img-upload-kit 0.0.0-stage → 2.0.0

package/dist/server.js

@@ -0,0 +1,1801 @@
+import {
+  UploadValidationError,
+  createUploadHandler,
+  createUploadHttpHandler,
+  isClientValidationError
+} from "./chunk-4ASFG3KB.js";
+import "./chunk-S2IFAWJK.js";
+import {
+  DEFAULT_ALLOWED_FORMATS,
+  DEFAULT_IMAGE_DIMENSIONS,
+  STANDARD_PRESETS,
+  SVG_MIME_TYPE,
+  hexToRgb,
+  rgbToHex,
+  validateImageFileStrict
+} from "./chunk-TT5C7K3Q.js";
+
+// src/server/optimization/types.ts
+var DEFAULT_LIMIT_INPUT_PIXELS = 5e7;
+var PRIMARY_AVIF_EFFORT = 6;
+var RETRY_AVIF_EFFORT = 5;
+var BLUR_PLACEHOLDER_WIDTH = 128;
+var BLUR_PLACEHOLDER_FALLBACK_WIDTH = 96;
+var BLUR_PLACEHOLDER_QUALITY = 80;
+var BLUR_PLACEHOLDER_MAX_CHARS = 8e3;
+var EDGE_COLOR_FALLBACK = "#6B7280";
+var EDGE_WHITE_FALLBACK = "#F9FAFB";
+var WHITE_DOMINANCE_RATIO = 1.35;
+
+// src/server/security/sanitizeSvg.ts
+var DEFAULT_MAX_SVG_BYTES = 1024 * 1024;
+var FORBIDDEN_ELEMENTS = [
+  "script",
+  "foreignObject",
+  "iframe",
+  "embed",
+  "object",
+  "applet",
+  "meta",
+  "link",
+  "base",
+  "audio",
+  "video",
+  "canvas",
+  "animate",
+  "animateMotion",
+  "animateTransform",
+  "set",
+  "handler",
+  "listener",
+  "tbreak"
+];
+var SAFE_NAMED_ENTITIES = /* @__PURE__ */ new Set(["amp", "lt", "gt", "quot", "apos"]);
+var SAFE_HREF_FRAGMENT_RE = /^#[a-zA-Z0-9_.:-]+$/;
+var SAFE_DATA_IMAGE_RE = /^data:image\/(?:png|jpeg|webp);base64,[a-zA-Z0-9+/=\s]+$/i;
+function stripControlAndSpace(str) {
+  let out = "";
+  for (let i = 0; i < str.length; i++) {
+    if (str.charCodeAt(i) > 32) out += str[i];
+  }
+  return out;
+}
+function decodeHtmlEntitiesForCheck(value) {
+  const decoded = value.replace(
+    /&#x([0-9a-fA-F]+);?/g,
+    (_, hex) => String.fromCodePoint(Number.parseInt(hex, 16) || 0)
+  ).replace(
+    /&#(\d+);?/g,
+    (_, dec) => String.fromCodePoint(Number.parseInt(dec, 10) || 0)
+  );
+  return stripControlAndSpace(decoded);
+}
+function isSafeSvgHref(rawValue) {
+  const trimmed = rawValue.trim();
+  if (SAFE_HREF_FRAGMENT_RE.test(trimmed)) return true;
+  const decoded = decodeHtmlEntitiesForCheck(trimmed);
+  if (SAFE_HREF_FRAGMENT_RE.test(decoded)) return true;
+  if (SAFE_DATA_IMAGE_RE.test(trimmed) && SAFE_DATA_IMAGE_RE.test(decoded)) {
+    return true;
+  }
+  return false;
+}
+function sanitizeCssBlock(css) {
+  return css.replace(/@import\b[^;{}]*(?:;|$)/gi, "").replace(/expression\s*\([^)]*\)/gi, "").replace(/(?:javascript|vbscript|data)\s*:[^;)"']*/gi, "").replace(/-moz-binding\s*:[^;}"']*/gi, "").replace(/behavior\s*:[^;}"']*/gi, "").replace(/url\s*\(\s*(['"]?)(.*?)\1\s*\)/gi, (full, _q, target) => {
+    const cleaned = decodeHtmlEntitiesForCheck(target.trim());
+    return SAFE_HREF_FRAGMENT_RE.test(cleaned) ? full : "none";
+  });
+}
+function sanitizeTagAttributes(attrs) {
+  const attrRe = /([a-zA-Z_:][\w:.-]*)\s*(?:=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+  const kept = [];
+  for (const match of attrs.matchAll(attrRe)) {
+    const rawName = match[1];
+    const lowerName = rawName.toLowerCase();
+    const localName = lowerName.includes(":") ? lowerName.split(":")[1] : lowerName;
+    const rawValue = match[2] ?? match[3] ?? match[4] ?? "";
+    if (lowerName.startsWith("on") || localName.startsWith("on")) {
+      continue;
+    }
+    if (localName === "href" || lowerName === "xlink:href" || localName === "src" || localName === "action" || localName === "formaction" || localName === "data") {
+      if (!isSafeSvgHref(rawValue)) {
+        continue;
+      }
+      const escaped = rawValue.replace(/"/g, "&quot;");
+      kept.push(`${rawName}="${escaped}"`);
+      continue;
+    }
+    if (localName === "style") {
+      const cleanStyle = sanitizeCssBlock(rawValue).replace(/"/g, "'");
+      if (cleanStyle.trim()) {
+        kept.push(`style="${cleanStyle}"`);
+      }
+      continue;
+    }
+    const decodedVal = decodeHtmlEntitiesForCheck(rawValue).toLowerCase();
+    if (decodedVal.includes("javascript:") || decodedVal.includes("vbscript:") || decodedVal.includes("data:text/") || decodedVal.includes("data:image/svg")) {
+      continue;
+    }
+    if (/url\s*\(/i.test(rawValue)) {
+      const sanitizedUrlAttr = sanitizeCssBlock(rawValue).replace(/"/g, "&quot;");
+      kept.push(`${rawName}="${sanitizedUrlAttr}"`);
+      continue;
+    }
+    if (match[2] !== void 0 || match[3] !== void 0 || match[4] !== void 0) {
+      kept.push(`${rawName}="${rawValue.replace(/"/g, "&quot;")}"`);
+    } else {
+      kept.push(rawName);
+    }
+  }
+  return kept.length > 0 ? ` ${kept.join(" ")}` : "";
+}
+function sanitizeSvg(input, options = {}) {
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_SVG_BYTES;
+  const byteLength = typeof input === "string" ? Buffer.byteLength(input, "utf8") : input.length;
+  if (byteLength > maxBytes) {
+    throw new UploadValidationError(
+      `SVG file size (${byteLength} bytes) exceeds maximum allowed SVG size of ${maxBytes} bytes`
+    );
+  }
+  let svg = typeof input === "string" ? input : input.toString("utf8");
+  svg = svg.replace(/^\uFEFF/, "");
+  svg = svg.replace(/<!DOCTYPE[^[>]*(?:\[[\s\S]*?\]\s*)?>/gi, "");
+  svg = svg.replace(/<!ENTITY[\s\S]*?>/gi, "");
+  svg = svg.replace(/<!--[\s\S]*?-->/g, "");
+  svg = svg.replace(/<!\[CDATA\[[\s\S]*?\]\]>/g, "");
+  svg = svg.replace(/<\?(?!xml\b)[\s\S]*?\?>/gi, "");
+  svg = svg.replace(
+    /&([a-zA-Z_][\w.-]*);/g,
+    (full, name) => SAFE_NAMED_ENTITIES.has(name) ? full : ""
+  );
+  const tagPattern = FORBIDDEN_ELEMENTS.join("|");
+  const pairedRe = new RegExp(
+    `<\\s*(?:[a-zA-Z0-9_-]+:)?(?:${tagPattern})\\b[^>]*>[\\s\\S]*?<\\s*\\/\\s*(?:[a-zA-Z0-9_-]+:)?(?:${tagPattern})\\s*>`,
+    "gi"
+  );
+  const singleRe = new RegExp(
+    `<\\s*\\/?\\s*(?:[a-zA-Z0-9_-]+:)?(?:${tagPattern})\\b[^>]*\\/?>`,
+    "gi"
+  );
+  const htmlNamespaceRe = /<\s*\/?\s*(?:xhtml|html):[a-zA-Z0-9_-]+\b[^>]*\/?>/gi;
+  for (let pass = 0; pass < 4; pass++) {
+    const prev = svg;
+    svg = svg.replace(pairedRe, "").replace(singleRe, "").replace(htmlNamespaceRe, "");
+    if (svg === prev) break;
+  }
+  svg = svg.replace(
+    /(<\s*style\b[^>]*>)([\s\S]*?)(<\s*\/\s*style\s*>)/gi,
+    (_m, open, body, close) => `${open}${sanitizeCssBlock(body)}${close}`
+  );
+  svg = svg.replace(
+    /<([a-zA-Z_:][\w:.-]*)(\s[^<>]*?)?(\s*\/?)>/g,
+    (_full, tagName, attrs, selfClose) => {
+      const cleanAttrs = attrs ? sanitizeTagAttributes(attrs) : "";
+      return `<${tagName}${cleanAttrs}${selfClose}>`;
+    }
+  );
+  if (!/<svg[\s>/]/i.test(svg)) {
+    throw new UploadValidationError(
+      "Invalid SVG: missing root <svg> element after sanitization"
+    );
+  }
+  if (pairedRe.test(svg) || singleRe.test(svg) || /<!(?:DOCTYPE|ENTITY)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg) || /(?:javascript|vbscript)\s*:/i.test(svg)) {
+    throw new UploadValidationError(
+      "Invalid SVG: unsafe content remained after sanitization"
+    );
+  }
+  return Buffer.from(svg.trim(), "utf8");
+}
+
+// src/server/optimization/loadSharp.ts
+var SHARP_MISSING_MESSAGE = "img-upload-kit/server requires `sharp` \u2014 run `npm i sharp`";
+var sharpPromise = null;
+function unwrapDefault(mod) {
+  const record = mod;
+  return record && record.default !== void 0 ? record.default : mod;
+}
+function loadSharp() {
+  if (!sharpPromise) {
+    sharpPromise = import("sharp").then(
+      (mod) => unwrapDefault(mod),
+      (error) => {
+        sharpPromise = null;
+        throw new Error(SHARP_MISSING_MESSAGE, { cause: error });
+      }
+    );
+  }
+  return sharpPromise;
+}
+
+// src/server/optimization/imageOptimizer.ts
+var PASSTHROUGH_FORMATS = /* @__PURE__ */ new Set(["jpeg", "png", "webp", "avif"]);
+function extractSvgDimensions(svgText, metaWidth, metaHeight) {
+  let width = metaWidth;
+  let height = metaHeight;
+  if (!width || !height) {
+    const svgTagMatch = svgText.match(/<svg\b[^>]*>/i);
+    if (svgTagMatch) {
+      const tag = svgTagMatch[0];
+      const wMatch = tag.match(/\bwidth\s*=\s*["']\s*([\d.]+)(?:px)?\s*["']/i);
+      const hMatch = tag.match(/\bheight\s*=\s*["']\s*([\d.]+)(?:px)?\s*["']/i);
+      if (!width && wMatch) width = Math.round(parseFloat(wMatch[1]));
+      if (!height && hMatch) height = Math.round(parseFloat(hMatch[1]));
+    }
+  }
+  if (!width || !height) {
+    const viewBoxMatch = svgText.match(
+      /viewBox\s*=\s*["']\s*([\d.-]+)[\s,]+([\d.-]+)[\s,]+([\d.-]+)[\s,]+([\d.-]+)\s*["']/i
+    );
+    if (viewBoxMatch) {
+      if (!width) width = Math.round(parseFloat(viewBoxMatch[3]));
+      if (!height) height = Math.round(parseFloat(viewBoxMatch[4]));
+    }
+  }
+  return {
+    width: width && width > 0 ? width : 600,
+    height: height && height > 0 ? height : 600
+  };
+}
+async function optimizeImage(buffer, options = {}) {
+  const sharp = await loadSharp();
+  const maxDimensions = options.maxDimensions || DEFAULT_IMAGE_DIMENSIONS;
+  const { outputFormat, quality } = options;
+  const limitInputPixels = options.limitInputPixels ?? DEFAULT_LIMIT_INPUT_PIXELS;
+  const primaryEffort = options.effort ?? PRIMARY_AVIF_EFFORT;
+  const retryEffort = options.effort !== void 0 ? Math.max(1, options.effort - 1) : RETRY_AVIF_EFFORT;
+  let pipeline = sharp(buffer, {
+    failOn: "error",
+    limitInputPixels
+  }).rotate();
+  let metadata;
+  try {
+    metadata = await pipeline.metadata();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.toLowerCase().includes("pixel limit") || msg.toLowerCase().includes("exceeds") || msg.toLowerCase().includes("unsupported image format")) {
+      throw new UploadValidationError(msg);
+    }
+    throw err;
+  }
+  const originalFormat = metadata.format;
+  if (originalFormat === "svg") {
+    const sanitizedBuffer = sanitizeSvg(buffer);
+    const svgText = sanitizedBuffer.toString("utf8");
+    const dims = extractSvgDimensions(svgText, metadata.width, metadata.height);
+    return {
+      buffer: sanitizedBuffer,
+      width: dims.width,
+      height: dims.height,
+      format: "svg",
+      size: sanitizedBuffer.length,
+      ...quality !== void 0 ? { quality } : {}
+    };
+  }
+  const isPhoto = originalFormat === "jpeg" || Boolean(metadata.density && metadata.density > 150);
+  let baseQuality = quality ?? (isPhoto ? 85 : 88);
+  baseQuality = Math.max(1, Math.min(100, baseQuality));
+  pipeline = pipeline.resize(maxDimensions.width, maxDimensions.height, {
+    fit: "inside",
+    withoutEnlargement: true,
+    kernel: "lanczos3"
+  });
+  if (outputFormat === "jpeg" || outputFormat === "png" || outputFormat === "webp") {
+    let cloned = pipeline.clone();
+    if (outputFormat === "jpeg") {
+      cloned = cloned.jpeg({ quality: baseQuality, mozjpeg: true });
+    } else if (outputFormat === "png") {
+      cloned = cloned.png();
+    } else if (outputFormat === "webp") {
+      cloned = cloned.webp({ quality: baseQuality, effort: 4 });
+    }
+    const outputBuffer = await cloned.toBuffer({ resolveWithObject: true });
+    return {
+      buffer: outputBuffer.data,
+      width: outputBuffer.info.width || maxDimensions.width,
+      height: outputBuffer.info.height || maxDimensions.height,
+      format: outputFormat,
+      size: outputBuffer.info.size,
+      quality: baseQuality
+    };
+  }
+  const avifBuffer = await pipeline.clone().avif({
+    quality: baseQuality,
+    effort: primaryEffort,
+    chromaSubsampling: "4:2:0",
+    bitdepth: 8
+  }).toBuffer({ resolveWithObject: true });
+  const avifSize = avifBuffer.info.size;
+  const originalSize = buffer.length;
+  if (avifSize <= originalSize || outputFormat === "avif") {
+    return {
+      buffer: avifBuffer.data,
+      width: avifBuffer.info.width || maxDimensions.width,
+      height: avifBuffer.info.height || maxDimensions.height,
+      format: "avif",
+      size: avifSize,
+      quality: baseQuality
+    };
+  }
+  const scaledQuality = Math.max(
+    40,
+    Math.round(baseQuality * Math.sqrt(originalSize / avifSize))
+  );
+  const avifRetry = await pipeline.clone().avif({
+    quality: scaledQuality,
+    effort: retryEffort,
+    chromaSubsampling: "4:2:0",
+    bitdepth: 8
+  }).toBuffer({ resolveWithObject: true });
+  if (avifRetry.info.size <= originalSize) {
+    return {
+      buffer: avifRetry.data,
+      width: avifRetry.info.width || maxDimensions.width,
+      height: avifRetry.info.height || maxDimensions.height,
+      format: "avif",
+      size: avifRetry.info.size,
+      quality: scaledQuality
+    };
+  }
+  const isRotated90 = typeof metadata.orientation === "number" && metadata.orientation >= 5 && metadata.orientation <= 8;
+  const orientedWidth = isRotated90 ? metadata.height : metadata.width;
+  const orientedHeight = isRotated90 ? metadata.width : metadata.height;
+  const wasDimensionCapped = (orientedWidth ?? 0) > maxDimensions.width || (orientedHeight ?? 0) > maxDimensions.height;
+  if (!wasDimensionCapped && PASSTHROUGH_FORMATS.has(originalFormat ?? "")) {
+    const srcFmt = originalFormat;
+    let passthrough = pipeline.clone();
+    if (srcFmt === "jpeg") {
+      passthrough = passthrough.jpeg({ quality: baseQuality, mozjpeg: true });
+    } else if (srcFmt === "png") {
+      passthrough = passthrough.png({ compressionLevel: 9 });
+    } else if (srcFmt === "webp") {
+      passthrough = passthrough.webp({ quality: baseQuality, effort: 4 });
+    } else {
+      passthrough = passthrough.avif({
+        quality: baseQuality,
+        effort: retryEffort
+      });
+    }
+    let passthroughOut = await passthrough.toBuffer({ resolveWithObject: true });
+    if (srcFmt === "jpeg" && passthroughOut.info.size > originalSize) {
+      passthroughOut = await pipeline.clone().jpeg({ quality: 10 }).toBuffer({ resolveWithObject: true });
+    }
+    return {
+      buffer: passthroughOut.data,
+      width: passthroughOut.info.width || orientedWidth || maxDimensions.width,
+      height: passthroughOut.info.height || orientedHeight || maxDimensions.height,
+      format: srcFmt,
+      size: passthroughOut.info.size,
+      quality: baseQuality
+    };
+  }
+  const webpBuffer = await pipeline.clone().webp({ quality: baseQuality, effort: 6, smartSubsample: true }).toBuffer({ resolveWithObject: true });
+  const useWebP = webpBuffer.info.size <= avifRetry.info.size;
+  const winner = useWebP ? {
+    buf: webpBuffer.data,
+    fmt: "webp",
+    sz: webpBuffer.info.size,
+    w: webpBuffer.info.width,
+    h: webpBuffer.info.height,
+    q: baseQuality
+  } : {
+    buf: avifRetry.data,
+    fmt: "avif",
+    sz: avifRetry.info.size,
+    w: avifRetry.info.width,
+    h: avifRetry.info.height,
+    q: scaledQuality
+  };
+  return {
+    buffer: winner.buf,
+    width: winner.w || maxDimensions.width,
+    height: winner.h || maxDimensions.height,
+    format: winner.fmt,
+    size: winner.sz,
+    quality: winner.q
+  };
+}
+
+// src/server/optimization/blurGenerator.ts
+import { encode as encodeBlurHash } from "blurhash";
+
+// src/server/optimization/colorHistogram.ts
+async function extractEnhancedColorFromBuffer(buffer, mode = "balanced") {
+  const sharp = await loadSharp();
+  try {
+    const metadata = await sharp(buffer).metadata();
+    const maxSize = 400;
+    const needsResize = metadata.width && metadata.height && (metadata.width > maxSize || metadata.height > maxSize);
+    if (needsResize) {
+      const resized = await sharp(buffer).resize(maxSize, maxSize, {
+        fit: "inside",
+        kernel: "lanczos3",
+        withoutEnlargement: true
+      }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+      return extractDominantColorHistogramAdvanced(
+        resized.data,
+        resized.info.width,
+        resized.info.height,
+        mode
+      );
+    }
+    const raw = await sharp(buffer).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+    return extractDominantColorHistogramAdvanced(
+      raw.data,
+      raw.info.width,
+      raw.info.height,
+      mode
+    );
+  } catch {
+    const stats = await sharp(buffer).resize(64, 64, { fit: "cover", kernel: "lanczos3" }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+    return extractDominantColorHistogram(stats.data);
+  }
+}
+function extractDominantColorHistogramAdvanced(data, width, height, mode) {
+  const colorMap = /* @__PURE__ */ new Map();
+  const bucketSize = 16;
+  const centerWeight = 1.5;
+  const centerX = width / 2 || 1;
+  const centerY = height / 2 || 1;
+  let whiteWeight = 0;
+  for (let i = 0; i < data.length; i += 4) {
+    const alpha = data[i + 3];
+    if (alpha !== void 0 && alpha < 8) continue;
+    const r2 = data[i];
+    const g2 = data[i + 1];
+    const b2 = data[i + 2];
+    const brightness = (r2 + g2 + b2) / 3;
+    if (brightness < 10) continue;
+    const pixelIndex = i / 4;
+    const x = pixelIndex % width;
+    const y = Math.floor(pixelIndex / width);
+    const dx = (x - centerX) / centerX;
+    const dy = (y - centerY) / centerY;
+    const distanceFromCenter = Math.sqrt(dx * dx + dy * dy);
+    let weight = 1;
+    if (mode === "edge") {
+      const edgeThicknessX = Math.max(1, Math.floor(width * 0.12));
+      const edgeThicknessY = Math.max(1, Math.floor(height * 0.12));
+      const onLeftEdge = x < edgeThicknessX;
+      const onRightEdge = x >= width - edgeThicknessX;
+      const onTopEdge = y < edgeThicknessY;
+      const onBottomEdge = y >= height - edgeThicknessY;
+      if (!(onLeftEdge || onRightEdge || onTopEdge || onBottomEdge)) {
+        continue;
+      }
+      const distanceToNearestEdge = Math.min(
+        x,
+        y,
+        width - 1 - x,
+        height - 1 - y
+      );
+      const maxEdgeDistance = Math.max(edgeThicknessX, edgeThicknessY) || 1;
+      const edgeFactor = 1 - distanceToNearestEdge / maxEdgeDistance;
+      weight = 1 + edgeFactor * 3;
+    } else {
+      weight = distanceFromCenter < 0.5 ? centerWeight : 1;
+    }
+    const isNearWhite = r2 >= 245 && g2 >= 245 && b2 >= 245;
+    if (isNearWhite) {
+      whiteWeight += weight;
+      continue;
+    }
+    const bucketR = Math.floor(r2 / bucketSize) * bucketSize;
+    const bucketG = Math.floor(g2 / bucketSize) * bucketSize;
+    const bucketB = Math.floor(b2 / bucketSize) * bucketSize;
+    const key = `${bucketR},${bucketG},${bucketB}`;
+    colorMap.set(key, (colorMap.get(key) || 0) + weight);
+  }
+  if (!colorMap.size) {
+    return whiteWeight > 0 ? EDGE_WHITE_FALLBACK : EDGE_COLOR_FALLBACK;
+  }
+  let maxCount = 0;
+  let dominantColor = "64,64,80";
+  let totalColorWeight = 0;
+  colorMap.forEach((count, color) => {
+    totalColorWeight += count;
+    if (count > maxCount) {
+      maxCount = count;
+      dominantColor = color;
+    }
+  });
+  const whiteDominates = whiteWeight > 0 && whiteWeight >= totalColorWeight * WHITE_DOMINANCE_RATIO;
+  if (whiteDominates) {
+    return EDGE_WHITE_FALLBACK;
+  }
+  const [r, g, b] = dominantColor.split(",").map(Number);
+  return rgbToHex(r, g, b);
+}
+function extractDominantColorHistogram(data) {
+  const colorMap = /* @__PURE__ */ new Map();
+  const bucketSize = 16;
+  let whiteWeight = 0;
+  for (let i = 0; i < data.length; i += 4) {
+    const alpha = data[i + 3];
+    if (alpha !== void 0 && alpha < 8) continue;
+    const r2 = Math.floor(data[i] / bucketSize) * bucketSize;
+    const g2 = Math.floor(data[i + 1] / bucketSize) * bucketSize;
+    const b2 = Math.floor(data[i + 2] / bucketSize) * bucketSize;
+    if (r2 >= 240 && g2 >= 240 && b2 >= 240) {
+      whiteWeight += 1;
+      continue;
+    }
+    const key = `${r2},${g2},${b2}`;
+    colorMap.set(key, (colorMap.get(key) || 0) + 1);
+  }
+  if (!colorMap.size) {
+    return whiteWeight > 0 ? EDGE_WHITE_FALLBACK : EDGE_COLOR_FALLBACK;
+  }
+  let maxCount = 0;
+  let dominantColor = "64,64,80";
+  let totalColorWeight = 0;
+  colorMap.forEach((count, color) => {
+    totalColorWeight += count;
+    if (count > maxCount) {
+      maxCount = count;
+      dominantColor = color;
+    }
+  });
+  const whiteDominates = whiteWeight > 0 && whiteWeight >= totalColorWeight * WHITE_DOMINANCE_RATIO;
+  if (whiteDominates) {
+    return EDGE_WHITE_FALLBACK;
+  }
+  const [r, g, b] = dominantColor.split(",").map(Number);
+  return rgbToHex(r, g, b);
+}
+
+// src/server/optimization/edgeColorExtractor.ts
+async function extractEdgeColorsFromBuffer(buffer) {
+  const sharp = await loadSharp();
+  try {
+    const sample = await sharp(buffer).resize(400, 400, {
+      fit: "inside",
+      kernel: "lanczos3",
+      withoutEnlargement: true
+    }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+    return computeEdgeColorSet(
+      sample.data,
+      sample.info.width,
+      sample.info.height
+    );
+  } catch {
+    try {
+      const fallback = await extractEnhancedColorFromBuffer(buffer, "edge");
+      return {
+        top: fallback,
+        right: fallback,
+        bottom: fallback,
+        left: fallback
+      };
+    } catch {
+      return {
+        top: EDGE_COLOR_FALLBACK,
+        right: EDGE_COLOR_FALLBACK,
+        bottom: EDGE_COLOR_FALLBACK,
+        left: EDGE_COLOR_FALLBACK
+      };
+    }
+  }
+}
+function computeEdgeColorSet(data, width, height) {
+  const thicknessX = Math.max(2, Math.floor(width * 0.12));
+  const thicknessY = Math.max(2, Math.floor(height * 0.12));
+  const bucketSize = 16;
+  const edgeMaps = {
+    top: /* @__PURE__ */ new Map(),
+    right: /* @__PURE__ */ new Map(),
+    bottom: /* @__PURE__ */ new Map(),
+    left: /* @__PURE__ */ new Map()
+  };
+  const whiteEdgeStrength = {
+    top: 0,
+    right: 0,
+    bottom: 0,
+    left: 0
+  };
+  const accumulateEdgeSample = (edge, weight, key, isWhiteSample) => {
+    if (weight <= 0) return;
+    if (isWhiteSample) {
+      whiteEdgeStrength[edge] += weight;
+      return;
+    }
+    edgeMaps[edge].set(key, (edgeMaps[edge].get(key) || 0) + weight);
+  };
+  for (let i = 0; i < data.length; i += 4) {
+    const r = data[i];
+    const g = data[i + 1];
+    const b = data[i + 2];
+    const alpha = data[i + 3];
+    if (alpha !== void 0 && alpha < 8) continue;
+    const brightness = (r + g + b) / 3;
+    if (brightness < 12) continue;
+    const isNearWhite = r >= 245 && g >= 245 && b >= 245;
+    const pixelIndex = i / 4;
+    const x = pixelIndex % width;
+    const y = Math.floor(pixelIndex / width);
+    const bucketR = Math.floor(r / bucketSize) * bucketSize;
+    const bucketG = Math.floor(g / bucketSize) * bucketSize;
+    const bucketB = Math.floor(b / bucketSize) * bucketSize;
+    const key = `${bucketR},${bucketG},${bucketB}`;
+    const topWeight = y < thicknessY ? 1 + (thicknessY - y) / thicknessY : 0;
+    if (topWeight > 0) {
+      accumulateEdgeSample("top", topWeight, key, isNearWhite);
+    }
+    const bottomWeight = y >= height - thicknessY ? 1 + (y - (height - thicknessY)) / thicknessY : 0;
+    if (bottomWeight > 0) {
+      accumulateEdgeSample("bottom", bottomWeight, key, isNearWhite);
+    }
+    const leftWeight = x < thicknessX ? 1 + (thicknessX - x) / thicknessX : 0;
+    if (leftWeight > 0) {
+      accumulateEdgeSample("left", leftWeight, key, isNearWhite);
+    }
+    const rightWeight = x >= width - thicknessX ? 1 + (x - (width - thicknessX)) / thicknessX : 0;
+    if (rightWeight > 0) {
+      accumulateEdgeSample("right", rightWeight, key, isNearWhite);
+    }
+  }
+  return {
+    top: resolveEdgeColor(edgeMaps.top, whiteEdgeStrength.top),
+    right: resolveEdgeColor(edgeMaps.right, whiteEdgeStrength.right),
+    bottom: resolveEdgeColor(edgeMaps.bottom, whiteEdgeStrength.bottom),
+    left: resolveEdgeColor(edgeMaps.left, whiteEdgeStrength.left)
+  };
+}
+function resolveEdgeColor(map, whiteStrength) {
+  if (!map.size) {
+    return whiteStrength > 0 ? EDGE_WHITE_FALLBACK : EDGE_COLOR_FALLBACK;
+  }
+  let dominantColor = "";
+  let maxCount = 0;
+  let totalColorWeight = 0;
+  map.forEach((count, color) => {
+    totalColorWeight += count;
+    if (count > maxCount) {
+      maxCount = count;
+      dominantColor = color;
+    }
+  });
+  if (!dominantColor) {
+    return whiteStrength > 0 ? EDGE_WHITE_FALLBACK : EDGE_COLOR_FALLBACK;
+  }
+  const whiteDominates = whiteStrength > 0 && (totalColorWeight === 0 || whiteStrength >= totalColorWeight * WHITE_DOMINANCE_RATIO);
+  if (whiteDominates) {
+    return EDGE_WHITE_FALLBACK;
+  }
+  if (dominantColor.startsWith("#")) {
+    return dominantColor.toUpperCase();
+  }
+  const [r, g, b] = dominantColor.split(",").map(Number);
+  return rgbToHex(r, g, b);
+}
+function blendEdgeColors(edgeColors) {
+  const colors = Object.values(edgeColors);
+  if (!colors.length) {
+    return EDGE_COLOR_FALLBACK;
+  }
+  const totals = colors.reduce(
+    (acc, hex) => {
+      const { r, g, b } = hexToRgb(hex || EDGE_COLOR_FALLBACK);
+      acc.r += r;
+      acc.g += g;
+      acc.b += b;
+      return acc;
+    },
+    { r: 0, g: 0, b: 0 }
+  );
+  const count = colors.length;
+  return rgbToHex(totals.r / count, totals.g / count, totals.b / count);
+}
+
+// src/server/optimization/blurGenerator.ts
+function encodeRawBlurHash(data, width, height, componentX = 4, componentY = 3) {
+  const clampedX = Math.max(1, Math.min(Math.round(componentX), width, 9));
+  const clampedY = Math.max(1, Math.min(Math.round(componentY), height, 9));
+  return encodeBlurHash(
+    new Uint8ClampedArray(data),
+    width,
+    height,
+    clampedX,
+    clampedY
+  );
+}
+async function encodeBlurHashString(buffer, componentX = 4, componentY = 3) {
+  const sharp = await loadSharp();
+  const { data, info } = await sharp(buffer).resize(32, 32, { fit: "inside" }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+  return encodeRawBlurHash(
+    data,
+    info.width,
+    info.height,
+    componentX,
+    componentY
+  );
+}
+async function generateBlurPlaceholder(buffer, options = {}) {
+  const targetWidth = options.width ?? BLUR_PLACEHOLDER_WIDTH;
+  const fallbackWidth = options.fallbackWidth ?? BLUR_PLACEHOLDER_FALLBACK_WIDTH;
+  const quality = options.quality ?? BLUR_PLACEHOLDER_QUALITY;
+  const maxChars = options.maxDataUrlChars ?? BLUR_PLACEHOLDER_MAX_CHARS;
+  const sharp = await loadSharp();
+  try {
+    let processBuffer = buffer;
+    const isSvg = /<svg[\s>]/i.test(buffer.toString("utf8", 0, 1024));
+    if (isSvg) {
+      const normalizedSvg = buffer.toString("utf8").replace(/<svg\b/gi, "<svg").replace(/<\/svg\s*>/gi, "</svg>");
+      processBuffer = Buffer.from(normalizedSvg, "utf8");
+    }
+    const baseSize = Math.max(targetWidth, 128);
+    const rawSample = await sharp(processBuffer).rotate().resize(baseSize, baseSize, { fit: "inside", withoutEnlargement: true }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+    const rawInput = {
+      raw: {
+        width: rawSample.info.width,
+        height: rawSample.info.height,
+        channels: 4
+      }
+    };
+    const buildPlaceholderDataUrl = async (width) => {
+      const webpBuffer = await sharp(rawSample.data, rawInput).resize(width, width, { fit: "inside", withoutEnlargement: true }).webp({ quality, effort: 6, smartSubsample: true }).toBuffer();
+      return `data:image/webp;base64,${webpBuffer.toString("base64")}`;
+    };
+    let dataURL = await buildPlaceholderDataUrl(targetWidth);
+    if (dataURL.length > maxChars) {
+      dataURL = await buildPlaceholderDataUrl(fallbackWidth);
+    }
+    const edgeColors = computeEdgeColorSet(
+      rawSample.data,
+      rawSample.info.width,
+      rawSample.info.height
+    );
+    const color = blendEdgeColors(edgeColors);
+    let blurHash;
+    if (options.includeBlurHash) {
+      try {
+        const hashSample = rawSample.info.width <= 32 && rawSample.info.height <= 32 ? rawSample : await sharp(rawSample.data, rawInput).resize(32, 32, { fit: "inside" }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+        blurHash = encodeRawBlurHash(
+          hashSample.data,
+          hashSample.info.width,
+          hashSample.info.height
+        );
+      } catch {
+        blurHash = void 0;
+      }
+    }
+    return {
+      dataURL,
+      color,
+      ...blurHash && { blurHash }
+    };
+  } catch {
+    return generateFallbackBlur(buffer, options.includeBlurHash);
+  }
+}
+var generateBlurHash = generateBlurPlaceholder;
+async function generateFallbackBlur(buffer, includeBlurHash) {
+  const sharp = await loadSharp();
+  const tinyBuffer = await sharp(buffer).resize(64, 64, { fit: "cover", kernel: "lanczos3" }).blur(1).webp({
+    quality: 75,
+    effort: 6,
+    smartSubsample: false
+  }).toBuffer();
+  const dataURL = `data:image/webp;base64,${tinyBuffer.toString("base64")}`;
+  const edgeColors = await extractEdgeColorsFromBuffer(buffer);
+  const color = blendEdgeColors(edgeColors);
+  let blurHash;
+  if (includeBlurHash) {
+    try {
+      blurHash = await encodeBlurHashString(tinyBuffer);
+    } catch {
+      blurHash = void 0;
+    }
+  }
+  return { dataURL, color, ...blurHash && { blurHash } };
+}
+
+// src/server/security/sniffFormat.ts
+var AVIF_BRANDS = /* @__PURE__ */ new Set(["avif", "avis"]);
+var HEIF_BRANDS = /* @__PURE__ */ new Set(["heic", "heix", "hevc", "hevx", "mif1", "msf1"]);
+function readAscii(bytes, start, end) {
+  let out = "";
+  const limit = Math.min(bytes.length, end);
+  for (let i = start; i < limit; i++) {
+    out += String.fromCharCode(bytes[i]);
+  }
+  return out;
+}
+function sniffIsoBmff(bytes) {
+  if (bytes.length < 12) return null;
+  if (readAscii(bytes, 4, 8) !== "ftyp") return null;
+  const boxSize = (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
+  const maxOffset = Math.min(
+    bytes.length,
+    boxSize >= 16 ? Math.min(boxSize, 128) : 64
+  );
+  const majorBrand = readAscii(bytes, 8, 12).toLowerCase();
+  if (AVIF_BRANDS.has(majorBrand)) {
+    return { format: "avif", mime: "image/avif" };
+  }
+  const brands = [majorBrand];
+  for (let offset = 16; offset + 4 <= maxOffset; offset += 4) {
+    brands.push(readAscii(bytes, offset, offset + 4).toLowerCase());
+  }
+  if (brands.some((b) => AVIF_BRANDS.has(b))) {
+    return { format: "avif", mime: "image/avif" };
+  }
+  if (brands.some((b) => HEIF_BRANDS.has(b))) {
+    return { format: "heif", mime: "image/heif" };
+  }
+  return null;
+}
+function sniffTextSvg(bytes) {
+  const sampleLength = Math.min(bytes.length, 4096);
+  for (let i = 0; i < Math.min(sampleLength, 512); i++) {
+    if (bytes[i] === 0) return null;
+  }
+  const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, sampleLength)).replace(/^\uFEFF/, "").trimStart();
+  if (!text.startsWith("<")) return null;
+  const stripped = text.replace(/^<\?xml[\s\S]*?\?>\s*/i, "").replace(/<!--[\s\S]*?-->\s*/g, "").replace(/<!DOCTYPE\s+svg[\s\S]*?(?:\]>|>)\s*/i, "").replace(/<!--[\s\S]*?-->\s*/g, "").trimStart();
+  if (/^<svg[\s>/]/i.test(stripped) || /<svg[\s>/]/i.test(text)) {
+    if (/^<!doctype\s+html\b/i.test(text) || /^<html[\s>]/i.test(stripped)) {
+      return null;
+    }
+    return { format: "svg", mime: "image/svg+xml" };
+  }
+  return null;
+}
+function sniffImageFormat(input) {
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  if (bytes.length < 4) return null;
+  if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) {
+    return { format: "jpeg", mime: "image/jpeg" };
+  }
+  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10) {
+    return { format: "png", mime: "image/png" };
+  }
+  if (bytes.length >= 6) {
+    const header = readAscii(bytes, 0, 6);
+    if (header === "GIF87a" || header === "GIF89a") {
+      return { format: "gif", mime: "image/gif" };
+    }
+  }
+  if (bytes.length >= 12 && readAscii(bytes, 0, 4) === "RIFF" && readAscii(bytes, 8, 12) === "WEBP") {
+    return { format: "webp", mime: "image/webp" };
+  }
+  const bmff = sniffIsoBmff(bytes);
+  if (bmff) return bmff;
+  if (bytes[0] === 73 && bytes[1] === 73 && bytes[2] === 42 && bytes[3] === 0 || bytes[0] === 77 && bytes[1] === 77 && bytes[2] === 0 && bytes[3] === 42) {
+    return { format: "tiff", mime: "image/tiff" };
+  }
+  if (bytes.length >= 14 && bytes[0] === 66 && bytes[1] === 77) {
+    return { format: "bmp", mime: "image/bmp" };
+  }
+  if (bytes[0] === 0 && bytes[1] === 0 && bytes[2] === 1 && bytes[3] === 0) {
+    return { format: "ico", mime: "image/x-icon" };
+  }
+  return sniffTextSvg(bytes);
+}
+function assertMagicBytesAllowed(buffer, allowedFormats, allowSvg = false) {
+  const sniffed = sniffImageFormat(buffer);
+  if (!sniffed) {
+    throw new UploadValidationError(
+      "Unsupported image format: file content is not a recognized image"
+    );
+  }
+  if (sniffed.format === "svg" && !allowSvg) {
+    throw new UploadValidationError(
+      "File type image/svg+xml is not allowed unless allowSvg: true is set"
+    );
+  }
+  if (allowedFormats.length > 0 && !allowedFormats.includes(sniffed.mime)) {
+    throw new UploadValidationError(
+      `File type ${sniffed.mime} is not allowed. Allowed: ${allowedFormats.join(", ")}`
+    );
+  }
+  return sniffed;
+}
+
+// src/server/semaphore.ts
+var SemaphoreQueueFullError = class extends Error {
+  status = 503;
+  constructor(message = "Server upload queue is full. Please try again later.") {
+    super(message);
+    this.name = "SemaphoreQueueFullError";
+  }
+};
+function createAbortError(signal) {
+  if (signal?.reason instanceof Error) {
+    return signal.reason;
+  }
+  const err = new Error(
+    typeof signal?.reason === "string" ? signal.reason : "Operation aborted"
+  );
+  err.name = "AbortError";
+  return err;
+}
+var AsyncSemaphore = class {
+  constructor(concurrency, options) {
+    this.concurrency = concurrency;
+    if (concurrency < 1) {
+      throw new Error("AsyncSemaphore concurrency must be >= 1");
+    }
+    if (typeof options === "number") {
+      this.maxQueue = options;
+    } else if (options && typeof options === "object") {
+      this.maxQueue = options.maxQueue;
+    }
+  }
+  concurrency;
+  activeCount = 0;
+  maxQueue;
+  queue = [];
+  get active() {
+    return this.activeCount;
+  }
+  get pending() {
+    return this.queue.length;
+  }
+  async run(task, options = {}) {
+    const { signal, timeoutMs, label = "Semaphore task" } = options;
+    await this.acquire(signal);
+    let rawTaskPromise;
+    try {
+      rawTaskPromise = Promise.resolve().then(task);
+    } catch (syncError) {
+      this.release();
+      throw syncError;
+    }
+    let released = false;
+    const releaseOnce = () => {
+      if (!released) {
+        released = true;
+        this.release();
+      }
+    };
+    void rawTaskPromise.then(
+      () => releaseOnce(),
+      (err) => {
+        const pending = err && typeof err === "object" && "pendingTask" in err ? err.pendingTask : void 0;
+        if (pending && typeof pending.then === "function") {
+          void pending.then(releaseOnce, releaseOnce);
+        } else {
+          releaseOnce();
+        }
+      }
+    );
+    let callerPromise = rawTaskPromise;
+    if (timeoutMs !== void 0 && timeoutMs > 0) {
+      callerPromise = withTimeout(callerPromise, timeoutMs, label);
+    }
+    if (signal) {
+      callerPromise = raceWithAbort(callerPromise, signal);
+    }
+    return callerPromise;
+  }
+  acquire(signal) {
+    if (signal?.aborted) {
+      return Promise.reject(createAbortError(signal));
+    }
+    if (this.activeCount < this.concurrency) {
+      this.activeCount += 1;
+      return Promise.resolve();
+    }
+    if (this.maxQueue !== void 0 && this.queue.length >= this.maxQueue) {
+      return Promise.reject(new SemaphoreQueueFullError());
+    }
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        const idx = this.queue.indexOf(entry);
+        if (idx !== -1) {
+          this.queue.splice(idx, 1);
+        }
+        entry.cancel(createAbortError(signal));
+      };
+      const entry = {
+        grant: () => {
+          signal?.removeEventListener("abort", onAbort);
+          this.activeCount += 1;
+          resolve();
+        },
+        cancel: (reason) => {
+          signal?.removeEventListener("abort", onAbort);
+          reject(reason);
+        }
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      this.queue.push(entry);
+    });
+  }
+  release() {
+    this.activeCount = Math.max(0, this.activeCount - 1);
+    const next = this.queue.shift();
+    next?.grant();
+  }
+};
+function raceWithAbort(task, signal) {
+  if (signal.aborted) {
+    const err = createAbortError(signal);
+    err.pendingTask = task.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return Promise.reject(err);
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      const err = createAbortError(signal);
+      err.pendingTask = task.then(
+        () => {
+        },
+        () => {
+        }
+      );
+      reject(err);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    task.then(
+      (val) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(val);
+      },
+      (err) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(err);
+      }
+    );
+  });
+}
+async function withTimeout(task, timeoutMs, label) {
+  let timeoutHandle = null;
+  const settledTask = task.then(
+    () => {
+    },
+    () => {
+    }
+  );
+  try {
+    return await Promise.race([
+      task,
+      new Promise((_, reject) => {
+        timeoutHandle = setTimeout(() => {
+          const err = new Error(
+            `${label} timed out after ${timeoutMs}ms`
+          );
+          err.pendingTask = settledTask;
+          reject(err);
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timeoutHandle) {
+      clearTimeout(timeoutHandle);
+    }
+  }
+}
+
+// src/server/uploader/bufferProcessor.ts
+async function computeSha256Hex(buffer) {
+  const bytes = new Uint8Array(buffer.byteLength);
+  bytes.set(buffer);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function throwIfAborted(signal) {
+  if (!signal?.aborted) return;
+  if (signal.reason instanceof Error) throw signal.reason;
+  const err = new Error(
+    typeof signal.reason === "string" ? signal.reason : "Operation aborted"
+  );
+  err.name = "AbortError";
+  throw err;
+}
+async function processImageBuffer(originalBuffer, options = {}) {
+  const optTimeout = options.optimizationTimeoutMs ?? 6e4;
+  const blurTimeout = options.blurTimeoutMs ?? 3e4;
+  throwIfAborted(options.signal);
+  const contentHash = await computeSha256Hex(originalBuffer);
+  throwIfAborted(options.signal);
+  const optimized = await withTimeout(
+    optimizeImage(originalBuffer, {
+      maxDimensions: options.maxDimensions,
+      outputFormat: options.outputFormat,
+      quality: options.quality,
+      limitInputPixels: options.limitInputPixels,
+      effort: options.effort
+    }),
+    optTimeout,
+    "Image optimization"
+  );
+  if (!optimized || !optimized.buffer) {
+    throw new Error("Image optimization returned invalid result");
+  }
+  if (!optimized.width || !optimized.height) {
+    throw new Error(
+      `Image dimensions missing: width=${optimized.width}, height=${optimized.height}`
+    );
+  }
+  throwIfAborted(options.signal);
+  const blurData = await withTimeout(
+    generateBlurPlaceholder(optimized.buffer, {
+      includeBlurHash: options.includeBlurHash
+    }),
+    blurTimeout,
+    "Blur generation"
+  );
+  return {
+    optimized,
+    blurData,
+    contentHash,
+    originalSize: originalBuffer.length
+  };
+}
+
+// src/server/uploader/pathGenerator.ts
+function randomShortId() {
+  if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.randomUUID === "function") {
+    return globalThis.crypto.randomUUID().split("-")[0];
+  }
+  return Math.random().toString(16).slice(2, 10).padEnd(8, "0");
+}
+function formatToExtension(format) {
+  switch (format) {
+    case "svg":
+      return "svg";
+    case "png":
+      return "png";
+    case "webp":
+      return "webp";
+    case "jpeg":
+      return "jpg";
+    default:
+      return "avif";
+  }
+}
+function sanitizeSegment(value) {
+  return value.replace(/\\/g, "/").split("/").map((part) => part.trim().replace(/[^a-zA-Z0-9._-]/g, "-")).filter((part) => part && part !== "." && part !== "..").join("/");
+}
+function stripFilenameExtension(rawFilename) {
+  const leaf = rawFilename.replace(/^.*[\\/]/, "").trim();
+  const dotIdx = leaf.lastIndexOf(".");
+  const base = dotIdx > 0 ? leaf.slice(0, dotIdx) : leaf;
+  const cleaned = base.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^[.-]+|[.-]+$/g, "");
+  return cleaned || "image";
+}
+function createDefaultPathGenerator() {
+  let imageCounter = 0;
+  return (ctx) => {
+    const cleanFolder = ctx.folder ? sanitizeSegment(ctx.folder) : "";
+    if (ctx.customFilename?.trim()) {
+      const baseName = stripFilenameExtension(ctx.customFilename);
+      const cleanName = `${baseName}.${ctx.extension}`;
+      const fullPath2 = cleanFolder ? `${cleanFolder}/${cleanName}` : cleanName;
+      return {
+        bucket: ctx.bucket,
+        path: fullPath2,
+        filename: cleanName
+      };
+    }
+    const date = /* @__PURE__ */ new Date();
+    const year = date.getFullYear();
+    const month = String(date.getMonth() + 1).padStart(2, "0");
+    const day = String(date.getDate()).padStart(2, "0");
+    imageCounter = (imageCounter + 1) % 1e4;
+    const seq = String(imageCounter).padStart(4, "0");
+    const timestamp = Date.now();
+    const randomSuffix = randomShortId();
+    const prefix = sanitizeSegment(
+      ctx.preset || cleanFolder.split("/")[0] || "img"
+    );
+    const filename = `${prefix}-${year}${month}${day}-${seq}-${timestamp}-${randomSuffix}.${ctx.extension}`;
+    const fullPath = cleanFolder ? `${cleanFolder}/${year}/${month}/${filename}` : `${year}/${month}/${filename}`;
+    return {
+      bucket: ctx.bucket,
+      path: fullPath,
+      filename
+    };
+  };
+}
+
+// src/server/uploader/uploadRetry.ts
+import fs from "fs/promises";
+import path from "path";
+function randomRetrySuffix() {
+  if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.randomUUID === "function") {
+    return globalThis.crypto.randomUUID().split("-")[0];
+  }
+  return Math.random().toString(16).slice(2, 10);
+}
+function isCollisionError(e) {
+  if (!e) return false;
+  const code = typeof e === "object" && e !== null && "code" in e ? String(e.code).toUpperCase() : "";
+  const statusCode = typeof e === "object" && e !== null && "$metadata" in e ? e.$metadata?.httpStatusCode : typeof e === "object" && e !== null && "statusCode" in e ? Number(e.statusCode) : void 0;
+  if (code === "EEXIST" || code === "PRECONDITIONFAILED" || statusCode === 412) {
+    return true;
+  }
+  if (code === "ENOENT") {
+    return false;
+  }
+  const msg = e instanceof Error ? e.message.toLowerCase() : String(e).toLowerCase();
+  if (msg.includes("does not exist") || msg.includes("doesn't exist") || msg.includes("not exist") || msg.includes("enoent")) {
+    return false;
+  }
+  return msg.includes("already exists") || msg.includes("already_exists") || msg.includes("eexist") || msg.includes("file exists") || msg.includes("precondition failed");
+}
+async function uploadWithCollisionRetry(params) {
+  const {
+    storage,
+    buildPath,
+    pathContext,
+    data,
+    contentType,
+    maxRetries = 3
+  } = params;
+  const isServerCustomName = Boolean(pathContext.customFilename) && !pathContext.isClientFilename;
+  let storageTarget = buildPath(pathContext);
+  let uploadResult;
+  for (let attempt = 0; attempt < maxRetries; attempt++) {
+    try {
+      uploadResult = await storage.upload({
+        bucket: storageTarget.bucket,
+        path: storageTarget.path,
+        data,
+        contentType,
+        upsert: isServerCustomName,
+        contentHash: pathContext.contentHash,
+        metadata: pathContext.metadata
+      });
+      break;
+    } catch (e) {
+      if (isCollisionError(e)) {
+        if (isServerCustomName) {
+          uploadResult = await storage.upload({
+            bucket: storageTarget.bucket,
+            path: storageTarget.path,
+            data,
+            contentType,
+            upsert: true,
+            contentHash: pathContext.contentHash,
+            metadata: pathContext.metadata
+          });
+          break;
+        }
+        if (pathContext.customFilename && pathContext.isClientFilename) {
+          const base = stripFilenameExtension(pathContext.customFilename);
+          storageTarget = buildPath({
+            ...pathContext,
+            customFilename: `${base}-${randomRetrySuffix()}`
+          });
+          continue;
+        }
+        storageTarget = buildPath({
+          ...pathContext,
+          customFilename: void 0
+        });
+        continue;
+      }
+      throw e;
+    }
+  }
+  if (!uploadResult) {
+    throw new Error("Failed to upload image after multiple retries");
+  }
+  return { uploadResult, storageTarget };
+}
+async function mirrorBufferLocally(options) {
+  const {
+    buffer,
+    filename,
+    storagePath,
+    fallbackUrl,
+    mirrorDir,
+    publicUrlBase
+  } = options;
+  if (!mirrorDir) {
+    return fallbackUrl;
+  }
+  const relativeTarget = (storagePath || filename).replace(/^\/+/, "");
+  try {
+    const resolvedBase = path.resolve(mirrorDir);
+    const destPath = path.resolve(resolvedBase, relativeTarget);
+    const rel = path.relative(resolvedBase, destPath);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      return fallbackUrl;
+    }
+    const destDir = path.dirname(destPath);
+    await fs.mkdir(destDir, { recursive: true });
+    await fs.writeFile(destPath, buffer);
+    if (publicUrlBase) {
+      return `${publicUrlBase.replace(/\/+$/, "")}/${relativeTarget}`;
+    }
+  } catch {
+  }
+  return fallbackUrl;
+}
+async function deleteMirroredFiles(mirrorDirs, storagePath) {
+  if (!mirrorDirs.length || !storagePath) return;
+  const relativeTarget = storagePath.replace(/^\/+/, "");
+  if (!relativeTarget) return;
+  await Promise.all(
+    mirrorDirs.map(async (dir) => {
+      try {
+        const resolvedBase = path.resolve(dir);
+        const destPath = path.resolve(resolvedBase, relativeTarget);
+        const rel = path.relative(resolvedBase, destPath);
+        if (rel.startsWith("..") || path.isAbsolute(rel)) return;
+        await fs.unlink(destPath);
+      } catch {
+      }
+    })
+  );
+}
+
+// src/server/uploader/variantGenerator.ts
+function buildVariantStoragePath(basePath, width) {
+  const dotIdx = basePath.lastIndexOf(".");
+  const slashIdx = basePath.lastIndexOf("/");
+  if (dotIdx > slashIdx && dotIdx > 0) {
+    return `${basePath.slice(0, dotIdx)}-${width}w${basePath.slice(dotIdx)}`;
+  }
+  return `${basePath}-${width}w`;
+}
+function resolveEffectiveAllowedFormats(baseFormats, allowSvg, explicitAllowSvg) {
+  if (!allowSvg) return baseFormats.filter((fmt) => fmt !== SVG_MIME_TYPE);
+  if (explicitAllowSvg && !baseFormats.includes(SVG_MIME_TYPE)) {
+    return [...baseFormats, SVG_MIME_TYPE];
+  }
+  return baseFormats;
+}
+async function generateImageVariants(params) {
+  const {
+    sourceBuffer,
+    format,
+    quality,
+    effort,
+    limitInputPixels,
+    mainWidth,
+    mainHeight,
+    mainUrl,
+    baseStoragePath,
+    baseFilename,
+    bucket,
+    storage,
+    variantWidths,
+    upsert = false,
+    contentHash,
+    metadata,
+    mirrorDir,
+    publicUrlBase
+  } = params;
+  if (format === "svg" || !variantWidths?.length) {
+    return { variants: [] };
+  }
+  const targetWidths = [
+    ...new Set(
+      variantWidths.map((w) => Math.floor(w)).filter((w) => Number.isFinite(w) && w > 0 && w < mainWidth)
+    )
+  ].sort((a, b) => a - b);
+  if (targetWidths.length === 0) {
+    return { variants: [] };
+  }
+  const sharp = await loadSharp();
+  const baseQuality = Math.max(1, Math.min(100, quality ?? 85));
+  const avifEffort = effort ?? PRIMARY_AVIF_EFFORT;
+  const basePipeline = sharp(sourceBuffer, {
+    failOn: "error",
+    limitInputPixels: limitInputPixels ?? DEFAULT_LIMIT_INPUT_PIXELS
+  }).rotate();
+  const variants = await Promise.all(
+    targetWidths.map(async (w) => {
+      let branch = basePipeline.clone().resize({
+        width: w,
+        withoutEnlargement: true,
+        kernel: "lanczos3"
+      });
+      if (format === "jpeg") {
+        branch = branch.jpeg({ quality: baseQuality, mozjpeg: true });
+      } else if (format === "png") {
+        branch = branch.png({ compressionLevel: 9 });
+      } else if (format === "webp") {
+        branch = branch.webp({ quality: baseQuality, effort: 4 });
+      } else {
+        branch = branch.avif({
+          quality: baseQuality,
+          effort: avifEffort,
+          chromaSubsampling: "4:2:0",
+          bitdepth: 8
+        });
+      }
+      const out = await branch.toBuffer({ resolveWithObject: true });
+      const variantPath = buildVariantStoragePath(baseStoragePath, w);
+      const variantFilename = buildVariantStoragePath(baseFilename, w);
+      const uploaded = await storage.upload({
+        bucket,
+        path: variantPath,
+        data: out.data,
+        contentType: `image/${format}`,
+        upsert,
+        contentHash,
+        metadata
+      });
+      const resolvedUrl = await mirrorBufferLocally({
+        buffer: out.data,
+        filename: variantFilename,
+        storagePath: uploaded.path,
+        fallbackUrl: uploaded.url,
+        mirrorDir,
+        publicUrlBase
+      });
+      return {
+        width: out.info.width || w,
+        height: out.info.height || Math.max(1, Math.round(mainHeight / Math.max(1, mainWidth) * w)),
+        url: resolvedUrl,
+        size: out.info.size,
+        storagePath: uploaded.path
+      };
+    })
+  );
+  const srcSet = [
+    ...variants.map((v) => `${v.url} ${v.width}w`),
+    `${mainUrl} ${mainWidth}w`
+  ].join(", ");
+  return { variants, srcSet };
+}
+function collectCandidateVariantWidths(presets, extraWidths) {
+  const widths = new Set(extraWidths);
+  for (const preset of Object.values(presets)) {
+    if (preset?.variantWidths) {
+      for (const w of preset.variantWidths) {
+        if (Number.isFinite(w) && w > 0) widths.add(Math.floor(w));
+      }
+    }
+  }
+  return [...widths];
+}
+async function deleteStoredVariants(params) {
+  const {
+    storage,
+    bucket,
+    basePath,
+    mirrorDirs,
+    knownVariantPaths = [],
+    candidateWidths = []
+  } = params;
+  const paths = new Set(knownVariantPaths);
+  for (const w of candidateWidths) {
+    paths.add(buildVariantStoragePath(basePath, w));
+  }
+  if (paths.size === 0) return;
+  await Promise.all(
+    [...paths].map(async (vPath) => {
+      await storage.delete(bucket, vPath).catch(() => {
+      });
+      await deleteMirroredFiles(mirrorDirs, vPath);
+    })
+  );
+}
+async function invokeRecordHookWithRollback(params) {
+  const {
+    onUploadRecord,
+    awaitRecordHook,
+    record,
+    storage,
+    bucket,
+    mainPath,
+    variantPaths,
+    mirrorDirs,
+    onError
+  } = params;
+  if (!onUploadRecord) return;
+  if (awaitRecordHook) {
+    try {
+      await onUploadRecord(record);
+    } catch (hookError) {
+      await storage.delete(bucket, mainPath).catch(() => {
+      });
+      await deleteMirroredFiles(mirrorDirs, mainPath);
+      await deleteStoredVariants({
+        storage,
+        bucket,
+        basePath: mainPath,
+        mirrorDirs,
+        knownVariantPaths: variantPaths
+      });
+      throw hookError;
+    }
+  } else {
+    Promise.resolve(onUploadRecord(record)).catch((err) => {
+      onError?.(err, { action: "recordHook" });
+    });
+  }
+}
+
+// src/server/uploader/createImageUploader.ts
+function createImageUploader(options) {
+  const {
+    storage,
+    defaultBucket = "images",
+    defaultFolder = "",
+    defaultMaxSizeMB = 10,
+    defaultAllowedFormats = DEFAULT_ALLOWED_FORMATS,
+    defaultMaxDimensions = DEFAULT_IMAGE_DIMENSIONS,
+    allowSvg: defaultAllowSvg = false,
+    limitInputPixels: defaultLimitInputPixels,
+    effort: defaultEffort,
+    presets: customPresets,
+    includeStandardPresets = true,
+    pathGenerator,
+    onUploadRecord,
+    awaitRecordHook = false,
+    onError,
+    concurrency = 2,
+    maxQueue,
+    optimizationTimeoutMs = 6e4,
+    blurTimeoutMs = 3e4,
+    includeBlurHash: defaultIncludeBlurHash = false
+  } = options;
+  const mergedPresets = {
+    ...includeStandardPresets ? STANDARD_PRESETS : {},
+    ...customPresets || {}
+  };
+  const semaphore = new AsyncSemaphore(concurrency, { maxQueue });
+  const buildPath = pathGenerator || createDefaultPathGenerator();
+  const trackedVariants = /* @__PURE__ */ new Map();
+  const observedWidths = /* @__PURE__ */ new Set();
+  const resolvePreset = (name) => name ? mergedPresets[name] : void 0;
+  const getAllowedBuckets = () => {
+    const buckets = /* @__PURE__ */ new Set([defaultBucket]);
+    for (const preset of Object.values(mergedPresets)) {
+      if (preset?.bucket) buckets.add(preset.bucket);
+    }
+    return [...buckets];
+  };
+  const getMirrorDirs = () => [...new Set(Object.values(mergedPresets).map((p) => p?.mirrorDir).filter(Boolean))];
+  const getMaxSizeMB = (allowedPresets) => {
+    let maxMB = defaultMaxSizeMB;
+    const keys = allowedPresets?.length ? allowedPresets : Object.keys(mergedPresets);
+    for (const key of keys) {
+      const p = mergedPresets[key];
+      if (p?.maxSizeMB && p.maxSizeMB > maxMB) maxMB = p.maxSizeMB;
+    }
+    return maxMB;
+  };
+  const cleanupVariantsFor = async (bucket, basePath) => {
+    const key = `${bucket}:${basePath}`;
+    const knownVariantPaths = trackedVariants.get(key);
+    trackedVariants.delete(key);
+    await deleteStoredVariants({
+      storage,
+      bucket,
+      basePath,
+      mirrorDirs: getMirrorDirs(),
+      knownVariantPaths,
+      candidateWidths: collectCandidateVariantWidths(mergedPresets, observedWidths)
+    });
+  };
+  return {
+    defaultBucket,
+    resolvePreset,
+    getAllowedBuckets,
+    getMaxSizeMB,
+    parseUrl: (url) => storage.parseUrl ? storage.parseUrl(url) : null,
+    async processBuffer(buffer, procOptions = {}) {
+      return semaphore.run(
+        () => processImageBuffer(buffer, {
+          maxDimensions: defaultMaxDimensions,
+          optimizationTimeoutMs,
+          blurTimeoutMs,
+          includeBlurHash: defaultIncludeBlurHash,
+          limitInputPixels: defaultLimitInputPixels,
+          effort: defaultEffort,
+          ...procOptions
+        }),
+        { signal: procOptions.signal }
+      );
+    },
+    async uploadImage(input, uploadOptions = {}) {
+      const presetConfig = resolvePreset(uploadOptions.preset);
+      if (uploadOptions.preset && !presetConfig) {
+        throw new UploadValidationError(`Invalid preset "${uploadOptions.preset}".`);
+      }
+      const bucket = uploadOptions.bucket || presetConfig?.bucket || defaultBucket;
+      const folder = uploadOptions.folder ?? presetConfig?.folder ?? defaultFolder;
+      const maxSizeMB = uploadOptions.maxSizeMB ?? presetConfig?.maxSizeMB ?? defaultMaxSizeMB;
+      const allowSvg = uploadOptions.allowSvg ?? presetConfig?.allowSvg ?? defaultAllowSvg;
+      const explicitAllowSvg = Boolean(
+        uploadOptions.allowSvg ?? presetConfig?.allowSvg ?? (defaultAllowSvg && !uploadOptions.allowedFormats && !presetConfig?.allowedFormats)
+      );
+      const allowedFormats = resolveEffectiveAllowedFormats(
+        uploadOptions.allowedFormats ?? presetConfig?.allowedFormats ?? defaultAllowedFormats,
+        allowSvg,
+        explicitAllowSvg
+      );
+      const maxDimensions = uploadOptions.maxDimensions ?? presetConfig?.maxDimensions ?? defaultMaxDimensions;
+      const outputFormat = uploadOptions.outputFormat ?? presetConfig?.outputFormat;
+      const quality = uploadOptions.quality ?? presetConfig?.quality;
+      const includeBlurHash = uploadOptions.includeBlurHash ?? presetConfig?.includeBlurHash ?? defaultIncludeBlurHash;
+      const limitInputPixels = uploadOptions.limitInputPixels ?? presetConfig?.limitInputPixels ?? defaultLimitInputPixels;
+      const variantWidths = uploadOptions.variantWidths ?? presetConfig?.variantWidths;
+      const isWebFile = typeof input.arrayBuffer === "function";
+      if (isWebFile) {
+        const pre = validateImageFileStrict({ size: input.size, type: input.type }, maxSizeMB, allowedFormats);
+        if (!pre.valid) throw new UploadValidationError(pre.error);
+      }
+      try {
+        let originalBuffer = isWebFile ? Buffer.from(await input.arrayBuffer()) : input.buffer;
+        if (!originalBuffer || originalBuffer.length === 0) throw new UploadValidationError("File is empty");
+        const validation = validateImageFileStrict({ size: originalBuffer.length, type: input.type }, maxSizeMB, allowedFormats);
+        if (!validation.valid) throw new UploadValidationError(validation.error);
+        const sniffed = assertMagicBytesAllowed(originalBuffer, allowedFormats, allowSvg);
+        if (sniffed.format === "svg") originalBuffer = sanitizeSvg(originalBuffer);
+        const { optimized, blurData, contentHash, originalSize } = await semaphore.run(
+          () => processImageBuffer(originalBuffer, {
+            maxDimensions,
+            outputFormat,
+            quality,
+            includeBlurHash,
+            optimizationTimeoutMs,
+            blurTimeoutMs,
+            limitInputPixels,
+            effort: defaultEffort,
+            allowSvg,
+            signal: uploadOptions.signal
+          }),
+          { signal: uploadOptions.signal }
+        );
+        const mainFormat = optimized.format;
+        const { uploadResult, storageTarget } = await uploadWithCollisionRetry({
+          storage,
+          buildPath,
+          pathContext: {
+            bucket,
+            folder,
+            preset: uploadOptions.preset,
+            format: mainFormat,
+            extension: formatToExtension(mainFormat),
+            customFilename: uploadOptions.customFilename,
+            isClientFilename: uploadOptions.isClientFilename,
+            contentHash,
+            originalName: input.name,
+            metadata: uploadOptions.metadata
+          },
+          data: optimized.buffer,
+          contentType: mainFormat === "svg" ? SVG_MIME_TYPE : `image/${mainFormat}`
+        });
+        const resolvedUrl = await mirrorBufferLocally({
+          buffer: optimized.buffer,
+          filename: storageTarget.filename,
+          storagePath: uploadResult.path,
+          fallbackUrl: uploadResult.url,
+          mirrorDir: presetConfig?.mirrorDir,
+          publicUrlBase: presetConfig?.publicUrlBase
+        });
+        const { variants, srcSet } = variantWidths?.length && mainFormat !== "svg" ? await semaphore.run(
+          () => generateImageVariants({
+            sourceBuffer: originalBuffer,
+            format: mainFormat,
+            quality: optimized.quality ?? quality,
+            effort: defaultEffort,
+            limitInputPixels,
+            mainWidth: optimized.width,
+            mainHeight: optimized.height,
+            mainUrl: resolvedUrl,
+            baseStoragePath: uploadResult.path,
+            baseFilename: storageTarget.filename,
+            bucket: storageTarget.bucket,
+            storage,
+            variantWidths,
+            upsert: Boolean(uploadOptions.customFilename) && !uploadOptions.isClientFilename,
+            contentHash,
+            metadata: uploadOptions.metadata,
+            mirrorDir: presetConfig?.mirrorDir,
+            publicUrlBase: presetConfig?.publicUrlBase
+          }),
+          { signal: uploadOptions.signal }
+        ) : { variants: [], srcSet: void 0 };
+        const variantPaths = variants.map((v) => v.storagePath).filter(Boolean);
+        if (variantPaths.length > 0) {
+          trackedVariants.set(`${storageTarget.bucket}:${uploadResult.path}`, variantPaths);
+          variants.forEach((v) => observedWidths.add(v.width));
+        }
+        const result = {
+          url: resolvedUrl,
+          blurDataUrl: blurData.dataURL,
+          blurColor: blurData.color,
+          ...blurData.blurHash && { blurHash: blurData.blurHash },
+          altText: uploadOptions.altText || "",
+          width: optimized.width,
+          height: optimized.height,
+          format: optimized.format,
+          size: optimized.size,
+          originalSize,
+          contentHash,
+          storagePath: uploadResult.path,
+          bucket: storageTarget.bucket,
+          ...uploadOptions.preset && { preset: uploadOptions.preset },
+          ...folder && { folder },
+          ...uploadOptions.metadata && { metadata: uploadOptions.metadata },
+          ...variants.length > 0 && { variants },
+          ...srcSet && { srcSet },
+          uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        const record = { ...result, quality: optimized.quality ?? quality ?? 85 };
+        await invokeRecordHookWithRollback({
+          onUploadRecord,
+          awaitRecordHook,
+          record,
+          storage,
+          bucket: storageTarget.bucket,
+          mainPath: uploadResult.path,
+          variantPaths,
+          mirrorDirs: getMirrorDirs(),
+          onError
+        });
+        return result;
+      } catch (error) {
+        if (error instanceof UploadValidationError || error instanceof SemaphoreQueueFullError) {
+          throw error;
+        }
+        throw new Error(`Image upload failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+      }
+    },
+    async deleteImage(targetPath, bucket) {
+      const targetBucket = bucket || defaultBucket;
+      try {
+        await storage.delete(targetBucket, targetPath);
+        await deleteMirroredFiles(getMirrorDirs(), targetPath);
+        await cleanupVariantsFor(targetBucket, targetPath);
+      } catch (error) {
+        throw new Error(`Image deletion failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+      }
+    },
+    async deleteByUrl(url) {
+      const parsed = storage.parseUrl?.(url);
+      const deleted = storage.deleteByUrl ? await storage.deleteByUrl(url) : false;
+      if (deleted && parsed?.path) {
+        await deleteMirroredFiles(getMirrorDirs(), parsed.path);
+        await cleanupVariantsFor(parsed.bucket || defaultBucket, parsed.path);
+      }
+      return deleted;
+    }
+  };
+}
+export {
+  AsyncSemaphore,
+  BLUR_PLACEHOLDER_FALLBACK_WIDTH,
+  BLUR_PLACEHOLDER_MAX_CHARS,
+  BLUR_PLACEHOLDER_QUALITY,
+  BLUR_PLACEHOLDER_WIDTH,
+  DEFAULT_LIMIT_INPUT_PIXELS,
+  DEFAULT_MAX_SVG_BYTES,
+  EDGE_COLOR_FALLBACK,
+  EDGE_WHITE_FALLBACK,
+  PRIMARY_AVIF_EFFORT,
+  RETRY_AVIF_EFFORT,
+  SemaphoreQueueFullError,
+  UploadValidationError,
+  WHITE_DOMINANCE_RATIO,
+  assertMagicBytesAllowed,
+  blendEdgeColors,
+  buildVariantStoragePath,
+  computeEdgeColorSet,
+  createDefaultPathGenerator,
+  createImageUploader,
+  createUploadHandler,
+  createUploadHttpHandler,
+  encodeBlurHashString,
+  extractEdgeColorsFromBuffer,
+  extractEnhancedColorFromBuffer,
+  formatToExtension,
+  generateBlurHash,
+  generateBlurPlaceholder,
+  generateImageVariants,
+  isClientValidationError,
+  isCollisionError,
+  mirrorBufferLocally,
+  optimizeImage,
+  processImageBuffer,
+  sanitizeSegment,
+  sanitizeSvg,
+  sniffImageFormat,
+  uploadWithCollisionRetry,
+  withTimeout
+};
+//# sourceMappingURL=server.js.map