.inner.moveFile(this.scopePath(from), this.scopePath(to));
+  }
+  async copyFile(from, to) {
+    return this.inner.copyFile(this.scopePath(from), this.scopePath(to));
+  }
+  async stat(path2) {
+    const entry = await this.inner.stat(this.scopePath(path2));
+    return { ...entry, path: this.unscopePath(entry.path) };
+  }
+  list(path2, options) {
+    const inner = this.inner.list(this.scopePath(path2), options);
+    const unscope = this.unscopePath.bind(this);
+    return async function* () {
+      for await (const entry of inner) {
+        yield { ...entry, path: unscope(entry.path) };
+      }
+    }();
+  }
+  async changeVisibility(path2, visibility2) {
+    return this.inner.changeVisibility(this.scopePath(path2), visibility2);
+  }
+  async visibility(path2) {
+    return this.inner.visibility(this.scopePath(path2));
+  }
+  async fileExists(path2) {
+    return this.inner.fileExists(this.scopePath(path2));
+  }
+  async directoryExists(path2) {
+    return this.inner.directoryExists(this.scopePath(path2));
+  }
+  async publicUrl(path2, options) {
+    return this.inner.publicUrl(this.scopePath(path2), options);
+  }
+  async temporaryUrl(path2, options) {
+    return this.inner.temporaryUrl(this.scopePath(path2), options);
+  }
+  async signedUrl(path2, options) {
+    if (typeof this.inner.signedUrl !== "function")
+      throw new Error("[storage/scoped] wrapped adapter does not support signedUrl");
+    return this.inner.signedUrl(this.scopePath(path2), options);
+  }
+  async presignedUploadUrl(options) {
+    if (typeof this.inner.presignedUploadUrl !== "function")
+      throw new Error("[storage/scoped] wrapped adapter does not support presignedUploadUrl");
+    const scopedDir = options.dir ? `${this.scope}/${options.dir.replace(/^\/+/, "")}` : this.scope;
+    const result = await this.inner.presignedUploadUrl({ ...options, dir: scopedDir });
+    return { ...result, path: this.unscopePath(result.path), key: this.unscopePath(result.key) };
+  }
+  async presignedUploadPolicy(options) {
+    if (typeof this.inner.presignedUploadPolicy !== "function")
+      throw new Error("[storage/scoped] wrapped adapter does not support presignedUploadPolicy");
+    const scopedKey = typeof options.key === "string" ? this.scopePath(options.key) : { startsWith: this.scopePath(options.key.startsWith) };
+    const result = await this.inner.presignedUploadPolicy({ ...options, key: scopedKey });
+    return { ...result, key: this.unscopePath(result.key) };
+  }
+  async getStream(path2, options) {
+    if (typeof this.inner.getStream !== "function")
+      throw new Error("[storage/scoped] wrapped adapter does not support getStream");
+    return this.inner.getStream(this.scopePath(path2), options);
+  }
+  async putStream(path2, stream, options) {
+    if (typeof this.inner.putStream !== "function")
+      throw new Error("[storage/scoped] wrapped adapter does not support putStream");
+    const result = await this.inner.putStream(this.scopePath(path2), stream, options);
+    return { ...result, path: this.unscopePath(result.path) };
+  }
+  async checksum(path2, options) {
+    return this.inner.checksum(this.scopePath(path2), options);
+  }
+  async mimeType(path2, options) {
+    return this.inner.mimeType(this.scopePath(path2), options);
+  }
+  async lastModified(path2) {
+    return this.inner.lastModified(this.scopePath(path2));
+  }
+  async fileSize(path2) {
+    return this.inner.fileSize(this.scopePath(path2));
+  }
+}
+function scoped(inner, options) {
+  return new ScopedStorageAdapter(inner, options);
+}
+// src/index.ts
+init_types();
+
 // src/drivers/aws.ts
-import { S3Client } from "@stacksjs/ts-cloud";
+init_s3();
 var _adapterPromise = null;
 async function loadConfig() {
   try {
     const { filesystems } = await import("@stacksjs/config");
     const s3Config = filesystems.s3;
-    const client = new S3Client(s3Config?.region || "us-east-1");
-    return createS3Storage(client, {
+    return createS3Storage(null, {
       bucket: s3Config?.bucket || "stacks",
       prefix: s3Config?.prefix || "stx",
       region: s3Config?.region || "us-east-1"
     });
   } catch {
     const { env } = await import("@stacksjs/env");
-    const client = new S3Client(env.AWS_REGION || "us-east-1");
-    return createS3Storage(client, {
+    return createS3Storage(null, {
       bucket: env.AWS_S3_BUCKET || "stacks",
       prefix: env.AWS_S3_PREFIX || "stx",
       region: env.AWS_REGION || "us-east-1"
@@ -1812,16 +3030,17 @@ var aws = {
   }
 };
 // src/drivers/local.ts
+init_local();
 import { resolve } from "path";
-import process3 from "process";
+import process4 from "process";
 var _adapterPromise2 = null;
 async function loadConfig2() {
   try {
     const { filesystems } = await import("@stacksjs/config");
-    const rootDirectory = resolve(filesystems.root || process3.cwd());
+    const rootDirectory = resolve(filesystems.root || process4.cwd());
     return createLocalStorage({ root: rootDirectory });
   } catch {
-    const rootDirectory = resolve(process3.cwd());
+    const rootDirectory = resolve(process4.cwd());
     return createLocalStorage({ root: rootDirectory });
   }
 }
@@ -1992,15 +3211,15 @@ var memory2 = {
 };
 // src/drivers/bun.ts
 import { resolve as resolve2 } from "path";
-import process4 from "process";
+import process5 from "process";
 var _adapterPromise3 = null;
 async function loadConfig3() {
   try {
     const { filesystems } = await import("@stacksjs/config");
-    const rootDirectory = resolve2(filesystems.root || process4.cwd());
+    const rootDirectory = resolve2(filesystems.root || process5.cwd());
     return createBunStorage({ root: rootDirectory });
   } catch {
-    const rootDirectory = resolve2(process4.cwd());
+    const rootDirectory = resolve2(process5.cwd());
     return createBunStorage({ root: rootDirectory });
   }
 }
@@ -2224,198 +3443,14 @@ function guessMime(filePath) {
       return "application/octet-stream";
   }
 }
-// src/facade.ts
-import { resolve as resolve3 } from "path";
-import process5 from "process";
-import { filesystems, app as appConfig } from "@stacksjs/config";
-import { S3Client as S3Client2 } from "@stacksjs/ts-cloud";
-function buildConfig() {
-  const cwd = process5.cwd();
-  const rootDir = filesystems.root || cwd;
-  const s3Config = filesystems.s3;
-  const appUrl = appConfig?.url || "";
-  const config = {
-    default: filesystems.driver || "local",
-    disks: {
-      local: {
-        driver: "local",
-        root: resolve3(rootDir, "storage/app"),
-        visibility: filesystems.defaultVisibility || "private"
-      },
-      public: {
-        driver: "local",
-        root: resolve3(rootDir, "public"),
-        url: appUrl ? `${appUrl}/storage` : "/storage",
-        visibility: "public"
-      }
-    }
-  };
-  if (s3Config?.bucket) {
-    config.disks.s3 = {
-      driver: "s3",
-      bucket: s3Config.bucket,
-      region: s3Config.region || "us-east-1",
-      prefix: s3Config.prefix,
-      endpoint: s3Config.endpoint,
-      url: filesystems.publicUrl?.domain,
-      usePathStyleEndpoint: !!s3Config.endpoint,
-      visibility: filesystems.defaultVisibility || "private",
-      credentials: s3Config.credentials ? { key: s3Config.credentials.accessKeyId, secret: s3Config.credentials.secretAccessKey } : undefined
-    };
-  }
-  return config;
-}
 
-class StorageManager {
-  _config = null;
-  disks = new Map;
-  s3Clients = new Map;
-  customConfig = null;
-  get config() {
-    if (!this._config) {
-      const builtConfig = buildConfig();
-      this._config = this.customConfig ? {
-        default: this.customConfig.default || builtConfig.default,
-        disks: { ...builtConfig.disks, ...this.customConfig.disks }
-      } : builtConfig;
-    }
-    return this._config;
-  }
-  init(config) {
-    this.customConfig = config;
-    this._config = null;
-    this.disks.clear();
-    this.s3Clients.clear();
-    return this;
-  }
-  disk(name) {
-    const diskName = name || this.config.default;
-    if (this.disks.has(diskName)) {
-      return this.disks.get(diskName);
-    }
-    const diskConfig = this.config.disks[diskName];
-    if (!diskConfig) {
-      const available = Object.keys(this.config.disks).join(", ");
-      throw new Error(`Disk [${diskName}] is not configured. Available: ${available}`);
-    }
-    const adapter2 = this.createAdapter(diskName, diskConfig);
-    this.disks.set(diskName, adapter2);
-    return adapter2;
-  }
-  createAdapter(name, config) {
-    switch (config.driver) {
-      case "local":
-        return this.createLocalAdapter(config);
-      case "s3":
-        return this.createS3Adapter(name, config);
-      default:
-        throw new Error(`Unsupported driver: ${config.driver}`);
-    }
-  }
-  createLocalAdapter(config) {
-    return createLocalStorage({ root: config.root });
-  }
-  createS3Adapter(name, config) {
-    let client = this.s3Clients.get(name);
-    if (!client) {
-      client = new S3Client2(config.region || "us-east-1");
-      this.s3Clients.set(name, client);
-    }
-    return new S3StorageAdapter(client, {
-      bucket: config.bucket,
-      region: config.region,
-      prefix: config.prefix
-    });
-  }
-  async put(path2, contents) {
-    return this.disk().write(path2, contents);
-  }
-  async get(path2) {
-    return this.disk().readToString(path2);
-  }
-  async exists(path2) {
-    return this.disk().fileExists(path2);
-  }
-  async missing(path2) {
-    return !await this.exists(path2);
-  }
-  async delete(path2) {
-    return this.disk().deleteFile(path2);
-  }
-  async copy(from, to) {
-    return this.disk().copyFile(from, to);
-  }
-  async move(from, to) {
-    return this.disk().moveFile(from, to);
-  }
-  async url(path2) {
-    return this.disk().publicUrl(path2);
-  }
-  async signedUrl(path2, options) {
-    const adapter2 = this.disk();
-    if (typeof adapter2.signedUrl !== "function") {
-      throw new Error(`[storage] disk '${this.config.default}' does not support signedUrl`);
-    }
-    return adapter2.signedUrl(path2, options);
-  }
-  async size(path2) {
-    return this.disk().fileSize(path2);
-  }
-  async lastModified(path2) {
-    return this.disk().lastModified(path2);
-  }
-  async mimeType(path2) {
-    return this.disk().mimeType(path2);
-  }
-  async checksum(path2, algorithm) {
-    return this.disk().checksum(path2, { algorithm });
-  }
-  async makeDirectory(path2) {
-    return this.disk().createDirectory(path2);
-  }
-  async deleteDirectory(path2) {
-    return this.disk().deleteDirectory(path2);
-  }
-  files(path2 = "") {
-    return this.disk().list(path2);
-  }
-  allFiles(path2 = "") {
-    return this.disk().list(path2, { deep: true });
-  }
-  configure(name, config) {
-    const currentConfig = this.config;
-    currentConfig.disks[name] = config;
-    this.disks.delete(name);
-    this.s3Clients.delete(name);
-    return this;
-  }
-  setDefaultDisk(name) {
-    if (!this.config.disks[name]) {
-      throw new Error(`Disk [${name}] is not configured`);
-    }
-    this.config.default = name;
-    return this;
-  }
-  getDiskConfig(name) {
-    return this.config.disks[name || this.config.default];
-  }
-  getConfiguredDisks() {
-    return Object.keys(this.config.disks);
-  }
-  getDefaultDisk() {
-    return this.config.default;
-  }
-  reset() {
-    this._config = null;
-    this.customConfig = null;
-    this.disks.clear();
-    this.s3Clients.clear();
-    return this;
-  }
-}
-var Storage = new StorageManager;
+// src/index.ts
+init_facade();
+
 // src/uploaded-file.ts
+init_facade();
 import { basename as basename5, extname as extname2, join as join7 } from "path";
+
 class UploadedFile {
   _file;
   _hashName = null;
@@ -2574,6 +3609,67 @@ function configFromEnv(base = {}) {
     }
   };
 }
+
+// src/index.ts
+init_signed_url();
+init_path_sanitize();
+
+// src/mime-verify.ts
+function detectMimeFromMagicBytes(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  if (view.length < 4)
+    return null;
+  if (view[0] === 137 && view[1] === 80 && view[2] === 78 && view[3] === 71 && view[4] === 13 && view[5] === 10 && view[6] === 26 && view[7] === 10)
+    return "image/png";
+  if (view[0] === 255 && view[1] === 216 && view[2] === 255)
+    return "image/jpeg";
+  if (view[0] === 71 && view[1] === 73 && view[2] === 70 && view[3] === 56)
+    return "image/gif";
+  if (view[0] === 82 && view[1] === 73 && view[2] === 70 && view[3] === 70 && view.length >= 12) {
+    if (view[8] === 87 && view[9] === 69 && view[10] === 66 && view[11] === 80)
+      return "image/webp";
+    if (view[8] === 87 && view[9] === 65 && view[10] === 86 && view[11] === 69)
+      return "audio/wav";
+  }
+  if (view[0] === 37 && view[1] === 80 && view[2] === 68 && view[3] === 70)
+    return "application/pdf";
+  if (view[0] === 80 && view[1] === 75 && (view[2] === 3 || view[2] === 5) && (view[3] === 4 || view[3] === 6))
+    return "application/zip";
+  if (view.length >= 12 && view[4] === 102 && view[5] === 116 && view[6] === 121 && view[7] === 112) {
+    const brand = String.fromCharCode(view[8] ?? 0, view[9] ?? 0, view[10] ?? 0, view[11] ?? 0);
+    if (brand === "avif" || brand === "avis")
+      return "image/avif";
+    if (brand === "heic" || brand === "heix" || brand === "mif1")
+      return "image/heic";
+    return "video/mp4";
+  }
+  if (view[0] === 26 && view[1] === 69 && view[2] === 223 && view[3] === 163)
+    return "video/webm";
+  if (view[0] === 73 && view[1] === 68 && view[2] === 51)
+    return "audio/mpeg";
+  if (view[0] === 255 && (view[1] ?? 0) >= 224)
+    return "audio/mpeg";
+  return null;
+}
+function normalizeContentType(contentType) {
+  return contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+async function verifyUploadedMime(path2, expectedContentType, options = {}) {
+  const { Storage: Storage2 } = await Promise.resolve().then(() => (init_facade(), exports_facade));
+  const disk = Storage2.disk(options.disk);
+  const bytes = await disk.readToUint8Array(path2);
+  const expected = normalizeContentType(expectedContentType);
+  const detected = detectMimeFromMagicBytes(bytes.slice(0, 32));
+  const matches = detected === expected || detected === "image/jpeg" && (expected === "image/jpg" || expected === "image/pjpeg");
+  return {
+    ok: matches,
+    expected,
+    detected
+  };
+}
+
+// src/index.ts
+init_s3_presigned_post();
 export {
   zip,
   writeTextFile,
@@ -2581,6 +3677,7 @@ export {
   writeFileSync,
   writeFile,
   watchFile,
+  verifyUploadedMime,
   verifySignedStorageToken,
   uploadedFiles,
   uploadedFile,
@@ -2588,13 +3685,19 @@ export {
   unzip,
   unarchive,
   exports_storage as storage,
+  signS3PresignedPost,
   serveFile,
+  scoped,
+  sanitizePresignedFilename,
+  sanitizePresignedDir,
   s3Disk,
+  revokeSignedStorageToken,
   readTextFile,
   readPackageJson,
   readJsonFile,
   readFileSync,
   put,
+  parseDiskPath,
   normalizeExpiryToMilliseconds,
   normalizeExpiryToDate,
   mkdirSync,
@@ -2602,6 +3705,7 @@ export {
   memory2 as memory,
   localDisk,
   local2 as local,
+  isSignedStorageTokenRevoked,
   isFolder,
   isFile2 as isFile,
   isDirectoryEmpty,
@@ -2635,6 +3739,7 @@ export {
   doesNotExist,
   doesFolderExist,
   doesExist,
+  detectMimeFromMagicBytes,
   deleteGlob,
   deleteFolder,
   deleteFiles,
@@ -2656,6 +3761,7 @@ export {
   copy,
   configFromEnv,
   compress,
+  clearRevokedSignedStorageTokens,
   bun2 as bun,
   aws,
   archive,
@@ -2664,7 +3770,9 @@ export {
   UploadedFile,
   StorageManager,
   Storage,
+  ScopedStorageAdapter,
   S3StorageAdapter,
+  PathSanitizeError,
   LocalStorageAdapter,
   InMemoryStorageAdapter,
   BunStorageAdapter