img-upload-kit 1.1.1 → 2.0.1

package/dist/storage.js

@@ -1,14 +1,41 @@
-import fs from 'fs/promises';
-import path from 'path';
+import {
+  createMemoryStorageAdapter,
+  createStorageAdapter,
+  toPaginatedListResult,
+  validateStorageMetadata
+} from "./chunk-MHGQEBPW.js";
+import {
+  DEFAULT_PUBLIC_STORAGE_PREFIX,
+  parsePublicStorageUrl
+} from "./chunk-S2IFAWJK.js";
 
 // src/storage/localFsAdapter.ts
+import fs from "fs/promises";
+import path from "path";
 function sanitizeRelativePath(inputPath) {
+  if (!inputPath || typeof inputPath !== "string") {
+    throw new Error("Invalid storage path");
+  }
+  if (inputPath.includes(":") || inputPath.includes("\0")) {
+    throw new Error("Path traversal blocked in LocalFsStorageAdapter");
+  }
   const normalized = inputPath.replace(/\\/g, "/").replace(/^\/+/, "");
-  const parts = normalized.split("/").filter((segment) => segment && segment !== "." && segment !== "..");
-  if (parts.length === 0) {
+  const rawSegments = normalized.split("/").filter(Boolean);
+  if (rawSegments.length === 0) {
     throw new Error("Invalid storage path");
   }
-  return parts.join("/");
+  for (const segment of rawSegments) {
+    if (segment === "." || segment === "..") {
+      throw new Error("Invalid storage path: path traversal blocked");
+    }
+  }
+  return rawSegments.join("/");
+}
+function assertContainedInRoot(resolvedRoot, targetPath) {
+  const relative = path.relative(resolvedRoot, targetPath);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error("Path traversal blocked in LocalFsStorageAdapter");
+  }
 }
 function createLocalFsStorageAdapter(options) {
   const resolvedRoot = path.resolve(options.rootDir);
@@ -19,35 +46,78 @@ function createLocalFsStorageAdapter(options) {
     const cleanRel = sanitizeRelativePath(relativePath);
     const subPath = includeBucket ? `${cleanBucket}/${cleanRel}` : cleanRel;
     const diskPath = path.resolve(resolvedRoot, subPath);
-    if (!diskPath.startsWith(resolvedRoot)) {
-      throw new Error("Path traversal blocked in LocalFsStorageAdapter");
-    }
+    assertContainedInRoot(resolvedRoot, diskPath);
     return { diskPath, subPath, cleanRel };
   };
   const getPublicUrl = (bucket, relativePath) => {
     const { subPath } = resolveDiskTarget(bucket, relativePath);
     return `${baseUrl}/${subPath}`;
   };
+  const parseUrl = (url) => {
+    if (!url || typeof url !== "string") return null;
+    try {
+      const cleanUrl = url.split(/[?#]/)[0];
+      const prefix = `${baseUrl}/`;
+      let subPath = null;
+      if (cleanUrl.startsWith(prefix)) {
+        subPath = cleanUrl.slice(prefix.length);
+      } else if (baseUrl.startsWith("/")) {
+        const parsed = new URL(cleanUrl, "http://localhost");
+        const isLocal = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+        const isRelative = !cleanUrl.startsWith("http://") && !cleanUrl.startsWith("https://");
+        if ((isLocal || isRelative) && parsed.pathname.startsWith(prefix)) {
+          subPath = parsed.pathname.slice(prefix.length);
+        }
+      }
+      if (!subPath) return null;
+      const decoded = decodeURIComponent(subPath).replace(/\\/g, "/").replace(/^\/+/, "");
+      if (!decoded || decoded.includes(":") || decoded.includes("\0")) {
+        return null;
+      }
+      const segments = decoded.split("/").filter(Boolean);
+      if (segments.length === 0 || segments.includes("..") || segments.includes(".")) {
+        return null;
+      }
+      const diskPath = path.resolve(resolvedRoot, ...segments);
+      const relative = path.relative(resolvedRoot, diskPath);
+      if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        return null;
+      }
+      if (includeBucket) {
+        if (segments.length < 2) return null;
+        return {
+          bucket: segments[0],
+          path: segments.slice(1).join("/")
+        };
+      }
+      return { path: segments.join("/") };
+    } catch {
+      return null;
+    }
+  };
   return {
     async upload(params) {
       const { diskPath, cleanRel } = resolveDiskTarget(
         params.bucket,
         params.path
       );
-      if (params.upsert === false) {
-        try {
-          await fs.access(diskPath);
-          throw new Error(
+      await fs.mkdir(path.dirname(diskPath), { recursive: true });
+      try {
+        await fs.writeFile(
+          diskPath,
+          params.data,
+          params.upsert === false ? { flag: "wx" } : void 0
+        );
+      } catch (err) {
+        if (err.code === "EEXIST") {
+          const existsError = new Error(
             `File already exists at ${params.bucket}/${cleanRel}`
           );
-        } catch (err) {
-          if (err instanceof Error && err.message.includes("File already exists")) {
-            throw err;
-          }
+          existsError.code = "EEXIST";
+          throw existsError;
         }
+        throw err;
       }
-      await fs.mkdir(path.dirname(diskPath), { recursive: true });
-      await fs.writeFile(diskPath, params.data);
       return {
         bucket: params.bucket,
         path: cleanRel,
@@ -64,42 +134,31 @@ function createLocalFsStorageAdapter(options) {
         }
       }
     },
+    async exists(bucket, relativePath) {
+      try {
+        const { diskPath } = resolveDiskTarget(bucket, relativePath);
+        const stat = await fs.stat(diskPath);
+        return stat.isFile();
+      } catch {
+        return false;
+      }
+    },
     getPublicUrl,
+    parseUrl,
     async deleteByUrl(url) {
-      if (!url || typeof url !== "string") return false;
+      const parsed = parseUrl(url);
+      if (!parsed) return false;
       try {
-        const cleanUrl = url.split(/[?#]/)[0];
-        const prefix = `${baseUrl}/`;
-        let subPath = null;
-        if (cleanUrl.startsWith(prefix)) {
-          subPath = cleanUrl.slice(prefix.length);
-        } else if (baseUrl.startsWith("/")) {
-          const parsed = new URL(cleanUrl, "http://localhost");
-          const isLocal = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
-          const isRelative = !cleanUrl.startsWith("http://") && !cleanUrl.startsWith("https://");
-          if ((isLocal || isRelative) && parsed.pathname.startsWith(prefix)) {
-            subPath = parsed.pathname.slice(prefix.length);
-          }
-        }
-        if (!subPath) return false;
-        const decoded = decodeURIComponent(subPath).replace(/\\/g, "/").replace(/^\/+/, "");
-        if (!decoded) return false;
-        const segments = decoded.split("/").filter(Boolean);
-        if (segments.length === 0 || segments.includes("..") || segments.includes(".")) {
-          return false;
-        }
-        const diskPath = path.resolve(resolvedRoot, ...segments);
-        const relative = path.relative(resolvedRoot, diskPath);
-        if (relative.startsWith("..") || path.isAbsolute(relative)) {
-          return false;
-        }
+        const subSegments = includeBucket && parsed.bucket ? [parsed.bucket, ...parsed.path.split("/")] : parsed.path.split("/");
+        const diskPath = path.resolve(resolvedRoot, ...subSegments);
+        assertContainedInRoot(resolvedRoot, diskPath);
         await fs.unlink(diskPath);
         return true;
       } catch {
         return false;
       }
     },
-    async list(bucket, folder) {
+    async list(bucket, folder, listOptions) {
       const cleanBucket = sanitizeRelativePath(bucket);
       const cleanFolder = folder ? sanitizeRelativePath(folder) : "";
       const targetDir = path.resolve(
@@ -107,9 +166,7 @@ function createLocalFsStorageAdapter(options) {
         includeBucket ? cleanBucket : "",
         cleanFolder
       );
-      if (!targetDir.startsWith(resolvedRoot)) {
-        throw new Error("Path traversal blocked in LocalFsStorageAdapter");
-      }
+      assertContainedInRoot(resolvedRoot, targetDir);
       try {
         const dirEntries = await fs.readdir(targetDir, { withFileTypes: true });
         const results = [];
@@ -124,10 +181,14 @@ function createLocalFsStorageAdapter(options) {
             size: stat.size
           });
         }
-        return results;
+        const offset = listOptions?.cursor ? Number(listOptions.cursor) || 0 : 0;
+        const limit = listOptions?.limit ?? results.length;
+        const sliced = listOptions?.limit !== void 0 || offset > 0 ? results.slice(offset, offset + limit) : results;
+        const nextCursor = listOptions?.limit !== void 0 && offset + sliced.length < results.length ? String(offset + sliced.length) : void 0;
+        return toPaginatedListResult(sliced, nextCursor);
       } catch (err) {
         if (err.code === "ENOENT") {
-          return [];
+          return toPaginatedListResult([]);
         }
         throw err;
       }
@@ -135,83 +196,6 @@ function createLocalFsStorageAdapter(options) {
   };
 }
 
-// src/storage/memoryAdapter.ts
-function createMemoryStorageAdapter(options = {}) {
-  const baseUrl = (options.baseUrl || "https://memory.local/uploads").replace(
-    /\/+$/,
-    ""
-  );
-  const store = /* @__PURE__ */ new Map();
-  const toKey = (bucket, path2) => `${bucket}::${path2.replace(/^\/+/, "")}`;
-  const getPublicUrl = (bucket, path2) => {
-    const cleanPath = path2.replace(/^\/+/, "");
-    return `${baseUrl}/${bucket}/${cleanPath}`;
-  };
-  return {
-    async upload(params) {
-      const cleanPath = params.path.replace(/^\/+/, "");
-      const key = toKey(params.bucket, cleanPath);
-      if (params.upsert === false && store.has(key)) {
-        throw new Error(`Object already exists at ${params.bucket}/${cleanPath}`);
-      }
-      store.set(key, {
-        bucket: params.bucket,
-        path: cleanPath,
-        data: new Uint8Array(params.data),
-        contentType: params.contentType,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        metadata: params.metadata
-      });
-      return {
-        bucket: params.bucket,
-        path: cleanPath,
-        url: getPublicUrl(params.bucket, cleanPath)
-      };
-    },
-    async delete(bucket, path2) {
-      const key = toKey(bucket, path2);
-      store.delete(key);
-    },
-    getPublicUrl,
-    async list(bucket, folder) {
-      const cleanFolder = folder ? folder.replace(/^\/+|\/+$/g, "") : "";
-      const entries = [];
-      for (const obj of store.values()) {
-        if (obj.bucket !== bucket) continue;
-        if (cleanFolder && !obj.path.startsWith(`${cleanFolder}/`)) continue;
-        const name = cleanFolder ? obj.path.slice(cleanFolder.length + 1) : obj.path;
-        entries.push({
-          name,
-          id: `${obj.bucket}/${obj.path}`,
-          createdAt: obj.createdAt,
-          size: obj.data.byteLength
-        });
-      }
-      return entries;
-    },
-    async deleteByUrl(url) {
-      const prefix = `${baseUrl}/`;
-      if (!url.startsWith(prefix)) return false;
-      const rest = url.slice(prefix.length);
-      const slashIdx = rest.indexOf("/");
-      if (slashIdx === -1) return false;
-      const bucket = rest.slice(0, slashIdx);
-      const filePath = rest.slice(slashIdx + 1);
-      const key = toKey(bucket, filePath);
-      return store.delete(key);
-    },
-    getObject(bucket, path2) {
-      return store.get(toKey(bucket, path2));
-    },
-    clear() {
-      store.clear();
-    },
-    get size() {
-      return store.size;
-    }
-  };
-}
-
 // src/storage/s3Adapter.ts
 function normalizeS3Key(rawPath) {
   const normalized = rawPath.replace(/\\/g, "/").replace(/^\/+/, "");
@@ -224,6 +208,13 @@ function resolveTransport(options) {
   if ("putObject" in options && typeof options.putObject === "function") return options;
   throw new Error("S3StorageAdapter requires putObject/deleteObject or client/transport");
 }
+function isS3PreconditionError(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  const status = e.$metadata?.httpStatusCode ?? Number(e.statusCode);
+  const code = String(e.code ?? e.name ?? "").toLowerCase();
+  return status === 412 || code === "preconditionfailed" || code === "eexist";
+}
 function createS3StorageAdapter(options) {
   const transport = resolveTransport(options);
   const includeBucket = options.includeBucketInUrl !== false;
@@ -236,19 +227,34 @@ function createS3StorageAdapter(options) {
   return {
     async upload(params) {
       const key = normalizeS3Key(params.path);
-      const cacheControl = params.cacheControl ?? options.cacheControl ?? (params.contentType.includes("image/avif") ? "public, max-age=31536000, immutable" : "public, max-age=2592000, must-revalidate");
+      validateStorageMetadata(params.metadata);
+      const isImmutable = params.upsert === false && params.contentType.includes("image/avif");
+      const cacheControl = params.cacheControl ?? options.cacheControl ?? (isImmutable ? "public, max-age=31536000, immutable" : "public, max-age=2592000, must-revalidate");
       const metadata = params.metadata || params.contentHash ? {
-        ...params.contentHash ? { contentHash: params.contentHash } : {},
-        ...params.metadata
+        ...params.metadata,
+        ...params.contentHash ? { contentHash: params.contentHash } : {}
       } : void 0;
-      await transport.putObject({
-        Bucket: params.bucket,
-        Key: key,
-        Body: params.data,
-        ContentType: params.contentType,
-        ...cacheControl ? { CacheControl: cacheControl } : {},
-        ...metadata ? { Metadata: metadata } : {}
-      });
+      try {
+        await transport.putObject({
+          Bucket: params.bucket,
+          Key: key,
+          Body: params.data,
+          ContentType: params.contentType,
+          ...cacheControl ? { CacheControl: cacheControl } : {},
+          ...metadata ? { Metadata: metadata } : {},
+          ...params.upsert === false ? { IfNoneMatch: "*" } : {}
+        });
+      } catch (err) {
+        if (isS3PreconditionError(err)) {
+          const existsErr = new Error(
+            `Object already exists at ${params.bucket}/${key}`
+          );
+          existsErr.code = "EEXIST";
+          existsErr.statusCode = 412;
+          throw existsErr;
+        }
+        throw err;
+      }
       return {
         bucket: params.bucket,
         path: key,
@@ -258,17 +264,34 @@ function createS3StorageAdapter(options) {
     async delete(bucket, path2) {
       await transport.deleteObject({ Bucket: bucket, Key: normalizeS3Key(path2) });
     },
+    async exists(bucket, path2) {
+      const key = normalizeS3Key(path2);
+      if (transport.headObject) {
+        try {
+          await transport.headObject({ Bucket: bucket, Key: key });
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      const lastSlash = key.lastIndexOf("/");
+      const folder = lastSlash > 0 ? key.slice(0, lastSlash) : void 0;
+      const targetName = lastSlash > 0 ? key.slice(lastSlash + 1) : key;
+      const listed = await this.list(bucket, folder);
+      return listed.some((item) => item.name === targetName);
+    },
     getPublicUrl,
-    async list(bucket, folder) {
+    async list(bucket, folder, listOptions) {
       const cleanFolder = folder ? normalizeS3Key(folder).replace(/\/+$/, "") : "";
       const prefix = cleanFolder ? `${cleanFolder}/` : void 0;
       const input = {
         Bucket: bucket,
         ...prefix ? { Prefix: prefix } : {},
-        MaxKeys: 1e3
+        MaxKeys: listOptions?.limit ?? 1e3,
+        ...listOptions?.cursor ? { ContinuationToken: listOptions.cursor } : {}
       };
       const output = transport.listObjects ? await transport.listObjects(input) : transport.listObjectsV2 ? await transport.listObjectsV2(input) : void 0;
-      return (output?.Contents ?? []).filter((item) => Boolean(item.Key)).map((item) => {
+      const entries = (output?.Contents ?? []).filter((item) => Boolean(item.Key)).map((item) => {
         const name = prefix && item.Key.startsWith(prefix) ? item.Key.slice(prefix.length) : item.Key;
         const createdAt = item.LastModified instanceof Date ? item.LastModified.toISOString() : item.LastModified;
         return {
@@ -278,26 +301,38 @@ function createS3StorageAdapter(options) {
           ...item.Size !== void 0 ? { size: item.Size } : {}
         };
       }).filter((entry) => entry.name.length > 0);
+      return toPaginatedListResult(entries, output?.NextContinuationToken);
     },
-    async deleteByUrl(url) {
-      if (typeof options.publicBaseUrl !== "string" || !url) return false;
+    parseUrl(url) {
+      if (typeof options.publicBaseUrl !== "string" || !url) return null;
       const prefix = `${options.publicBaseUrl.replace(/\/+$/, "")}/`;
       const cleanUrl = url.split(/[?#]/)[0];
-      if (!cleanUrl.startsWith(prefix)) return false;
+      if (!cleanUrl.startsWith(prefix)) return null;
       try {
         const rest = decodeURIComponent(cleanUrl.slice(prefix.length)).replace(/^\/+/, "");
-        if (!rest) return false;
+        if (!rest) return null;
         if (includeBucket) {
           const slashIdx = rest.indexOf("/");
-          if (slashIdx <= 0 || slashIdx === rest.length - 1) return false;
-          await transport.deleteObject({
-            Bucket: rest.slice(0, slashIdx),
-            Key: rest.slice(slashIdx + 1)
-          });
-          return true;
+          if (slashIdx <= 0 || slashIdx === rest.length - 1) return null;
+          return {
+            bucket: rest.slice(0, slashIdx),
+            path: rest.slice(slashIdx + 1)
+          };
         }
-        if (!options.defaultBucket) return false;
-        await transport.deleteObject({ Bucket: options.defaultBucket, Key: rest });
+        if (!options.defaultBucket) return null;
+        return { bucket: options.defaultBucket, path: rest };
+      } catch {
+        return null;
+      }
+    },
+    async deleteByUrl(url) {
+      const parsed = this.parseUrl?.(url);
+      if (!parsed || !parsed.bucket) return false;
+      try {
+        await transport.deleteObject({
+          Bucket: parsed.bucket,
+          Key: parsed.path
+        });
         return true;
       } catch {
         return false;
@@ -306,52 +341,22 @@ function createS3StorageAdapter(options) {
   };
 }
 
-// src/storage/urlParser.ts
-var DEFAULT_PUBLIC_STORAGE_PREFIX = "/storage/v1/object/public/";
-function parsePublicStorageUrl(url, publicPrefix = DEFAULT_PUBLIC_STORAGE_PREFIX) {
-  if (!url) return null;
-  try {
-    const parsed = new URL(url, "http://localhost");
-    const pathname = parsed.pathname;
-    const prefixIndex = pathname.indexOf(publicPrefix);
-    if (prefixIndex === -1) {
-      return null;
-    }
-    const relativePath = pathname.slice(prefixIndex + publicPrefix.length).replace(/^\/+/, "");
-    const segments = relativePath.split("/").filter(Boolean);
-    if (segments.length < 2) {
-      return null;
-    }
-    const [bucket, ...pathParts] = segments;
-    const filePath = pathParts.join("/");
-    const filename = pathParts[pathParts.length - 1];
-    const lastDotIndex = filename.lastIndexOf(".");
-    const extension = lastDotIndex >= 0 ? filename.slice(lastDotIndex) : null;
-    return {
-      bucket,
-      path: filePath,
-      filename,
-      extension
-    };
-  } catch {
-    return null;
-  }
-}
-
 // src/storage/supabaseAdapter.ts
 function createSupabaseStorageAdapter(client, options = {}) {
   const publicPrefix = options.publicUrlPrefix || DEFAULT_PUBLIC_STORAGE_PREFIX;
   return {
     async upload(params) {
-      const cacheControl = params.cacheControl || (params.contentType.includes("image/avif") ? "public, max-age=31536000, immutable" : "public, max-age=2592000, must-revalidate");
+      validateStorageMetadata(params.metadata);
+      const isImmutable = params.upsert === false && params.contentType.includes("image/avif");
+      const cacheControl = params.cacheControl || (isImmutable ? "public, max-age=31536000, immutable" : "public, max-age=2592000, must-revalidate");
       const { data, error } = await client.storage.from(params.bucket).upload(params.path, params.data, {
         contentType: params.contentType,
         upsert: params.upsert === void 0 ? true : params.upsert,
         cacheControl,
         metadata: {
+          ...params.metadata,
           uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          contentHash: params.contentHash || "unknown",
-          ...params.metadata
+          contentHash: params.contentHash || "unknown"
         }
       });
       if (error || !data) {
@@ -374,41 +379,53 @@ function createSupabaseStorageAdapter(client, options = {}) {
         throw new Error(`Failed to delete from Supabase storage: ${error.message}`);
       }
     },
+    async exists(bucket, path2) {
+      const cleanPath = path2.replace(/^\/+/, "");
+      const lastSlash = cleanPath.lastIndexOf("/");
+      const folder = lastSlash > 0 ? cleanPath.slice(0, lastSlash) : void 0;
+      const targetName = lastSlash > 0 ? cleanPath.slice(lastSlash + 1) : cleanPath;
+      const entries = await this.list(bucket, folder);
+      return entries.some((entry) => entry.name === targetName);
+    },
     getPublicUrl(bucket, path2) {
       const {
         data: { publicUrl }
       } = client.storage.from(bucket).getPublicUrl(path2);
       return publicUrl;
     },
-    async list(bucket, folder) {
+    async list(bucket, folder, listOptions) {
       const bucketClient = client.storage.from(bucket);
       if (!bucketClient.list) {
-        return [];
+        return toPaginatedListResult([]);
       }
+      const limit = listOptions?.limit ?? 1e3;
+      const offset = listOptions?.cursor ? Number(listOptions.cursor) || 0 : 0;
       const { data, error } = await bucketClient.list(folder, {
-        limit: 1e3,
+        limit,
+        ...offset > 0 ? { offset } : {},
         sortBy: { column: "created_at", order: "desc" }
       });
       if (error) {
         throw new Error(`Failed to list Supabase bucket files: ${error.message}`);
       }
-      return (data || []).filter((f) => f.id !== null).map((f) => ({
+      const entries = (data || []).filter((f) => f.id !== null).map((f) => ({
         name: f.name,
         id: f.id ?? void 0,
         createdAt: f.created_at ?? void 0
       }));
+      const nextCursor = listOptions?.limit !== void 0 && entries.length >= limit ? String(offset + entries.length) : void 0;
+      return toPaginatedListResult(entries, nextCursor);
+    },
+    parseUrl(url) {
+      const info = parsePublicStorageUrl(url, publicPrefix);
+      if (!info) return null;
+      return { bucket: info.bucket, path: info.path };
     },
     async deleteByUrl(url) {
       const info = parsePublicStorageUrl(url, publicPrefix);
       if (!info) return false;
       try {
-        const targets = /* @__PURE__ */ new Set([info.path]);
-        if (info.extension?.toLowerCase() === ".avif") {
-          const basePath = info.path.slice(0, -info.extension.length);
-          targets.add(`${basePath}-blur${info.extension}`);
-          targets.add(`${basePath}-thumb${info.extension}`);
-        }
-        const { error } = await client.storage.from(info.bucket).remove([...targets]);
+        const { error } = await client.storage.from(info.bucket).remove([info.path]);
         return !error;
       } catch {
         return false;
@@ -416,12 +433,15 @@ function createSupabaseStorageAdapter(client, options = {}) {
     }
   };
 }
-
-// src/storage/types.ts
-function createStorageAdapter(adapter) {
-  return adapter;
-}
-
-export { DEFAULT_PUBLIC_STORAGE_PREFIX, createLocalFsStorageAdapter, createMemoryStorageAdapter, createS3StorageAdapter, createStorageAdapter, createSupabaseStorageAdapter, parsePublicStorageUrl };
-//# sourceMappingURL=storage.js.map
+export {
+  DEFAULT_PUBLIC_STORAGE_PREFIX,
+  createLocalFsStorageAdapter,
+  createMemoryStorageAdapter,
+  createS3StorageAdapter,
+  createStorageAdapter,
+  createSupabaseStorageAdapter,
+  parsePublicStorageUrl,
+  toPaginatedListResult,
+  validateStorageMetadata
+};
 //# sourceMappingURL=storage.js.map