@useupup/server 3.3.0

package/dist/express.cjs

@@ -0,0 +1,2360 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/providers/s3-client.ts
+function buildS3ClientConfig(storage) {
+  const config = { region: storage.region };
+  if (storage.accessKeyId && storage.secretAccessKey) {
+    config.credentials = {
+      accessKeyId: storage.accessKeyId,
+      secretAccessKey: storage.secretAccessKey
+    };
+  }
+  if (storage.endpoint) {
+    config.endpoint = storage.endpoint;
+    config.forcePathStyle = storage.forcePathStyle ?? true;
+  }
+  return config;
+}
+function cacheKey(storage) {
+  return [
+    storage.endpoint ?? "",
+    storage.region,
+    storage.bucket,
+    storage.accessKeyId ?? "",
+    String(storage.forcePathStyle ?? "")
+  ].join("\0");
+}
+function createS3Client(storage) {
+  const key = cacheKey(storage);
+  const cached = clients.get(key);
+  if (cached) return cached;
+  const client = new import_client_s3.S3Client(buildS3ClientConfig(storage));
+  clients.set(key, client);
+  return client;
+}
+var import_client_s3, clients;
+var init_s3_client = __esm({
+  "src/providers/s3-client.ts"() {
+    "use strict";
+    import_client_s3 = require("@aws-sdk/client-s3");
+    clients = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/providers/aws.ts
+function computePartSize(fileSize, chunkSizeBytes) {
+  let partSize = chunkSizeBytes ?? MIN_PART_SIZE;
+  if (partSize < MIN_PART_SIZE) partSize = MIN_PART_SIZE;
+  const minPartSizeForFile = Math.ceil(fileSize / MAX_PARTS);
+  if (partSize < minPartSizeForFile) partSize = minPartSizeForFile;
+  return partSize;
+}
+async function generateSignedPublicUrl(storage, key, expiresIn = DEFAULT_DOWNLOAD_URL_EXPIRES_IN) {
+  const client = createS3Client(storage);
+  return (0, import_s3_request_presigner.getSignedUrl)(
+    client,
+    new import_client_s32.GetObjectCommand({ Bucket: storage.bucket, Key: key }),
+    { expiresIn }
+  );
+}
+async function generatePresignedUrl(storage, key, contentType, contentLength, expiresIn = DEFAULT_EXPIRES_IN, downloadUrlExpiresIn) {
+  const client = createS3Client(storage);
+  const command = new import_client_s32.PutObjectCommand({
+    Bucket: storage.bucket,
+    Key: key,
+    ContentType: contentType,
+    ContentLength: contentLength
+  });
+  const uploadUrl = await (0, import_s3_request_presigner.getSignedUrl)(client, command, {
+    expiresIn,
+    // Bind content-length into the signature so the PUT body cannot exceed the
+    // approved size (S1). Browsers/Node set Content-Length from the body; a
+    // larger body changes it and S3 rejects the signature.
+    signableHeaders: /* @__PURE__ */ new Set(["content-type", "content-length"])
+  });
+  const downloadUrl = await generateSignedPublicUrl(
+    storage,
+    key,
+    downloadUrlExpiresIn ?? DEFAULT_DOWNLOAD_URL_EXPIRES_IN
+  );
+  return {
+    key,
+    downloadUrl,
+    uploadUrl,
+    uploadHeaders: {
+      "Content-Type": contentType || "application/octet-stream"
+    },
+    expiresIn
+  };
+}
+async function initiateMultipartUpload(storage, key, contentType, fileSize, expiresIn = DEFAULT_EXPIRES_IN, chunkSizeBytes) {
+  const client = createS3Client(storage);
+  const command = new import_client_s32.CreateMultipartUploadCommand({
+    Bucket: storage.bucket,
+    Key: key,
+    ContentType: contentType
+  });
+  const response = await client.send(command);
+  if (!response.UploadId) {
+    throw new import_core5.UpupStorageError(
+      "Failed to initiate multipart upload: no UploadId",
+      storage.type,
+      "multipart-init"
+    );
+  }
+  const partSize = computePartSize(fileSize, chunkSizeBytes);
+  return { key, uploadId: response.UploadId, partSize, expiresIn };
+}
+async function generatePresignedPartUrl(storage, key, uploadId, partNumber, expiresIn = DEFAULT_EXPIRES_IN) {
+  const client = createS3Client(storage);
+  const command = new import_client_s32.UploadPartCommand({
+    Bucket: storage.bucket,
+    Key: key,
+    UploadId: uploadId,
+    PartNumber: partNumber
+  });
+  const uploadUrl = await (0, import_s3_request_presigner.getSignedUrl)(client, command, { expiresIn });
+  return { uploadUrl, expiresIn };
+}
+async function completeMultipartUpload(storage, key, uploadId, parts, downloadUrlExpiresIn) {
+  const client = createS3Client(storage);
+  const command = new import_client_s32.CompleteMultipartUploadCommand({
+    Bucket: storage.bucket,
+    Key: key,
+    UploadId: uploadId,
+    MultipartUpload: {
+      Parts: parts.sort((a, b) => a.partNumber - b.partNumber).map((p) => ({ PartNumber: p.partNumber, ETag: p.eTag }))
+    }
+  });
+  const result = await client.send(command);
+  const downloadUrl = await generateSignedPublicUrl(
+    storage,
+    key,
+    downloadUrlExpiresIn ?? DEFAULT_DOWNLOAD_URL_EXPIRES_IN
+  );
+  return {
+    key,
+    downloadUrl,
+    ...result.ETag !== void 0 ? { etag: result.ETag } : {}
+  };
+}
+async function abortMultipartUpload(storage, key, uploadId) {
+  const client = createS3Client(storage);
+  const command = new import_client_s32.AbortMultipartUploadCommand({
+    Bucket: storage.bucket,
+    Key: key,
+    UploadId: uploadId
+  });
+  await client.send(command);
+  return { ok: true };
+}
+async function listMultipartParts(storage, key, uploadId) {
+  const client = createS3Client(storage);
+  const parts = [];
+  let partNumberMarker;
+  for (; ; ) {
+    const command = new import_client_s32.ListPartsCommand({
+      Bucket: storage.bucket,
+      Key: key,
+      UploadId: uploadId,
+      PartNumberMarker: partNumberMarker
+    });
+    const response = await client.send(command);
+    if (response.Parts) {
+      for (const part of response.Parts) {
+        if (part.PartNumber != null && part.ETag) {
+          parts.push({
+            partNumber: part.PartNumber,
+            eTag: part.ETag,
+            ...part.Size !== void 0 ? { size: part.Size } : {}
+          });
+        }
+      }
+    }
+    if (!response.IsTruncated) break;
+    partNumberMarker = String(
+      response.Parts?.[response.Parts.length - 1]?.PartNumber
+    );
+  }
+  return { parts };
+}
+async function getMultipartUploadedSize(storage, key, uploadId) {
+  const client = createS3Client(storage);
+  let total = 0;
+  let partNumberMarker;
+  for (; ; ) {
+    const command = new import_client_s32.ListPartsCommand({
+      Bucket: storage.bucket,
+      Key: key,
+      UploadId: uploadId,
+      PartNumberMarker: partNumberMarker
+    });
+    const response = await client.send(command);
+    if (response.Parts) {
+      for (const part of response.Parts) {
+        total += part.Size ?? 0;
+      }
+    }
+    if (!response.IsTruncated) break;
+    partNumberMarker = String(
+      response.Parts?.[response.Parts.length - 1]?.PartNumber
+    );
+  }
+  return total;
+}
+async function checkStorageReachable(storage) {
+  try {
+    const client = createS3Client(storage);
+    await client.send(new import_client_s32.HeadBucketCommand({ Bucket: storage.bucket }));
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+var import_client_s32, import_s3_request_presigner, import_core5, DEFAULT_EXPIRES_IN, DEFAULT_DOWNLOAD_URL_EXPIRES_IN, MIN_PART_SIZE, MAX_PARTS;
+var init_aws = __esm({
+  "src/providers/aws.ts"() {
+    "use strict";
+    import_client_s32 = require("@aws-sdk/client-s3");
+    import_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+    import_core5 = require("@useupup/core");
+    init_s3_client();
+    DEFAULT_EXPIRES_IN = 3600;
+    DEFAULT_DOWNLOAD_URL_EXPIRES_IN = 3600 * 24 * 3;
+    MIN_PART_SIZE = 5 * 1024 * 1024;
+    MAX_PARTS = 1e4;
+  }
+});
+
+// src/observability.ts
+function toSafeError(e) {
+  return e instanceof Error ? { name: e.name, message: e.message, stack: e.stack } : { name: "NonError", message: String(e) };
+}
+function scrubSensitive(text) {
+  return SCRUBBERS.reduce((acc, [re, repl]) => acc.replace(re, repl), text);
+}
+function reportServerError(logger, event) {
+  const scrubbed = {
+    ...event,
+    message: scrubSensitive(event.message)
+  };
+  if (event.error) {
+    scrubbed.error = {
+      name: event.error.name,
+      message: scrubSensitive(event.error.message),
+      stack: event.error.stack ? scrubSensitive(event.error.stack) : void 0
+    };
+  }
+  ;
+  (logger ?? defaultLogger)(scrubbed);
+}
+var SCRUBBERS, defaultLogger;
+var init_observability = __esm({
+  "src/observability.ts"() {
+    "use strict";
+    SCRUBBERS = [
+      // `Authorization: Bearer xxx` / `authorization=xxx` header dumps.
+      [/(authorization)(\s*[:=]\s*)(?:bearer\s+)?[^\s,;"']+/gi, "$1$2[REDACTED]"],
+      // Standalone bearer tokens not preceded by the header name.
+      [/\bbearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]"],
+      // SigV4 signature / credential / security-token query params or headers.
+      [
+        /(x-amz-(?:signature|credential|security-token))(\s*[:=]\s*)[^\s&,;"']+/gi,
+        "$1$2[REDACTED]"
+      ],
+      // AWS access-key ids.
+      [/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"]
+    ];
+    defaultLogger = (event) => {
+      console.error("[upup:server]", JSON.stringify(event));
+    };
+  }
+});
+
+// src/transfer.ts
+var transfer_exports = {};
+__export(transfer_exports, {
+  transferDriveFileToS3: () => transferDriveFileToS3
+});
+async function transferDriveFileToS3(opts) {
+  const key = `${crypto.randomUUID()}-${opts.fileName}`;
+  if (opts.size > 0 && opts.size <= SINGLE_PUT_MAX_BYTES) {
+    return singlePut({ ...opts, key });
+  }
+  return streamingMultipart({ ...opts, key });
+}
+async function singlePut(opts) {
+  const buffer = await streamToUint8Array(opts.stream);
+  if (opts.maxBytes !== void 0 && buffer.byteLength > opts.maxBytes) {
+    throw new import_core10.UpupStorageError(
+      `Drive file exceeds the configured maxFileSize (${buffer.byteLength} > ${opts.maxBytes} bytes)`,
+      opts.storage.type,
+      "upload"
+    );
+  }
+  const client = createS3Client(opts.storage);
+  await client.send(
+    new import_client_s33.PutObjectCommand({
+      Bucket: opts.storage.bucket,
+      Key: opts.key,
+      ContentType: opts.mimeType,
+      Body: buffer
+    })
+  );
+  const url = await generateSignedPublicUrl(
+    opts.storage,
+    opts.key,
+    opts.downloadUrlExpiresIn ?? DEFAULT_DOWNLOAD_URL_EXPIRES_IN
+  );
+  return {
+    key: opts.key,
+    name: opts.fileName,
+    size: buffer.byteLength,
+    type: opts.mimeType,
+    url
+  };
+}
+async function streamingMultipart(opts) {
+  const client = createS3Client(opts.storage);
+  const init = await client.send(
+    new import_client_s33.CreateMultipartUploadCommand({
+      Bucket: opts.storage.bucket,
+      Key: opts.key,
+      ContentType: opts.mimeType
+    })
+  );
+  const uploadId = init.UploadId;
+  if (!uploadId)
+    throw new import_core10.UpupStorageError(
+      "Missing UploadId on multipart init",
+      opts.storage.type,
+      "multipart-init"
+    );
+  const parts = [];
+  let totalBytes = 0;
+  try {
+    let partNumber = 1;
+    for await (const chunk of chunkedStream(opts.stream, MIN_PART_SIZE)) {
+      const res = await client.send(
+        new import_client_s33.UploadPartCommand({
+          Bucket: opts.storage.bucket,
+          Key: opts.key,
+          UploadId: uploadId,
+          PartNumber: partNumber,
+          ContentLength: chunk.byteLength,
+          Body: chunk
+        })
+      );
+      if (!res.ETag) {
+        throw new import_core10.UpupStorageError(
+          `Missing ETag for part ${partNumber}`,
+          opts.storage.type,
+          "multipart-sign-part"
+        );
+      }
+      parts.push({ PartNumber: partNumber, ETag: res.ETag });
+      totalBytes += chunk.byteLength;
+      if (opts.maxBytes !== void 0 && totalBytes > opts.maxBytes) {
+        throw new import_core10.UpupStorageError(
+          `Drive file exceeds the configured maxFileSize (${totalBytes} > ${opts.maxBytes} bytes)`,
+          opts.storage.type,
+          "upload"
+        );
+      }
+      partNumber++;
+    }
+    if (parts.length === 0) {
+      throw new import_core10.UpupStorageError(
+        "Drive download produced no bytes",
+        opts.storage.type,
+        "upload"
+      );
+    }
+    await client.send(
+      new import_client_s33.CompleteMultipartUploadCommand({
+        Bucket: opts.storage.bucket,
+        Key: opts.key,
+        UploadId: uploadId,
+        MultipartUpload: { Parts: parts }
+      })
+    );
+  } catch (err) {
+    try {
+      await client.send(
+        new import_client_s33.AbortMultipartUploadCommand({
+          Bucket: opts.storage.bucket,
+          Key: opts.key,
+          UploadId: uploadId
+        })
+      );
+    } catch (abortErr) {
+      reportServerError(opts.onError, {
+        route: "files/transfer",
+        method: "POST",
+        status: 500,
+        code: import_core10.UpupErrorCode.STORAGE_ERROR,
+        message: `Failed to abort multipart upload after a transfer error (uploadId=${uploadId}, key=${opts.key})`,
+        requestId: opts.requestId,
+        error: toSafeError(abortErr)
+      });
+    }
+    throw err;
+  }
+  const url = await generateSignedPublicUrl(
+    opts.storage,
+    opts.key,
+    opts.downloadUrlExpiresIn ?? DEFAULT_DOWNLOAD_URL_EXPIRES_IN
+  );
+  return {
+    key: opts.key,
+    name: opts.fileName,
+    size: totalBytes,
+    type: opts.mimeType,
+    url
+  };
+}
+async function streamToUint8Array(stream) {
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    total += value.byteLength;
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+async function* chunkedStream(stream, chunkSize) {
+  const reader = stream.getReader();
+  let buffered = [];
+  let bufferedSize = 0;
+  const flush = () => {
+    const out = new Uint8Array(bufferedSize);
+    let offset = 0;
+    for (const c of buffered) {
+      out.set(c, offset);
+      offset += c.byteLength;
+    }
+    buffered = [];
+    bufferedSize = 0;
+    return out;
+  };
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buffered.push(value);
+    bufferedSize += value.byteLength;
+    while (bufferedSize >= chunkSize) {
+      const out = new Uint8Array(chunkSize);
+      let remaining = chunkSize;
+      let offset = 0;
+      while (remaining > 0 && buffered.length > 0) {
+        const head = buffered[0];
+        if (head === void 0) break;
+        const take = Math.min(head.byteLength, remaining);
+        out.set(head.subarray(0, take), offset);
+        offset += take;
+        remaining -= take;
+        if (take < head.byteLength) {
+          buffered[0] = head.subarray(take);
+        } else {
+          buffered.shift();
+        }
+      }
+      bufferedSize -= chunkSize;
+      yield out;
+    }
+  }
+  if (bufferedSize > 0) yield flush();
+}
+var import_client_s33, import_core10, SINGLE_PUT_MAX_BYTES;
+var init_transfer = __esm({
+  "src/transfer.ts"() {
+    "use strict";
+    import_client_s33 = require("@aws-sdk/client-s3");
+    import_core10 = require("@useupup/core");
+    init_s3_client();
+    init_aws();
+    init_observability();
+    SINGLE_PUT_MAX_BYTES = MIN_PART_SIZE;
+  }
+});
+
+// src/express.ts
+var express_exports = {};
+__export(express_exports, {
+  createUpupMiddleware: () => createUpupMiddleware
+});
+module.exports = __toCommonJS(express_exports);
+
+// src/handler.ts
+var import_core12 = require("@useupup/core");
+
+// src/uploadToken.ts
+var import_core = require("@useupup/core");
+var UploadTokenError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "UploadTokenError";
+    this.code = code;
+  }
+};
+var DEFAULT_UPLOAD_TOKEN_TTL_SECONDS = 3600;
+var MIN_SECRET_LENGTH = 16;
+function assertUploadTokenSecret(secret) {
+  if (!secret || secret.length < MIN_SECRET_LENGTH) {
+    throw new import_core.UpupConfigError(
+      `[@useupup/server] config.uploadTokenSecret is required and must be at least ${MIN_SECRET_LENGTH} characters. Generate a stable, high-entropy secret (e.g. \`openssl rand -hex 32\`) and share the SAME value across every server instance/worker.`
+    );
+  }
+}
+var encoder = new TextEncoder();
+function bytesToBase64Url(bytes) {
+  let bin = "";
+  for (const byte of bytes) bin += String.fromCharCode(byte);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(b64url) {
+  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+  const bin = atob(b64 + pad);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+async function hmacSha256(secret, data) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return new Uint8Array(sig);
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function signUploadToken(secret, payload) {
+  const body = bytesToBase64Url(encoder.encode(JSON.stringify(payload)));
+  const sig = bytesToBase64Url(await hmacSha256(secret, body));
+  return `${body}.${sig}`;
+}
+async function verifyUploadToken(secret, token, nowMs, options = {}) {
+  if (typeof token !== "string" || !token.includes(".")) {
+    throw new UploadTokenError(
+      "malformed",
+      "Upload token is missing or malformed"
+    );
+  }
+  const [body, sig] = token.split(".");
+  if (!body || !sig) {
+    throw new UploadTokenError("malformed", "Upload token is malformed");
+  }
+  const expected = bytesToBase64Url(await hmacSha256(secret, body));
+  if (!timingSafeEqual(sig, expected)) {
+    throw new UploadTokenError(
+      "bad_signature",
+      "Upload token signature is invalid"
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(
+      new TextDecoder().decode(base64UrlToBytes(body))
+    );
+  } catch {
+    throw new UploadTokenError(
+      "malformed",
+      "Upload token payload is not valid JSON"
+    );
+  }
+  if (typeof payload.k !== "string" || typeof payload.u !== "string" || typeof payload.exp !== "number" || typeof payload.smin !== "number" || typeof payload.smax !== "number" || payload.sid !== void 0 && typeof payload.sid !== "string") {
+    throw new UploadTokenError(
+      "malformed",
+      "Upload token payload is missing required fields"
+    );
+  }
+  if (!options.allowExpired && payload.exp <= Math.floor(nowMs / 1e3)) {
+    throw new UploadTokenError("expired", "Upload token has expired");
+  }
+  return payload;
+}
+
+// src/validate-config.ts
+var import_core2 = require("@useupup/core");
+function isNonEmpty(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function validateServerConfig(config) {
+  const missing = [];
+  const invalid = [];
+  if (!config.storage) {
+    missing.push("storage");
+  } else if (typeof config.storage === "function") {
+  } else {
+    if (!isNonEmpty(config.storage.bucket)) missing.push("storage.bucket");
+    if (!isNonEmpty(config.storage.region)) missing.push("storage.region");
+    const hasId = config.storage.accessKeyId !== void 0;
+    const hasSecret = config.storage.secretAccessKey !== void 0;
+    if (hasId || hasSecret) {
+      if (!isNonEmpty(config.storage.accessKeyId))
+        missing.push("storage.accessKeyId");
+      if (!isNonEmpty(config.storage.secretAccessKey))
+        missing.push("storage.secretAccessKey");
+    }
+  }
+  const p = config.providers;
+  if (p?.googleDrive) {
+    if (!isNonEmpty(p.googleDrive.clientId))
+      missing.push("providers.googleDrive.clientId");
+    if (!isNonEmpty(p.googleDrive.clientSecret))
+      missing.push("providers.googleDrive.clientSecret");
+  }
+  if (p?.dropbox) {
+    if (!isNonEmpty(p.dropbox.appKey))
+      missing.push("providers.dropbox.appKey");
+    if (!isNonEmpty(p.dropbox.appSecret))
+      missing.push("providers.dropbox.appSecret");
+  }
+  if (p?.oneDrive) {
+    if (!isNonEmpty(p.oneDrive.clientId))
+      missing.push("providers.oneDrive.clientId");
+    if (!isNonEmpty(p.oneDrive.clientSecret))
+      missing.push("providers.oneDrive.clientSecret");
+  }
+  if (p?.box) {
+    if (!isNonEmpty(p.box.clientId)) missing.push("providers.box.clientId");
+    if (!isNonEmpty(p.box.clientSecret))
+      missing.push("providers.box.clientSecret");
+  }
+  const resumeWindow = config.multipartResumeWindowSeconds;
+  if (resumeWindow !== void 0 && (!Number.isInteger(resumeWindow) || resumeWindow < 0)) {
+    invalid.push(
+      `multipartResumeWindowSeconds must be a non-negative integer (got ${String(resumeWindow)}); use 0 to disable /multipart/resume`
+    );
+  }
+  if (missing.length > 0 || invalid.length > 0) {
+    const sections = [
+      missing.length > 0 ? "missing/empty required field(s):\n" + missing.map((m) => `  - ${m}`).join("\n") : "",
+      invalid.length > 0 ? "invalid field(s):\n" + invalid.map((m) => `  - ${m}`).join("\n") : ""
+    ].filter(Boolean);
+    throw new import_core2.UpupConfigError(
+      `[@useupup/server] Invalid config \u2014 ${sections.join("\n")}`
+    );
+  }
+}
+
+// src/storage.ts
+var import_core3 = require("@useupup/core");
+function assertS3Storage(storage) {
+  const storageType = storage.type;
+  if (typeof storageType === "string" && import_core3.NON_S3_STORAGE_PROVIDERS.has(storageType)) {
+    throw new import_core3.UpupConfigError(
+      `[@useupup/server] storage.type "${storageType}" has no S3-compatible API and cannot be served. upup uploads via the S3 API \u2014 use an S3-compatible provider (aws, minio, r2, wasabi, \u2026) and set storage.endpoint for non-AWS backends.`
+    );
+  }
+}
+
+// src/resolve-storage.ts
+var import_core4 = require("@useupup/core");
+function isStorageResolver(storage) {
+  return typeof storage === "function";
+}
+async function storageIdentity(storage) {
+  const material = [
+    storage.bucket,
+    storage.endpoint ?? "",
+    storage.region
+  ].join("\n");
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(material)
+  );
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 32);
+}
+function assertResolvedStorage(storage) {
+  const s = storage;
+  const missing = [];
+  if (!s || typeof s !== "object") {
+    throw new import_core4.UpupConfigError(
+      "[@useupup/server] the storage resolver did not return a storage config object."
+    );
+  }
+  if (typeof s.bucket !== "string" || s.bucket.trim() === "")
+    missing.push("bucket");
+  if (typeof s.region !== "string" || s.region.trim() === "")
+    missing.push("region");
+  if (missing.length > 0) {
+    throw new import_core4.UpupConfigError(
+      "[@useupup/server] the storage resolver returned a config missing required field(s): " + missing.map((m) => `storage.${m}`).join(", ")
+    );
+  }
+  assertS3Storage(s);
+}
+async function resolveStorage(config, ctx) {
+  if (!isStorageResolver(config.storage)) return config.storage;
+  const resolved = await config.storage(ctx);
+  assertResolvedStorage(resolved);
+  return resolved;
+}
+async function resolveBoundStorage(config, ctx, boundId) {
+  if (!isStorageResolver(config.storage)) return config.storage;
+  if (!boundId) {
+    throw new StorageBindingError(
+      "Upload token carries no storage binding; restart the upload from /multipart/init"
+    );
+  }
+  const resolved = await resolveStorage(config, {
+    ...ctx,
+    storageId: boundId
+  });
+  if (await storageIdentity(resolved) !== boundId) {
+    throw new StorageBindingError(
+      "Upload token is bound to different storage than the resolver returned"
+    );
+  }
+  return resolved;
+}
+var StorageBindingError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "StorageBindingError";
+  }
+};
+
+// src/health.ts
+init_aws();
+init_observability();
+var cachedStorageCheck;
+var cachedAt = 0;
+var STORAGE_CHECK_TTL_MS = 3e4;
+function isConfigComplete(config) {
+  const secretOk = Boolean(
+    config.uploadTokenSecret && config.uploadTokenSecret.length >= 16
+  );
+  if (isStorageResolver(config.storage)) return secretOk;
+  return Boolean(config.storage.bucket && config.storage.region && secretOk);
+}
+async function sha256Hex(input) {
+  const bytes = new TextEncoder().encode(input);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function handleHealth(config, res) {
+  const configOk = isConfigComplete(config);
+  const staticStorage = isStorageResolver(config.storage) ? null : config.storage;
+  const now = Date.now();
+  if (staticStorage && (!cachedStorageCheck || now - cachedAt > STORAGE_CHECK_TTL_MS)) {
+    const result = await checkStorageReachable(staticStorage);
+    if (!result.ok) {
+      reportServerError(config.onError, {
+        route: "health",
+        method: "GET",
+        status: 200,
+        code: "STORAGE_ERROR",
+        message: "Health check: storage unreachable",
+        requestId: res.requestId,
+        error: toSafeError(result.error)
+      });
+    }
+    cachedStorageCheck = result.ok ? { ok: true } : { ok: false };
+    cachedAt = now;
+  }
+  const storageOk = staticStorage ? Boolean(cachedStorageCheck?.ok) : true;
+  const body = {
+    status: configOk && storageOk ? "ok" : "degraded",
+    checks: {
+      config: configOk ? "ok" : "incomplete",
+      storage: !staticStorage ? "skipped" : storageOk ? "ok" : "error"
+    },
+    // Non-secret operational summary — labels/flags/counts only, never any
+    // secret VALUE. Lets an operator eyeball how an instance is configured
+    // (which storage backend, whether anonymous access is open, how many
+    // drive providers are wired, the upload-token lifetime) from the same
+    // unauthenticated probe.
+    summary: {
+      storageType: staticStorage ? staticStorage.type : "dynamic",
+      anonymousUploads: Boolean(config.allowAnonymousUploads),
+      anonymousDrives: Boolean(config.allowAnonymous),
+      driveProviders: config.providers ? Object.keys(config.providers).length : 0,
+      uploadTokenTtlSeconds: DEFAULT_UPLOAD_TOKEN_TTL_SECONDS
+    }
+  };
+  if (config.health?.exposeSecretFingerprint && config.uploadTokenSecret) {
+    body.uploadTokenFingerprint = (await sha256Hex(config.uploadTokenSecret)).slice(0, 8);
+  }
+  return res.json(body);
+}
+
+// src/respond.ts
+init_observability();
+var import_core6 = require("@useupup/core");
+function corsHeaders(req, config) {
+  const cors = config.cors;
+  if (!cors) return {};
+  const origin = req.headers.get("origin") ?? "";
+  const allowsWildcard = cors.allowedOrigins.includes("*");
+  const allowsOrigin = origin && cors.allowedOrigins.includes(origin);
+  if (!allowsWildcard && !allowsOrigin) return {};
+  const allowOrigin = origin ? origin : "*";
+  const headers = {
+    "Access-Control-Allow-Origin": allowOrigin,
+    "Access-Control-Allow-Methods": (cors.allowedMethods ?? ["GET", "POST", "OPTIONS"]).join(", "),
+    "Access-Control-Allow-Headers": (cors.allowedHeaders ?? ["Content-Type", "Authorization"]).join(", "),
+    "Access-Control-Max-Age": String(cors.maxAgeSeconds ?? 600),
+    Vary: "Origin"
+  };
+  if (allowsOrigin && allowOrigin !== "*") {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function createResponder(req, config) {
+  const requestId = crypto.randomUUID();
+  const headers = {
+    ...corsHeaders(req, config),
+    "x-upup-request-id": requestId
+  };
+  const json = (data, status = 200) => new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...headers }
+  });
+  return {
+    requestId,
+    json,
+    html: (body, status = 200) => new Response(body, {
+      status,
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        ...headers
+      }
+    }),
+    redirect: (location, status = 302) => new Response(null, {
+      status,
+      headers: { ...headers, Location: location }
+    }),
+    noContent: (status = 204) => new Response(null, { status, headers }),
+    fail: (route, method, status, code, message, error) => {
+      reportServerError(config.onError, {
+        route,
+        method,
+        status,
+        code,
+        message,
+        requestId,
+        error: toSafeError(error)
+      });
+      return json({ error: message, code }, status);
+    }
+  };
+}
+async function parseJsonBody(req, res) {
+  try {
+    const value = await req.json();
+    return { ok: true, value };
+  } catch {
+    return {
+      ok: false,
+      response: res.json(
+        { error: "Invalid JSON body", code: import_core6.UpupErrorCode.BAD_REQUEST },
+        400
+      )
+    };
+  }
+}
+
+// src/upload-routes.ts
+var import_core7 = require("@useupup/core");
+init_aws();
+
+// src/tokenStore.ts
+var OAUTH_STATE_TTL_SECONDS = 600;
+var tokensKey = (userId, provider) => `upup:tokens:${userId}:${provider}`;
+var oauthStateKey = (state) => `upup:oauth-state:${state}`;
+async function getTokens(store, userId, provider) {
+  const raw = await store.get(tokensKey(userId, provider));
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function setTokens(store, userId, provider, tokens) {
+  let ttlSeconds;
+  if (!tokens.refreshToken && tokens.expiresAt) {
+    ttlSeconds = Math.max(
+      0,
+      Math.ceil((tokens.expiresAt - Date.now()) / 1e3)
+    );
+  }
+  await store.set(
+    tokensKey(userId, provider),
+    JSON.stringify(tokens),
+    ttlSeconds
+  );
+}
+async function deleteTokens(store, userId, provider) {
+  await store.delete(tokensKey(userId, provider));
+}
+async function saveOAuthState(store, state, payload) {
+  await store.set(
+    oauthStateKey(state),
+    JSON.stringify(payload),
+    OAUTH_STATE_TTL_SECONDS
+  );
+}
+async function consumeOAuthState(store, state) {
+  const raw = await store.get(oauthStateKey(state));
+  if (!raw) return null;
+  await store.delete(oauthStateKey(state));
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function generateOAuthState() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+var DEFAULT_USER_ID = "default";
+async function resolveUserId(config, req) {
+  if (config.getUserId) return config.getUserId(req);
+  return DEFAULT_USER_ID;
+}
+
+// src/key.ts
+function sanitizeFilename(name) {
+  const cleaned = name.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^[._]+/, "").slice(0, 128);
+  return cleaned || "file";
+}
+function defaultKeyStrategy(ctx) {
+  const owner = ctx.userId ?? "anon";
+  return `${owner}/${crypto.randomUUID()}/${sanitizeFilename(ctx.fileName)}`;
+}
+
+// src/upload-routes.ts
+init_observability();
+function requireUploadAuthorization(config, res, route, method) {
+  if (!config.auth && !config.getUserId && !config.allowAnonymousUploads) {
+    return res.fail(
+      route,
+      method,
+      403,
+      import_core7.UpupErrorCode.AUTH_REQUIRED,
+      "Anonymous uploads are disabled. Set allowAnonymousUploads:true, or configure auth/getUserId.",
+      new Error("anonymous upload rejected")
+    );
+  }
+  return null;
+}
+var DEFAULT_MULTIPART_RESUME_WINDOW_SECONDS = 86400;
+async function verifyTokenOrRespond(config, token, res, route, method, allowExpired = false) {
+  assertUploadTokenSecret(config.uploadTokenSecret);
+  try {
+    return await verifyUploadToken(
+      config.uploadTokenSecret,
+      token,
+      Date.now(),
+      { allowExpired }
+    );
+  } catch (e) {
+    if (e instanceof UploadTokenError) {
+      reportServerError(config.onError, {
+        route,
+        method,
+        status: 403,
+        code: e.code,
+        message: "Invalid upload token",
+        requestId: res.requestId,
+        error: toSafeError(e)
+      });
+      return res.json(
+        { error: "Invalid upload token", code: e.code },
+        403
+      );
+    }
+    throw e;
+  }
+}
+async function enforceTokenOwner(config, req, payload, res, route, method) {
+  if (!config.getUserId) return null;
+  const currentUserId = await resolveUserId(config, req);
+  const currentOwner = currentUserId === DEFAULT_USER_ID ? null : currentUserId;
+  if (currentOwner !== payload.uid) {
+    return res.fail(
+      route,
+      method,
+      403,
+      import_core7.UpupErrorCode.AUTH_DENIED,
+      "Upload token does not belong to the current user",
+      new Error("upload-token uid mismatch")
+    );
+  }
+  return null;
+}
+function matchesAllowedType(type, allowedTypes) {
+  if (!allowedTypes?.length) return true;
+  return allowedTypes.some((allowed) => {
+    if (allowed === type) return true;
+    if (allowed.endsWith("/*")) {
+      return type.startsWith(`${allowed.slice(0, -2)}/`);
+    }
+    return false;
+  });
+}
+async function validateUploadMetadata(req, config, body, res) {
+  if (typeof body.name !== "string" || body.name.length === 0 || typeof body.type !== "string" || typeof body.size !== "number" || !Number.isFinite(body.size) || body.size < 0) {
+    return res.json(
+      { error: "Invalid file metadata", code: import_core7.UpupErrorCode.BAD_REQUEST },
+      400
+    );
+  }
+  if (config.maxFileSize && body.size > config.maxFileSize) {
+    return res.json({ error: "File too large" }, 413);
+  }
+  if (!matchesAllowedType(body.type, config.allowedTypes)) {
+    return res.json({ error: "File type not allowed" }, 415);
+  }
+  if (config.hooks?.onBeforeUpload) {
+    let allowed;
+    try {
+      allowed = await config.hooks.onBeforeUpload(body, req);
+    } catch (error) {
+      if (error instanceof import_core7.UpupError) {
+        return res.json({ error: error.message, code: error.code }, 403);
+      }
+      throw error;
+    }
+    if (!allowed) {
+      return res.json({ error: "Upload rejected" }, 403);
+    }
+  }
+  return null;
+}
+async function resolveStorageOrFail(config, res, route, method, ctx) {
+  try {
+    return await resolveStorage(config, ctx);
+  } catch (error) {
+    return res.fail(
+      route,
+      method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Storage configuration error",
+      error
+    );
+  }
+}
+async function resolveBoundStorageOrFail(config, res, route, method, ctx, boundId) {
+  try {
+    return await resolveBoundStorage(config, ctx, boundId);
+  } catch (error) {
+    if (error instanceof StorageBindingError) {
+      return res.fail(
+        route,
+        method,
+        403,
+        import_core7.UpupErrorCode.AUTH_DENIED,
+        "Upload token is not valid for the resolved storage",
+        error
+      );
+    }
+    return res.fail(
+      route,
+      method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Storage configuration error",
+      error
+    );
+  }
+}
+async function applyPresignResponseHook(config, response, ctx) {
+  const hook = config.hooks?.onPresignResponse;
+  if (!hook) return response;
+  return await hook(response, ctx) ?? response;
+}
+async function runPostCompletionHooks(config, res, route, method, run) {
+  if (!config.hooks) return;
+  try {
+    await run();
+  } catch (error) {
+    reportServerError(config.onError, {
+      route,
+      method,
+      status: 200,
+      // No dedicated HOOK_ERROR code exists in @useupup/core; the message
+      // carries the real meaning — the upload itself succeeded.
+      code: import_core7.UpupErrorCode.STORAGE_ERROR,
+      message: "Post-completion hook threw after a durably-completed upload; the upload succeeded and the client was returned 200 (F-745).",
+      requestId: res.requestId,
+      error: toSafeError(error)
+    });
+  }
+}
+async function handlePresign(req, config, res) {
+  const gate = requireUploadAuthorization(config, res, "presign", req.method);
+  if (gate) return gate;
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  const validationError = await validateUploadMetadata(req, config, body, res);
+  if (validationError) return validationError;
+  const userId = await resolveUserId(config, req);
+  if (userId === null) return res.json({ error: "Unauthenticated" }, 401);
+  const owner = userId === DEFAULT_USER_ID ? null : userId;
+  const key = (config.keyStrategy ?? defaultKeyStrategy)({
+    userId: owner,
+    fileName: body.name,
+    contentType: body.type,
+    size: body.size,
+    ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+    req
+  });
+  const storage = await resolveStorageOrFail(
+    config,
+    res,
+    "presign",
+    req.method,
+    {
+      req,
+      phase: "presign",
+      userId: owner,
+      ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+      fileName: body.name,
+      contentType: body.type,
+      size: body.size
+    }
+  );
+  if (storage instanceof Response) return storage;
+  try {
+    const result = await generatePresignedUrl(
+      storage,
+      key,
+      body.type,
+      body.size,
+      void 0,
+      config.downloadUrlExpiresIn
+    );
+    const payload = await applyPresignResponseHook(config, result, {
+      req,
+      phase: "presign",
+      // Always the key that is IN the payload, on every phase.
+      key: result.key,
+      file: body,
+      ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+      userId: owner
+    });
+    return res.json(payload, 200);
+  } catch (error) {
+    return res.fail(
+      "presign",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.PRESIGN_FAILED,
+      "Presign failed",
+      error
+    );
+  }
+}
+async function handleMultipartInit(req, config, res) {
+  const gate = requireUploadAuthorization(
+    config,
+    res,
+    "multipart/init",
+    req.method
+  );
+  if (gate) return gate;
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  try {
+    const validationError = await validateUploadMetadata(
+      req,
+      config,
+      body,
+      res
+    );
+    if (validationError) return validationError;
+    const userId = await resolveUserId(config, req);
+    if (userId === null) return res.json({ error: "Unauthenticated" }, 401);
+    const owner = userId === DEFAULT_USER_ID ? null : userId;
+    const key = (config.keyStrategy ?? defaultKeyStrategy)({
+      userId: owner,
+      fileName: body.name,
+      contentType: body.type,
+      size: body.size,
+      ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+      req
+    });
+    const storage = await resolveStorageOrFail(
+      config,
+      res,
+      "multipart/init",
+      req.method,
+      {
+        req,
+        phase: "multipart-init",
+        userId: owner,
+        ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+        fileName: body.name,
+        contentType: body.type,
+        size: body.size
+      }
+    );
+    if (storage instanceof Response) return storage;
+    const result = await initiateMultipartUpload(
+      storage,
+      key,
+      body.type,
+      body.size,
+      void 0,
+      body.chunkSizeBytes
+    );
+    assertUploadTokenSecret(config.uploadTokenSecret);
+    const sid = isStorageResolver(config.storage) ? await storageIdentity(storage) : void 0;
+    const issuedAt = Math.floor(Date.now() / 1e3);
+    const token = await signUploadToken(config.uploadTokenSecret, {
+      k: result.key,
+      u: result.uploadId,
+      uid: owner,
+      smin: 0,
+      smax: body.size,
+      ...sid !== void 0 ? { sid } : {},
+      exp: issuedAt + DEFAULT_UPLOAD_TOKEN_TTL_SECONDS,
+      iat: issuedAt
+    });
+    const payload = await applyPresignResponseHook(
+      config,
+      { ...result, token },
+      {
+        req,
+        phase: "multipart-init",
+        key: result.key,
+        file: body,
+        ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+        userId: owner
+      }
+    );
+    return res.json(payload, 200);
+  } catch (error) {
+    return res.fail(
+      "multipart/init",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Multipart init failed",
+      error
+    );
+  }
+}
+function isNoSuchUpload(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const shape = error;
+  return shape.name === "NoSuchUpload" || shape.Code === "NoSuchUpload";
+}
+async function handleMultipartResume(req, config, res) {
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  try {
+    const payload = await verifyTokenOrRespond(
+      config,
+      body.token,
+      res,
+      "multipart/resume",
+      req.method,
+      true
+      // allowExpired — the resume window below is the real bound
+    );
+    if (payload instanceof Response) return payload;
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const issuedAt = payload.iat ?? payload.exp - DEFAULT_UPLOAD_TOKEN_TTL_SECONDS;
+    const windowSeconds = config.multipartResumeWindowSeconds ?? DEFAULT_MULTIPART_RESUME_WINDOW_SECONDS;
+    if (nowSeconds > issuedAt + windowSeconds) {
+      return res.fail(
+        "multipart/resume",
+        req.method,
+        403,
+        "expired",
+        "Upload resume window has expired",
+        new Error("resume window elapsed")
+      );
+    }
+    const owned = await enforceTokenOwner(
+      config,
+      req,
+      payload,
+      res,
+      "multipart/resume",
+      req.method
+    );
+    if (owned) return owned;
+    const storage = await resolveBoundStorageOrFail(
+      config,
+      res,
+      "multipart/resume",
+      req.method,
+      { req, phase: "multipart-resume", userId: payload.uid },
+      payload.sid
+    );
+    if (storage instanceof Response) return storage;
+    let listed;
+    try {
+      listed = await listMultipartParts(storage, payload.k, payload.u);
+    } catch (error) {
+      if (isNoSuchUpload(error)) {
+        return res.fail(
+          "multipart/resume",
+          req.method,
+          404,
+          import_core7.UpupErrorCode.NOT_FOUND,
+          "Multipart upload no longer exists",
+          error
+        );
+      }
+      throw error;
+    }
+    assertUploadTokenSecret(config.uploadTokenSecret);
+    const token = await signUploadToken(config.uploadTokenSecret, {
+      // Every binding is copied from the VERIFIED payload, unchanged: same
+      // key, same uploadId, same owner, same size envelope, same storage
+      // identity. Only `exp` moves — `iat` is the original, so the window
+      // does not roll.
+      k: payload.k,
+      u: payload.u,
+      uid: payload.uid,
+      smin: payload.smin,
+      smax: payload.smax,
+      ...payload.sid !== void 0 ? { sid: payload.sid } : {},
+      // Clamp to the resume window, not a fresh full TTL. The window is
+      // the operator's stated cap on how long a leaked token stays
+      // usable (multipartResumeWindowSeconds); a re-issued token that
+      // outlived it by up to a full TTL would make that cap — and the
+      // documented leak mitigation — a lie.
+      exp: Math.min(
+        nowSeconds + DEFAULT_UPLOAD_TOKEN_TTL_SECONDS,
+        issuedAt + windowSeconds
+      ),
+      iat: issuedAt
+    });
+    const response = {
+      key: payload.k,
+      token,
+      parts: listed.parts
+    };
+    return res.json(response, 200);
+  } catch (error) {
+    return res.fail(
+      "multipart/resume",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Multipart resume failed",
+      error
+    );
+  }
+}
+async function handleMultipartSignPart(req, config, res) {
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  try {
+    const payload = await verifyTokenOrRespond(
+      config,
+      body.token,
+      res,
+      "multipart/sign-part",
+      req.method
+    );
+    if (payload instanceof Response) return payload;
+    const owned = await enforceTokenOwner(
+      config,
+      req,
+      payload,
+      res,
+      "multipart/sign-part",
+      req.method
+    );
+    if (owned) return owned;
+    const storage = await resolveBoundStorageOrFail(
+      config,
+      res,
+      "multipart/sign-part",
+      req.method,
+      {
+        req,
+        phase: "multipart-sign-part",
+        userId: payload.uid
+      },
+      payload.sid
+    );
+    if (storage instanceof Response) return storage;
+    const result = await generatePresignedPartUrl(
+      storage,
+      payload.k,
+      payload.u,
+      body.partNumber
+    );
+    const rewritten = await applyPresignResponseHook(config, result, {
+      req,
+      phase: "multipart-sign-part",
+      // From the VERIFIED token — sign-part never sees a client-asserted
+      // key, and has no file metadata to report.
+      key: payload.k,
+      userId: payload.uid
+    });
+    return res.json(rewritten, 200);
+  } catch (error) {
+    return res.fail(
+      "multipart/sign-part",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Multipart sign failed",
+      error
+    );
+  }
+}
+async function handleMultipartComplete(req, config, res) {
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  try {
+    const payload = await verifyTokenOrRespond(
+      config,
+      body.token,
+      res,
+      "multipart/complete",
+      req.method
+    );
+    if (payload instanceof Response) return payload;
+    const owned = await enforceTokenOwner(
+      config,
+      req,
+      payload,
+      res,
+      "multipart/complete",
+      req.method
+    );
+    if (owned) return owned;
+    const storage = await resolveBoundStorageOrFail(
+      config,
+      res,
+      "multipart/complete",
+      req.method,
+      { req, phase: "multipart-complete", userId: payload.uid },
+      payload.sid
+    );
+    if (storage instanceof Response) return storage;
+    const uploadedSize = await getMultipartUploadedSize(
+      storage,
+      payload.k,
+      payload.u
+    );
+    if (uploadedSize < payload.smin || uploadedSize > payload.smax) {
+      await abortMultipartUpload(storage, payload.k, payload.u);
+      return res.json(
+        { error: "Upload size outside signed envelope" },
+        403
+      );
+    }
+    const result = await completeMultipartUpload(
+      storage,
+      payload.k,
+      payload.u,
+      body.parts,
+      config.downloadUrlExpiresIn
+    );
+    const uploaded = {
+      key: result.key,
+      name: result.key.split("/").pop() ?? result.key,
+      size: uploadedSize,
+      // already computed above for the envelope check
+      type: "",
+      // not retained server-side on the multipart path
+      url: result.downloadUrl ?? ""
+    };
+    await runPostCompletionHooks(
+      config,
+      res,
+      "multipart/complete",
+      req.method,
+      async () => {
+        if (config.hooks?.onFileUploaded)
+          await config.hooks.onFileUploaded(uploaded, req);
+        if (config.hooks?.onUploadComplete)
+          await config.hooks.onUploadComplete([uploaded], req);
+      }
+    );
+    return res.json(result, 200);
+  } catch (error) {
+    return res.fail(
+      "multipart/complete",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Multipart complete failed",
+      error
+    );
+  }
+}
+async function handleMultipartAbort(req, config, res) {
+  const parsed = await parseJsonBody(req, res);
+  if (!parsed.ok) return parsed.response;
+  const body = parsed.value;
+  try {
+    const payload = await verifyTokenOrRespond(
+      config,
+      body.token,
+      res,
+      "multipart/abort",
+      req.method
+    );
+    if (payload instanceof Response) return payload;
+    const owned = await enforceTokenOwner(
+      config,
+      req,
+      payload,
+      res,
+      "multipart/abort",
+      req.method
+    );
+    if (owned) return owned;
+    const storage = await resolveBoundStorageOrFail(
+      config,
+      res,
+      "multipart/abort",
+      req.method,
+      { req, phase: "multipart-abort", userId: payload.uid },
+      payload.sid
+    );
+    if (storage instanceof Response) return storage;
+    const result = await abortMultipartUpload(storage, payload.k, payload.u);
+    return res.json(result, 200);
+  } catch (error) {
+    return res.fail(
+      "multipart/abort",
+      req.method,
+      500,
+      import_core7.UpupErrorCode.STORAGE_ERROR,
+      "Multipart abort failed",
+      error
+    );
+  }
+}
+
+// src/oauth.ts
+var import_core8 = require("@useupup/core");
+init_observability();
+var VALID_PROVIDERS = [
+  "google-drive",
+  "one-drive",
+  "dropbox",
+  "box"
+];
+function isValidProvider(p) {
+  return VALID_PROVIDERS.includes(p);
+}
+function getProviderMeta(config, provider) {
+  const providers = config.providers;
+  if (!providers)
+    return { error: "No OAuth providers configured", status: 500 };
+  switch (provider) {
+    case "google-drive": {
+      const gc = providers.googleDrive;
+      if (!gc)
+        return { error: "Google Drive not configured", status: 400 };
+      return {
+        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        scope: "https://www.googleapis.com/auth/drive.readonly",
+        clientId: gc.clientId,
+        clientSecret: gc.clientSecret,
+        extra: { access_type: "offline", prompt: "consent" }
+      };
+    }
+    case "one-drive": {
+      const oc = providers.oneDrive;
+      if (!oc) return { error: "OneDrive not configured", status: 400 };
+      const tenant = oc.tenantId ?? "common";
+      return {
+        authUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+        tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+        scope: "Files.Read.All offline_access",
+        clientId: oc.clientId,
+        clientSecret: oc.clientSecret
+      };
+    }
+    case "dropbox": {
+      const dc = providers.dropbox;
+      if (!dc) return { error: "Dropbox not configured", status: 400 };
+      return {
+        authUrl: "https://www.dropbox.com/oauth2/authorize",
+        tokenUrl: "https://api.dropboxapi.com/oauth2/token",
+        scope: "files.content.read files.metadata.read",
+        clientId: dc.appKey,
+        clientSecret: dc.appSecret,
+        extra: { token_access_type: "online" }
+      };
+    }
+    case "box": {
+      const bc = providers.box;
+      if (!bc) return { error: "Box not configured", status: 400 };
+      return {
+        authUrl: "https://account.box.com/api/oauth2/authorize",
+        tokenUrl: "https://api.box.com/oauth2/token",
+        scope: "root_readonly",
+        clientId: bc.clientId,
+        clientSecret: bc.clientSecret
+      };
+    }
+  }
+}
+function callbackUrlFor(req, provider) {
+  const url = new URL(req.url);
+  const base = `${url.origin}${url.pathname.replace(/\/auth\/[\w-]+(?:\/cb)?\/?$/, "")}`;
+  return `${base}/auth/${provider}/cb`;
+}
+async function handleOAuthRedirect(req, config, provider, res) {
+  if (!isValidProvider(provider)) {
+    return res.json({ error: `Unknown provider: ${provider}` }, 400);
+  }
+  if (!config.tokenStore) {
+    return res.json(
+      { error: "tokenStore is required for OAuth flows" },
+      500
+    );
+  }
+  const userId = await resolveUserId(config, req);
+  if (!userId) return res.json({ error: "Unauthenticated" }, 401);
+  const meta = getProviderMeta(config, provider);
+  if ("error" in meta) return res.json({ error: meta.error }, meta.status);
+  const state = generateOAuthState();
+  const returnTo = new URL(req.url).searchParams.get("returnTo") ?? void 0;
+  await saveOAuthState(config.tokenStore, state, {
+    userId,
+    provider,
+    returnTo
+  });
+  const params = new URLSearchParams({
+    client_id: meta.clientId,
+    redirect_uri: callbackUrlFor(req, provider),
+    response_type: "code",
+    scope: meta.scope,
+    state,
+    ...meta.extra ?? {}
+  });
+  return res.redirect(`${meta.authUrl}?${params.toString()}`);
+}
+async function handleOAuthCallback(req, config, provider, res) {
+  if (!isValidProvider(provider)) {
+    return res.json({ error: `Unknown provider: ${provider}` }, 400);
+  }
+  if (!config.tokenStore) {
+    return res.json({ error: "tokenStore is required" }, 500);
+  }
+  const url = new URL(req.url);
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  const error = url.searchParams.get("error");
+  if (error) return res.json({ error: `OAuth error: ${error}` }, 400);
+  if (!code || !state)
+    return res.json({ error: "Missing code or state" }, 400);
+  const stateData = await consumeOAuthState(config.tokenStore, state);
+  if (!stateData || stateData.provider !== provider) {
+    return res.json({ error: "Invalid or expired state" }, 400);
+  }
+  const meta = getProviderMeta(config, provider);
+  if ("error" in meta) return res.json({ error: meta.error }, meta.status);
+  const tokenRes = await fetch(meta.tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      code,
+      client_id: meta.clientId,
+      client_secret: meta.clientSecret,
+      redirect_uri: callbackUrlFor(req, provider),
+      grant_type: "authorization_code"
+    })
+  });
+  if (!tokenRes.ok) {
+    const body = await tokenRes.text();
+    reportServerError(config.onError, {
+      route: `auth/${provider}/cb`,
+      method: req.method,
+      status: 502,
+      code: import_core8.UpupErrorCode.AUTH_PROVIDER_ERROR,
+      message: "Token exchange failed",
+      error: toSafeError(new Error(body.slice(0, 500)))
+    });
+    return res.json(
+      {
+        error: "Token exchange failed",
+        code: import_core8.UpupErrorCode.AUTH_PROVIDER_ERROR
+      },
+      502
+    );
+  }
+  const payload = await tokenRes.json();
+  const tokens = {
+    accessToken: payload.access_token,
+    expiresAt: payload.expires_in ? Date.now() + payload.expires_in * 1e3 : void 0,
+    scope: payload.scope,
+    tokenType: payload.token_type,
+    refreshToken: payload.refresh_token
+  };
+  await setTokens(config.tokenStore, stateData.userId, provider, tokens);
+  const validatedReturn = validateReturnTo(
+    stateData.returnTo,
+    req,
+    config.cors
+  );
+  const targetOrigins = concreteAllowedOrigins(config.cors);
+  return res.html(
+    buildOAuthSuccessPage(provider, {
+      targetOrigins,
+      ...validatedReturn !== void 0 ? { returnTo: validatedReturn } : {}
+    })
+  );
+}
+function validateReturnTo(returnTo, req, cors) {
+  if (!returnTo) return void 0;
+  const serverOrigin = new URL(req.url).origin;
+  let resolved;
+  try {
+    resolved = new URL(returnTo, serverOrigin);
+  } catch {
+    return void 0;
+  }
+  if (resolved.origin === serverOrigin) return resolved.toString();
+  const concrete = (cors?.allowedOrigins ?? []).filter((o) => o !== "*");
+  if (concrete.includes(resolved.origin)) return resolved.toString();
+  return void 0;
+}
+function concreteAllowedOrigins(cors) {
+  return (cors?.allowedOrigins ?? []).filter((o) => o !== "*");
+}
+function buildOAuthSuccessPage(provider, opts) {
+  const safeProvider = provider.replace(/[^a-z0-9-]/gi, "");
+  const { returnTo, targetOrigins } = opts;
+  let postMessageScript;
+  if (targetOrigins.length > 0) {
+    postMessageScript = targetOrigins.map(
+      (origin) => `window.opener.postMessage({ type: 'upup:oauth-success', provider: ${JSON.stringify(safeProvider)} }, ${JSON.stringify(origin)});`
+    ).join("\n      ");
+  } else {
+    postMessageScript = `window.opener.postMessage({ type: 'upup:oauth-success', provider: ${JSON.stringify(safeProvider)} }, '*' /* token-free payload */);`;
+  }
+  const elseBody = returnTo ? `window.location.replace(${JSON.stringify(returnTo)});` : `document.body.textContent = 'Connected to ' + ${JSON.stringify(safeProvider)} + '. You may close this window.';`;
+  return `<!doctype html>
+<html><head><title>Connected</title></head><body>
+<script>
+  try {
+    if (window.opener) {
+      ${postMessageScript}
+      window.close();
+    } else if (${JSON.stringify(returnTo ?? "")}) {
+      ${elseBody}
+    } else {
+      document.body.textContent = 'Connected to ' + ${JSON.stringify(safeProvider)} + '. You may close this window.';
+    }
+  } catch (e) {
+    document.body.textContent = 'Connected. You may close this window.';
+  }
+</script>
+</body></html>`;
+}
+async function refreshAccessToken(config, provider, userId, tokens) {
+  if (!tokens.refreshToken || !config.tokenStore) return null;
+  const meta = getProviderMeta(config, provider);
+  if ("error" in meta) return null;
+  const res = await fetch(meta.tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: tokens.refreshToken,
+      client_id: meta.clientId,
+      client_secret: meta.clientSecret
+    })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    reportServerError(config.onError, {
+      route: `auth/${provider}/refresh`,
+      method: "POST",
+      status: res.status,
+      code: import_core8.UpupErrorCode.AUTH_EXPIRED,
+      message: "Drive token refresh failed",
+      error: toSafeError(new Error(body.slice(0, 500) || res.statusText))
+    });
+    await deleteTokens(config.tokenStore, userId, provider);
+    return null;
+  }
+  const payload = await res.json();
+  const next = {
+    accessToken: payload.access_token,
+    expiresAt: payload.expires_in ? Date.now() + payload.expires_in * 1e3 : void 0,
+    scope: payload.scope ?? tokens.scope,
+    tokenType: payload.token_type ?? tokens.tokenType,
+    // Some providers omit refresh_token on refresh -> keep the existing one.
+    refreshToken: payload.refresh_token ?? tokens.refreshToken
+  };
+  await setTokens(config.tokenStore, userId, provider, next);
+  return next;
+}
+
+// src/drive-routes.ts
+var import_core11 = require("@useupup/core");
+
+// src/drive-clients.ts
+var import_core9 = require("@useupup/core");
+var DRIVE_CLIENTS = {
+  "google-drive": {
+    listFiles: listGoogleDriveFiles,
+    fetchFile: fetchGoogleDriveFile
+  },
+  "one-drive": { listFiles: listOneDriveFiles, fetchFile: fetchOneDriveFile },
+  dropbox: { listFiles: listDropboxFiles, fetchFile: fetchDropboxFile },
+  box: { listFiles: listBoxFiles, fetchFile: fetchBoxFile }
+};
+function getDriveClient(provider) {
+  return DRIVE_CLIENTS[provider];
+}
+async function driveFetch(url, init = {}) {
+  const res = await fetch(url, init);
+  if (res.status === 401) {
+    throw new import_core9.UpupNetworkError("Drive API 401", 401);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new import_core9.UpupNetworkError(
+      `Drive API ${res.status}: ${text.slice(0, 200) || res.statusText}`,
+      res.status
+    );
+  }
+  return res;
+}
+function escapeDriveQueryValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function escapeODataSearchValue(value) {
+  return value.replace(/'/g, "''");
+}
+function httpHeaderSafeJson(value) {
+  return JSON.stringify(value).replace(
+    /[\u007f-\uffff]/g,
+    (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0")
+  );
+}
+async function listGoogleDriveFiles(accessToken, opts) {
+  const parent = opts.folderId ?? "root";
+  const q = opts.search ? `name contains '${escapeDriveQueryValue(opts.search)}' and trashed = false` : `'${parent}' in parents and trashed = false`;
+  const params = new URLSearchParams({
+    q,
+    fields: "files(id,name,size,mimeType,thumbnailLink,modifiedTime,iconLink)",
+    pageSize: "200"
+  });
+  const res = await driveFetch(
+    `https://www.googleapis.com/drive/v3/files?${params.toString()}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  const data = await res.json();
+  return data.files.map((f) => ({
+    id: f.id,
+    name: f.name,
+    size: f.size ? Number(f.size) : void 0,
+    mimeType: f.mimeType,
+    thumbnailUrl: f.thumbnailLink,
+    isFolder: f.mimeType === "application/vnd.google-apps.folder",
+    modifiedAt: f.modifiedTime
+  }));
+}
+async function fetchGoogleDriveFile(accessToken, body) {
+  const metaRes = await driveFetch(
+    `https://www.googleapis.com/drive/v3/files/${encodeURIComponent(
+      body.fileId
+    )}?fields=name,size,mimeType`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  const meta = await metaRes.json();
+  const dlRes = await driveFetch(
+    `https://www.googleapis.com/drive/v3/files/${encodeURIComponent(
+      body.fileId
+    )}?alt=media`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  if (!dlRes.body) throw new import_core9.UpupNetworkError("Empty download body");
+  return {
+    stream: dlRes.body,
+    size: Number(meta.size ?? body.size ?? 0),
+    fileName: body.fileName ?? meta.name,
+    mimeType: body.mimeType ?? meta.mimeType ?? "application/octet-stream"
+  };
+}
+async function listOneDriveFiles(accessToken, opts) {
+  const path = opts.search ? `/me/drive/root/search(q='${encodeURIComponent(escapeODataSearchValue(opts.search))}')` : opts.folderId ? `/me/drive/items/${encodeURIComponent(opts.folderId)}/children` : "/me/drive/root/children";
+  const res = await driveFetch(`https://graph.microsoft.com/v1.0${path}`, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+  const data = await res.json();
+  return data.value.map((f) => ({
+    id: f.id,
+    name: f.name,
+    size: f.size,
+    mimeType: f.file?.mimeType,
+    isFolder: !!f.folder,
+    modifiedAt: f.lastModifiedDateTime
+  }));
+}
+async function fetchOneDriveFile(accessToken, body) {
+  const metaRes = await driveFetch(
+    `https://graph.microsoft.com/v1.0/me/drive/items/${encodeURIComponent(
+      body.fileId
+    )}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  const meta = await metaRes.json();
+  const dlRes = await driveFetch(
+    `https://graph.microsoft.com/v1.0/me/drive/items/${encodeURIComponent(
+      body.fileId
+    )}/content`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  if (!dlRes.body) throw new import_core9.UpupNetworkError("Empty download body");
+  return {
+    stream: dlRes.body,
+    size: meta.size ?? body.size ?? 0,
+    fileName: body.fileName ?? meta.name,
+    mimeType: body.mimeType ?? meta.file?.mimeType ?? "application/octet-stream"
+  };
+}
+async function listDropboxFiles(accessToken, opts) {
+  const endpoint = opts.search ? "https://api.dropboxapi.com/2/files/search_v2" : "https://api.dropboxapi.com/2/files/list_folder";
+  const body = opts.search ? { query: opts.search } : { path: opts.folderId ?? "", recursive: false };
+  const res = await driveFetch(endpoint, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const data = await res.json();
+  const entries = "entries" in data ? data.entries : data.matches.map((m) => m.metadata.metadata);
+  return entries.filter((e) => e[".tag"] !== "deleted").map((e) => ({
+    id: e.path_lower ?? e.id,
+    name: e.name,
+    size: "size" in e ? e.size : void 0,
+    isFolder: e[".tag"] === "folder",
+    modifiedAt: "server_modified" in e ? e.server_modified : void 0
+  }));
+}
+async function fetchDropboxFile(accessToken, body) {
+  const dlRes = await driveFetch(
+    "https://content.dropboxapi.com/2/files/download",
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Dropbox-API-Arg": httpHeaderSafeJson({ path: body.fileId })
+      }
+    }
+  );
+  if (!dlRes.body) throw new import_core9.UpupNetworkError("Empty download body");
+  const apiResult = dlRes.headers.get("Dropbox-API-Result");
+  let name = body.fileName ?? "download";
+  let size = body.size ?? 0;
+  if (apiResult) {
+    try {
+      const parsed = JSON.parse(apiResult);
+      name = body.fileName ?? parsed.name ?? name;
+      size = parsed.size ?? size;
+    } catch {
+    }
+  }
+  return {
+    stream: dlRes.body,
+    size,
+    fileName: name,
+    mimeType: body.mimeType ?? dlRes.headers.get("Content-Type") ?? "application/octet-stream"
+  };
+}
+async function listBoxFiles(accessToken, opts) {
+  if (opts.search) {
+    const params = new URLSearchParams({
+      query: opts.search,
+      limit: "200"
+    });
+    const res2 = await driveFetch(
+      `https://api.box.com/2.0/search?${params.toString()}`,
+      { headers: { Authorization: `Bearer ${accessToken}` } }
+    );
+    const data2 = await res2.json();
+    return data2.entries.map((e) => ({
+      id: e.id,
+      name: e.name,
+      size: e.size,
+      isFolder: e.type === "folder",
+      modifiedAt: e.modified_at
+    }));
+  }
+  const folderId = opts.folderId ?? "0";
+  const res = await driveFetch(
+    `https://api.box.com/2.0/folders/${encodeURIComponent(folderId)}/items?limit=200&fields=id,name,size,type,modified_at`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  const data = await res.json();
+  return data.entries.map((e) => ({
+    id: e.id,
+    name: e.name,
+    size: e.size,
+    isFolder: e.type === "folder",
+    modifiedAt: e.modified_at
+  }));
+}
+async function fetchBoxFile(accessToken, body) {
+  const metaRes = await driveFetch(
+    `https://api.box.com/2.0/files/${encodeURIComponent(body.fileId)}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  const meta = await metaRes.json();
+  const dlRes = await driveFetch(
+    `https://api.box.com/2.0/files/${encodeURIComponent(body.fileId)}/content`,
+    {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      redirect: "follow"
+    }
+  );
+  if (!dlRes.body) throw new import_core9.UpupNetworkError("Empty download body");
+  return {
+    stream: dlRes.body,
+    size: meta.size ?? body.size ?? 0,
+    fileName: body.fileName ?? meta.name,
+    mimeType: body.mimeType ?? dlRes.headers.get("Content-Type") ?? "application/octet-stream"
+  };
+}
+
+// src/drive-routes.ts
+async function handleListFiles(req, config, provider, res) {
+  if (!isValidProvider(provider)) {
+    return res.json({ error: `Unknown provider: ${provider}` }, 400);
+  }
+  if (!config.tokenStore)
+    return res.json({ error: "tokenStore is required" }, 500);
+  const userId = await resolveUserId(config, req);
+  if (!userId) return res.json({ error: "Unauthenticated" }, 401);
+  let tokens = await getTokens(config.tokenStore, userId, provider);
+  if (!tokens) {
+    return res.json({ reauth: true, provider }, 401);
+  }
+  if (tokens.refreshToken && tokens.expiresAt && Date.now() > tokens.expiresAt - 3e4) {
+    const refreshed = await refreshAccessToken(
+      config,
+      provider,
+      userId,
+      tokens
+    );
+    if (!refreshed) {
+      return res.json({ reauth: true, provider }, 401);
+    }
+    tokens = refreshed;
+  }
+  const url = new URL(req.url);
+  const folderId = url.searchParams.get("folderId") ?? void 0;
+  const search = url.searchParams.get("search") ?? void 0;
+  try {
+    const files = await getDriveClient(provider).listFiles(
+      tokens.accessToken,
+      { folderId, search }
+    );
+    return res.json({ provider, files }, 200);
+  } catch (err) {
+    if (err instanceof import_core11.UpupNetworkError && err.status === 401) {
+      await deleteTokens(config.tokenStore, userId, provider);
+      return res.json({ reauth: true, provider }, 401);
+    }
+    return res.fail(
+      `files/${provider}`,
+      req.method,
+      500,
+      import_core11.UpupErrorCode.STORAGE_ERROR,
+      "Drive request failed",
+      err
+    );
+  }
+}
+async function handleFileTransfer(req, config, provider, res) {
+  if (!isValidProvider(provider)) {
+    return res.json({ error: `Unknown provider: ${provider}` }, 400);
+  }
+  if (!config.tokenStore)
+    return res.json({ error: "tokenStore is required" }, 500);
+  const userId = await resolveUserId(config, req);
+  if (!userId) return res.json({ error: "Unauthenticated" }, 401);
+  let tokens = await getTokens(config.tokenStore, userId, provider);
+  if (!tokens) return res.json({ reauth: true, provider }, 401);
+  if (tokens.refreshToken && tokens.expiresAt && Date.now() > tokens.expiresAt - 3e4) {
+    const refreshed = await refreshAccessToken(
+      config,
+      provider,
+      userId,
+      tokens
+    );
+    if (!refreshed) {
+      return res.json({ reauth: true, provider }, 401);
+    }
+    tokens = refreshed;
+  }
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return res.json({ error: "Invalid JSON body" }, 400);
+  }
+  if (!body.fileId) return res.json({ error: "Missing fileId" }, 400);
+  if (config.maxFileSize && typeof body.size === "number" && body.size > config.maxFileSize) {
+    return res.json({ error: "File too large" }, 413);
+  }
+  if (!matchesAllowedType(body.mimeType ?? "", config.allowedTypes)) {
+    return res.json({ error: "File type not allowed" }, 415);
+  }
+  try {
+    const { stream, size, fileName, mimeType } = await getDriveClient(
+      provider
+    ).fetchFile(tokens.accessToken, body);
+    const storage = await resolveStorage(config, {
+      req,
+      phase: "drive-transfer",
+      userId,
+      ...body.metadata !== void 0 ? { metadata: body.metadata } : {},
+      fileName,
+      contentType: mimeType,
+      size
+    });
+    const { transferDriveFileToS3: transferDriveFileToS32 } = await Promise.resolve().then(() => (init_transfer(), transfer_exports));
+    const result = await transferDriveFileToS32({
+      stream,
+      size,
+      fileName,
+      mimeType,
+      storage,
+      // Enforce maxFileSize against the ACTUAL streamed bytes, and route
+      // an abort-cleanup failure through onError instead of swallowing it
+      // (F-743 / F-744).
+      maxBytes: config.maxFileSize,
+      onError: config.onError,
+      requestId: res.requestId,
+      downloadUrlExpiresIn: config.downloadUrlExpiresIn
+    });
+    await runPostCompletionHooks(
+      config,
+      res,
+      `files/${provider}/transfer`,
+      req.method,
+      async () => {
+        if (config.hooks?.onFileUploaded)
+          await config.hooks.onFileUploaded(result, req);
+      }
+    );
+    return res.json({ provider, ...result }, 200);
+  } catch (err) {
+    if (err instanceof import_core11.UpupNetworkError && err.status === 401) {
+      await deleteTokens(config.tokenStore, userId, provider);
+      return res.json({ reauth: true, provider }, 401);
+    }
+    return res.fail(
+      `files/${provider}/transfer`,
+      req.method,
+      500,
+      import_core11.UpupErrorCode.STORAGE_ERROR,
+      "Drive request failed",
+      err
+    );
+  }
+}
+
+// src/handler.ts
+function createUpupHandler(config) {
+  assertUploadTokenSecret(config.uploadTokenSecret);
+  validateServerConfig(config);
+  if (!isStorageResolver(config.storage)) assertS3Storage(config.storage);
+  if ((config.providers || config.tokenStore) && !config.getUserId && !config.allowAnonymous) {
+    throw new import_core12.UpupConfigError(
+      "[@useupup/server] drive providers / tokenStore require config.getUserId to scope tokens per user. Set getUserId, or set allowAnonymous:true to intentionally share ONE anonymous namespace (demos only)."
+    );
+  }
+  if (config.allowAnonymousUploads) {
+    console.warn(
+      "[@useupup/server] allowAnonymousUploads:true \u2014 /presign and /multipart/init accept UNAUTHENTICATED uploads under a shared anonymous namespace. Demos / upstream-auth deployments only; never enable in multi-tenant production."
+    );
+  }
+  return async (req) => {
+    const url = new URL(req.url);
+    const path = url.pathname.replace(/\/+$/, "") || "/";
+    const res = createResponder(req, config);
+    try {
+      if (req.method === "OPTIONS") {
+        return res.noContent();
+      }
+      if (req.method === "GET" && path.endsWith("/health")) {
+        return await handleHealth(config, res);
+      }
+      if (config.auth) {
+        const authorized = await config.auth(req);
+        if (!authorized) {
+          return res.json({ error: "Unauthorized" }, 401);
+        }
+      }
+      if (req.method === "POST" && path.endsWith("/presign")) {
+        return await handlePresign(req, config, res);
+      }
+      if (req.method === "POST" && path.endsWith("/multipart/init")) {
+        return await handleMultipartInit(req, config, res);
+      }
+      if (req.method === "POST" && path.endsWith("/multipart/sign-part")) {
+        return await handleMultipartSignPart(req, config, res);
+      }
+      if (req.method === "POST" && path.endsWith("/multipart/complete")) {
+        return await handleMultipartComplete(req, config, res);
+      }
+      if (req.method === "POST" && path.endsWith("/multipart/abort")) {
+        return await handleMultipartAbort(req, config, res);
+      }
+      if (req.method === "POST" && path.endsWith("/multipart/resume") && (config.multipartResumeWindowSeconds ?? DEFAULT_MULTIPART_RESUME_WINDOW_SECONDS) > 0) {
+        return await handleMultipartResume(req, config, res);
+      }
+      const authMatch = path.match(/\/auth\/([\w-]+?)(?:\/(cb))?$/);
+      if (req.method === "GET" && authMatch) {
+        const provider = authMatch[1];
+        if (provider === void 0) {
+          return res.json({ error: "Not found" }, 404);
+        }
+        const isCallback = authMatch[2] === "cb";
+        if (isCallback) {
+          return await handleOAuthCallback(req, config, provider, res);
+        }
+        return await handleOAuthRedirect(req, config, provider, res);
+      }
+      const filesMatch = path.match(
+        /\/files\/([\w-]+?)(?:\/(transfer))?$/
+      );
+      if (filesMatch) {
+        const provider = filesMatch[1];
+        if (provider === void 0) {
+          return res.json({ error: "Not found" }, 404);
+        }
+        const isTransfer = filesMatch[2] === "transfer";
+        if (req.method === "POST" && isTransfer) {
+          return await handleFileTransfer(req, config, provider, res);
+        }
+        if (req.method === "GET" && !isTransfer) {
+          return await handleListFiles(req, config, provider, res);
+        }
+      }
+      return res.json({ error: "Not found" }, 404);
+    } catch (error) {
+      return res.fail(
+        "router",
+        req.method,
+        500,
+        import_core12.UpupErrorCode.STORAGE_ERROR,
+        "Internal error",
+        error
+      );
+    }
+  };
+}
+
+// src/node-http-bridge.ts
+function nodeHeadersToWeb(h) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(h)) {
+    if (v === void 0) continue;
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else headers.set(k, v);
+  }
+  return headers;
+}
+function toWebRequest(input) {
+  const hasBody = input.method !== "GET" && input.method !== "HEAD";
+  return new Request(input.url, {
+    method: input.method,
+    headers: nodeHeadersToWeb(input.headers),
+    ...hasBody && input.body != null ? { body: input.body } : {}
+  });
+}
+async function writeWebResponse(sink, webRes) {
+  sink.status(webRes.status);
+  webRes.headers.forEach((value, key) => {
+    if (key.toLowerCase() === "content-length") return;
+    sink.setHeader(key, value);
+  });
+  sink.send(Buffer.from(await webRes.arrayBuffer()));
+}
+
+// src/express.ts
+function createUpupMiddleware(config) {
+  const handler = createUpupHandler(config);
+  return async (req, res, _next) => {
+    const url = `${req.protocol}://${req.get("host")}${req.originalUrl}`;
+    const webReq = toWebRequest({
+      url,
+      method: req.method,
+      headers: req.headers,
+      body: req.method !== "GET" && req.method !== "HEAD" ? JSON.stringify(req.body) : void 0
+    });
+    const webRes = await handler(webReq);
+    await writeWebResponse(
+      {
+        status: (c) => res.status(c),
+        setHeader: (k, v) => res.setHeader(k, v),
+        send: (b) => {
+          res.send(b);
+        }
+      },
+      webRes
+    );
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createUpupMiddleware
+});
+//# sourceMappingURL=express.cjs.map