qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/storage.mjs

@@ -0,0 +1,654 @@
+import { createError, getRequestURL, getRequestHeader, getQuery } from "nuxt/server";
+import { getR2Binding, parseByteSize } from "../../blob.mjs";
+import { getDevMockBlobStore } from "./blob-store.mjs";
+import { getQarpeoConfig, getSessionSecret } from "./config.mjs";
+import { getAuthContext } from "./context.mjs";
+export function getStorageConfig(event) {
+  const cfg = getQarpeoConfig(event);
+  return {
+    prefix: "/api/storage",
+    maxSize: "20MB",
+    allowedTypes: ["*"],
+    scope: "public",
+    defaultAccess: "public",
+    ...cfg.storage,
+    ...cfg.blob
+  };
+}
+export function parseDurationSeconds(duration) {
+  if (typeof duration === "number") return duration;
+  const match = duration.trim().match(/^(\d+(?:\.\d+)?)\s*(s|m|h|d|w)?$/i);
+  if (!match) return Number(duration) || 3600;
+  const num = parseFloat(match[1]);
+  const unit = (match[2] || "s").toLowerCase();
+  const multipliers = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800
+  };
+  return Math.round(num * (multipliers[unit] || 1));
+}
+export async function resolveStorageScopePrefix(event, config) {
+  const scope = config.scope || "public";
+  if (scope === "org") {
+    const authCtx = await getAuthContext(event);
+    const orgId = authCtx?.organization?.id || authCtx?.session?.currentOrganizationId;
+    if (!orgId) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: "Active organization required for organization-scoped storage"
+      });
+    }
+    return `org_${orgId}`;
+  }
+  if (scope === "user") {
+    const authCtx = await getAuthContext(event);
+    const userId = authCtx?.user?.id;
+    if (!userId) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: "Authentication required for user-scoped storage"
+      });
+    }
+    return `user_${userId}`;
+  }
+  return "public";
+}
+export function sanitizeFilename(filename) {
+  return filename.toLowerCase().replace(/[^\w.-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+export function validateStorageFile(file, config) {
+  const maxBytes = parseByteSize(config.maxSize || "20MB");
+  const fileSize = file.size ?? file.data.byteLength;
+  if (maxBytes > 0 && fileSize > maxBytes) {
+    throw createError({
+      statusCode: 413,
+      statusMessage: "Payload Too Large",
+      message: `File size (${fileSize} bytes) exceeds maximum allowed size of ${config.maxSize}`
+    });
+  }
+  const allowedTypes = config.allowedTypes || ["*"];
+  if (!allowedTypes.includes("*")) {
+    const fileType = (file.type || "application/octet-stream").toLowerCase();
+    const isAllowed = allowedTypes.some((pattern) => {
+      const lowerPattern = pattern.toLowerCase();
+      if (lowerPattern.endsWith("/*")) {
+        const prefix = lowerPattern.slice(0, -1);
+        return fileType.startsWith(prefix);
+      }
+      return fileType === lowerPattern;
+    });
+    if (!isAllowed) {
+      throw createError({
+        statusCode: 415,
+        statusMessage: "Unsupported Media Type",
+        message: `File type "${fileType}" is not allowed. Permitted types: ${allowedTypes.join(", ")}`
+      });
+    }
+  }
+}
+export async function uploadStorageFile(event, file, options = {}) {
+  const config = getStorageConfig(event);
+  validateStorageFile(file, config);
+  let key = options.key;
+  if (!key) {
+    const scopePrefix = await resolveStorageScopePrefix(event, config);
+    const rawName = file.filename || `file-${Date.now()}`;
+    const cleanName = sanitizeFilename(rawName);
+    const uniqueId = `${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
+    key = `${scopePrefix}/${uniqueId}-${cleanName}`;
+  }
+  key = key.replace(/^\/+/, "");
+  const contentType = file.type || "application/octet-stream";
+  const access = options.access || config.defaultAccess || "public";
+  const metadata = {
+    ...options.customMetadata,
+    access
+  };
+  try {
+    const r2 = getR2Binding("BLOB", event);
+    const r2Object = await r2.put(key, file.data, {
+      httpMetadata: {
+        contentType
+      },
+      customMetadata: metadata
+    });
+    const url = buildStorageUrl(event, key);
+    return {
+      key,
+      pathname: key,
+      url,
+      size: r2Object.size,
+      type: contentType,
+      etag: r2Object.etag,
+      access,
+      customMetadata: metadata
+    };
+  } catch (err) {
+    console.error("[qarpeo:storage] R2 upload failed:", err?.message || err);
+    const procEnv = globalThis.process?.env || {};
+    const isDev = Boolean(import.meta.dev || procEnv.NODE_ENV !== "production");
+    if (!isDev) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: "Internal Server Error",
+        message: `Failed to upload file to R2: ${err?.message || "Storage error"}`
+      });
+    }
+    const store = getDevMockBlobStore();
+    const rawData = file.data instanceof Uint8Array ? file.data : new Uint8Array(file.data);
+    const size = file.size ?? rawData.byteLength;
+    const uploaded = (/* @__PURE__ */ new Date()).toISOString();
+    const etag = `mock-${Date.now()}`;
+    store.set(key, {
+      key,
+      size,
+      contentType,
+      uploaded,
+      data: rawData,
+      access
+    });
+    const url = buildStorageUrl(event, key);
+    return {
+      key,
+      pathname: key,
+      url,
+      size,
+      type: contentType,
+      etag,
+      access,
+      customMetadata: metadata
+    };
+  }
+}
+export function buildStorageUrl(event, key, transform) {
+  const config = getStorageConfig(event);
+  const cleanKey = key.replace(/^\/+/, "");
+  let baseUrl = "";
+  if (config.cdnUrl) {
+    baseUrl = `${config.cdnUrl.replace(/\/$/, "")}/${cleanKey}`;
+  } else if (event) {
+    const reqUrl = getRequestURL(event);
+    const prefix = config.prefix || "/api/storage";
+    baseUrl = `${reqUrl.protocol}//${reqUrl.host}${prefix}/file/${cleanKey}`;
+  } else {
+    const prefix = config.prefix || "/api/storage";
+    baseUrl = `${prefix}/file/${cleanKey}`;
+  }
+  if (!transform) {
+    return baseUrl;
+  }
+  let appliedTransform = { ...transform };
+  if (transform.preset && config.images?.presets?.[transform.preset]) {
+    appliedTransform = {
+      ...config.images.presets[transform.preset],
+      ...transform
+    };
+  }
+  const cfOpts = [];
+  if (appliedTransform.width) cfOpts.push(`width=${appliedTransform.width}`);
+  if (appliedTransform.height) cfOpts.push(`height=${appliedTransform.height}`);
+  if (appliedTransform.quality) cfOpts.push(`quality=${appliedTransform.quality}`);
+  if (appliedTransform.format) cfOpts.push(`format=${appliedTransform.format}`);
+  if (appliedTransform.fit) cfOpts.push(`fit=${appliedTransform.fit}`);
+  if (cfOpts.length === 0) return baseUrl;
+  const useCfResizing = config.images?.resizing !== false;
+  if (useCfResizing) {
+    const cfParamStr = cfOpts.join(",");
+    try {
+      const parsed = new URL(baseUrl);
+      return `${parsed.origin}/cdn-cgi/image/${cfParamStr}${parsed.pathname}${parsed.search}`;
+    } catch {
+      const cleanPath = baseUrl.startsWith("/") ? baseUrl : `/${baseUrl}`;
+      return `/cdn-cgi/image/${cfParamStr}${cleanPath}`;
+    }
+  }
+  const params = new URLSearchParams();
+  if (appliedTransform.width) params.set("w", String(appliedTransform.width));
+  if (appliedTransform.height) params.set("h", String(appliedTransform.height));
+  if (appliedTransform.quality) params.set("q", String(appliedTransform.quality));
+  if (appliedTransform.format) params.set("f", appliedTransform.format);
+  if (appliedTransform.fit) params.set("fit", appliedTransform.fit);
+  const queryString = params.toString();
+  return queryString ? `${baseUrl}?${queryString}` : baseUrl;
+}
+export async function createPresignedUploadTicket(event, input) {
+  const config = getStorageConfig(event);
+  const scopePrefix = await resolveStorageScopePrefix(event, config);
+  const cleanName = sanitizeFilename(input.filename || "file");
+  const key = `${scopePrefix}/${Date.now()}-${crypto.randomUUID().slice(0, 8)}-${cleanName}`;
+  const access = input.access || config.defaultAccess || "public";
+  const durationSec = parseDurationSeconds(input.expiresIn || 900);
+  const expiresAt = Date.now() + durationSec * 1e3;
+  const secretKey = getSessionSecret(event);
+  const encoder = new TextEncoder();
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secretKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const payload = `${key}:${input.type}:${expiresAt}:${access}`;
+  const signatureBuffer = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(payload));
+  const signatureHex = Array.from(new Uint8Array(signatureBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const ticket = `${expiresAt}.${signatureHex}`;
+  const prefix = config.prefix || "/api/storage";
+  const uploadUrl = `${prefix}/upload?key=${encodeURIComponent(key)}&type=${encodeURIComponent(input.type)}&access=${access}&ticket=${ticket}`;
+  return {
+    key,
+    uploadUrl,
+    ticket,
+    expiresAt,
+    access
+  };
+}
+export async function verifyPresignedUploadTicket(event, key, type, ticket, access = "public") {
+  const [expiresAtStr, signatureHex] = ticket.split(".");
+  const expiresAt = Number(expiresAtStr);
+  if (!expiresAt || !signatureHex || Date.now() > expiresAt) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Presigned upload ticket has expired or is invalid"
+    });
+  }
+  const secretKey = getSessionSecret(event);
+  const encoder = new TextEncoder();
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secretKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const payloadWithAccess = `${key}:${type}:${expiresAt}:${access}`;
+  const sigBytes = new Uint8Array(
+    signatureHex.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || []
+  );
+  let isValid = await crypto.subtle.verify(
+    "HMAC",
+    cryptoKey,
+    sigBytes,
+    encoder.encode(payloadWithAccess)
+  );
+  if (!isValid) {
+    const legacyPayload = `${key}:${type}:${expiresAt}`;
+    isValid = await crypto.subtle.verify(
+      "HMAC",
+      cryptoKey,
+      sigBytes,
+      encoder.encode(legacyPayload)
+    );
+  }
+  if (!isValid) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Invalid ticket signature"
+    });
+  }
+  return true;
+}
+export async function createSignedBlobToken(event, key, options) {
+  const cleanKey = key.replace(/^\/+/, "");
+  const durationSec = parseDurationSeconds(options?.expiresIn || 3600);
+  const expiresAt = Date.now() + durationSec * 1e3;
+  const isDownload = options?.download ? 1 : 0;
+  const secretKey = getSessionSecret(event);
+  const encoder = new TextEncoder();
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secretKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const payload = `${cleanKey}:${expiresAt}:${isDownload}`;
+  const signatureBuffer = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(payload));
+  const signatureHex = Array.from(new Uint8Array(signatureBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const token = `${expiresAt}.${isDownload}.${signatureHex}`;
+  const config = getStorageConfig(event);
+  const prefix = config.prefix || "/api/storage";
+  const downloadParam = isDownload ? "&download=1" : "";
+  const url = `${prefix}/file/${cleanKey}?token=${token}${downloadParam}`;
+  return { token, expiresAt, url };
+}
+export async function verifySignedBlobToken(event, key, token) {
+  const cleanKey = key.replace(/^\/+/, "");
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Malformed signed file token"
+    });
+  }
+  const [expiresAtStr, downloadStr, signatureHex] = parts;
+  const expiresAt = Number(expiresAtStr);
+  const isDownload = downloadStr === "1";
+  if (!expiresAt || !signatureHex || Date.now() > expiresAt) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Signed file URL has expired"
+    });
+  }
+  const secretKey = getSessionSecret(event);
+  const encoder = new TextEncoder();
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secretKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const payload = `${cleanKey}:${expiresAt}:${isDownload ? 1 : 0}`;
+  const sigBytes = new Uint8Array(
+    signatureHex.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || []
+  );
+  const isValid = await crypto.subtle.verify(
+    "HMAC",
+    cryptoKey,
+    sigBytes,
+    encoder.encode(payload)
+  );
+  if (!isValid) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Invalid signed file token signature"
+    });
+  }
+  return { valid: true, download: isDownload };
+}
+export async function getDownloadUrl(event, key, options) {
+  const res = await createSignedBlobToken(event, key, {
+    expiresIn: options?.expiresIn,
+    download: options?.download ?? true
+  });
+  if (options?.filename) {
+    return `${res.url}&filename=${encodeURIComponent(options.filename)}`;
+  }
+  return res.url;
+}
+export async function deleteStorageFile(event, key) {
+  const cleanKey = key.replace(/^\/+/, "");
+  try {
+    const r2 = getR2Binding("BLOB", event);
+    await r2.delete(cleanKey);
+  } catch (err) {
+    console.error("[qarpeo:storage] R2 delete failed:", err?.message || err);
+    const procEnv = globalThis.process?.env || {};
+    const isDev = Boolean(import.meta.dev || procEnv.NODE_ENV !== "production");
+    if (!isDev) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: "Internal Server Error",
+        message: `Failed to delete file from R2: ${err?.message || "Storage error"}`
+      });
+    }
+    const store = getDevMockBlobStore();
+    store.delete(cleanKey);
+  }
+  return { success: true };
+}
+export async function listStorageFiles(event, options) {
+  const config = getStorageConfig(event);
+  try {
+    const r2 = getR2Binding("BLOB", event);
+    const result = await r2.list({
+      prefix: options?.prefix,
+      limit: options?.limit || 60,
+      cursor: options?.cursor
+    });
+    const prefix = config.prefix || "/api/storage";
+    let files = (result.objects || []).map((obj) => {
+      const url = `${prefix}/file/${obj.key}`;
+      const access = obj.customMetadata?.access || "public";
+      return {
+        key: obj.key,
+        size: obj.size,
+        uploaded: obj.uploaded ? new Date(obj.uploaded).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+        url,
+        pathname: obj.key,
+        access
+      };
+    });
+    if (options?.access) {
+      files = files.filter((f) => f.access === options.access);
+    }
+    return {
+      files,
+      cursor: result.truncated ? result.cursor : void 0,
+      truncated: Boolean(result.truncated)
+    };
+  } catch (err) {
+    console.error("[qarpeo:storage] R2 list failed:", err?.message || err);
+    const procEnv = globalThis.process?.env || {};
+    const isDev = Boolean(import.meta.dev || procEnv.NODE_ENV !== "production");
+    if (!isDev) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: "Internal Server Error",
+        message: `Failed to list files from R2: ${err?.message || "Storage error"}`
+      });
+    }
+    const store = getDevMockBlobStore();
+    const prefix = config.prefix || "/api/storage";
+    let files = Array.from(store.values()).filter((f) => !options?.prefix || f.key.startsWith(options.prefix)).map((item) => ({
+      key: item.key,
+      size: item.size,
+      uploaded: item.uploaded,
+      url: `${prefix}/file/${item.key}`,
+      pathname: item.key,
+      access: item.access || "public"
+    }));
+    if (options?.access) {
+      files = files.filter((f) => f.access === options.access);
+    }
+    const limit = options?.limit || 60;
+    return {
+      files: files.slice(0, limit),
+      truncated: false
+    };
+  }
+}
+export async function serveStorageFile(event, key) {
+  const cleanKey = key.replace(/^\/+/, "");
+  const query = getQuery(event);
+  const hasTransform = ["w", "h", "f", "fit", "q"].some(
+    (p) => query[p] !== void 0 && query[p] !== ""
+  );
+  if (hasTransform) {
+    const storageConfig = getStorageConfig(event);
+    if (storageConfig.cdnUrl && !query.token) {
+      const transform = {};
+      if (query.w) transform.width = Number(query.w);
+      if (query.h) transform.height = Number(query.h);
+      if (query.q) transform.quality = Number(query.q);
+      if (query.f) transform.format = String(query.f);
+      if (query.fit) transform.fit = String(query.fit);
+      const redirectUrl = buildStorageUrl(event, cleanKey, transform);
+      return new Response(null, {
+        status: 302,
+        headers: { Location: redirectUrl }
+      });
+    }
+  }
+  let object = null;
+  const rangeHeader = getRequestHeader(event, "range");
+  let r2Range = void 0;
+  let isRange = false;
+  if (rangeHeader && rangeHeader.startsWith("bytes=")) {
+    const rangeVal = rangeHeader.slice(6).trim();
+    const [startStr, endStr] = rangeVal.split("-");
+    const start = startStr ? parseInt(startStr, 10) : void 0;
+    const end = endStr ? parseInt(endStr, 10) : void 0;
+    if (start !== void 0 && end !== void 0 && !isNaN(start) && !isNaN(end) && end >= start) {
+      r2Range = { offset: start, length: end - start + 1 };
+      isRange = true;
+    } else if (start !== void 0 && !isNaN(start)) {
+      r2Range = { offset: start };
+      isRange = true;
+    } else if (end !== void 0 && !isNaN(end)) {
+      r2Range = { suffix: end };
+      isRange = true;
+    }
+  }
+  try {
+    const cfg = getQarpeoConfig(event);
+    const bindingName = cfg.blob?.binding || "BLOB";
+    const r2 = getR2Binding(bindingName, event);
+    object = await r2.get(cleanKey, r2Range ? { range: r2Range } : void 0).catch(() => null);
+  } catch (err) {
+    console.error("[qarpeo:storage] R2 retrieve failed:", err?.message || err);
+    const procEnv = globalThis.process?.env || {};
+    const isDev = Boolean(import.meta.dev || procEnv.NODE_ENV !== "production");
+    if (!isDev) {
+      throw createError({
+        statusCode: 500,
+        statusMessage: "Internal Server Error",
+        message: `Failed to retrieve file from R2: ${err?.message || "Storage error"}`
+      });
+    }
+    object = null;
+  }
+  if (!object) {
+    const procEnv = globalThis.process?.env || {};
+    const isDev = Boolean(import.meta.dev || procEnv.NODE_ENV !== "production");
+    if (isDev) {
+      const store = getDevMockBlobStore();
+      const devItem = store.get(cleanKey);
+      if (devItem && devItem.data) {
+        const query2 = getQuery(event);
+        const forceDownload2 = query2.download === "1" || query2.download === "true";
+        const rawFilename = query2.filename || cleanKey.split("/").pop() || "download";
+        const headers2 = {
+          "Content-Type": devItem.contentType || "application/octet-stream",
+          "Content-Length": String(devItem.data.byteLength),
+          "Accept-Ranges": "bytes",
+          "Cache-Control": "no-cache"
+        };
+        if (forceDownload2) {
+          headers2["Content-Disposition"] = `attachment; filename="${sanitizeFilename(rawFilename)}"`;
+        }
+        return new Response(devItem.data, { headers: headers2 });
+      }
+      if (cleanKey.endsWith(".png") || cleanKey.endsWith(".webp") || cleanKey.endsWith(".jpg") || cleanKey.endsWith(".jpeg") || cleanKey.endsWith(".svg")) {
+        const filename = cleanKey.split("/").pop() || cleanKey;
+        const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="600" height="400" viewBox="0 0 600 400" fill="none">
+          <rect width="600" height="400" fill="#0f172a"/>
+          <rect x="20" y="20" width="560" height="360" rx="12" fill="#1e293b" stroke="#334155" stroke-dasharray="8 8" stroke-width="2"/>
+          <circle cx="300" cy="180" r="48" fill="#0284c7" fill-opacity="0.2" stroke="#0284c7" stroke-width="3"/>
+          <path d="M284 196L296 172L308 188L316 178L328 196H284Z" fill="#38bdf8"/>
+          <circle cx="316" cy="164" r="6" fill="#38bdf8"/>
+          <text x="300" y="260" font-family="-apple-system, system-ui, sans-serif" font-size="16" font-weight="600" fill="#f8fafc" text-anchor="middle">${filename}</text>
+          <text x="300" y="285" font-family="-apple-system, system-ui, sans-serif" font-size="12" fill="#94a3b8" text-anchor="middle">Cloudflare R2 Dev Preview</text>
+        </svg>`;
+        return new Response(svg, {
+          headers: {
+            "Content-Type": "image/svg+xml",
+            "Accept-Ranges": "bytes",
+            "Cache-Control": "no-cache"
+          }
+        });
+      }
+    }
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Not Found",
+      message: `Storage file "${cleanKey}" not found`
+    });
+  }
+  const token = query.token;
+  const access = object.customMetadata?.access || "public";
+  let tokenVerified = null;
+  if (token) {
+    tokenVerified = await verifySignedBlobToken(event, cleanKey, token);
+  }
+  if (access === "private") {
+    if (!tokenVerified?.valid) {
+      const authCtx = await getAuthContext(event);
+      if (!authCtx?.user) {
+        throw createError({
+          statusCode: 401,
+          statusMessage: "Unauthorized",
+          message: `Authentication required to access private file "${cleanKey}"`
+        });
+      }
+      if (cleanKey.startsWith("user_")) {
+        const requiredUserId = cleanKey.split("/")[0].slice(5);
+        if (authCtx.user.id !== requiredUserId) {
+          throw createError({
+            statusCode: 403,
+            statusMessage: "Forbidden",
+            message: "You do not have permission to access this private file"
+          });
+        }
+      } else if (cleanKey.startsWith("org_")) {
+        const requiredOrgId = cleanKey.split("/")[0].slice(4);
+        const userOrgId = authCtx.organization?.id || authCtx.session?.currentOrganizationId;
+        if (userOrgId !== requiredOrgId) {
+          throw createError({
+            statusCode: 403,
+            statusMessage: "Forbidden",
+            message: "You do not have permission to access this organization file"
+          });
+        }
+      }
+    }
+  }
+  if (access === "unlisted") {
+    if (!tokenVerified?.valid) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: `Signed token is required to access unlisted file "${cleanKey}"`
+      });
+    }
+  }
+  const ifNoneMatch = getRequestHeader(event, "if-none-match");
+  if (ifNoneMatch && (ifNoneMatch === object.etag || ifNoneMatch === `W/"${object.etag}"`)) {
+    event.node?.res ? event.node.res.statusCode = 304 : event.status = 304;
+    return null;
+  }
+  const headers = {
+    ETag: object.etag,
+    "Content-Type": object.httpMetadata?.contentType || "application/octet-stream",
+    "Accept-Ranges": "bytes",
+    "Cache-Control": access === "public" ? object.httpMetadata?.cacheControl || "public, max-age=31536000, immutable" : "private, no-cache, no-store, must-revalidate"
+  };
+  if (isRange && !object.range) {
+    return new Response(null, {
+      status: 416,
+      headers: {
+        "Content-Range": `bytes */${object.size}`,
+        "Accept-Ranges": "bytes"
+      }
+    });
+  }
+  if (isRange && object.range) {
+    const offset = object.range.offset ?? 0;
+    const length = object.range.length ?? object.size;
+    const end = offset + length - 1;
+    headers["Content-Range"] = `bytes ${offset}-${end}/${object.size}`;
+    headers["Content-Length"] = String(length);
+    if (event.node?.res) event.node.res.statusCode = 206;
+    return new Response(object.body, { status: 206, headers });
+  }
+  headers["Content-Length"] = String(object.size);
+  const forceDownload = query.download === "1" || query.download === "true" || Boolean(tokenVerified?.download);
+  if (forceDownload) {
+    const rawFilename = query.filename || cleanKey.split("/").pop() || "download";
+    const safeFilename = sanitizeFilename(rawFilename);
+    headers["Content-Disposition"] = `attachment; filename="${safeFilename}"`;
+  } else if (object.httpMetadata?.contentDisposition) {
+    headers["Content-Disposition"] = object.httpMetadata.contentDisposition;
+  }
+  return new Response(object.body, { headers });
+}

package/dist/runtime/server/utils/tenant.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @file Tenant.ts Tier 2 Multi-Tenancy — Edge Tenant resolution and context management. Provides:
+ *
+ *   - resolveTenant(event) — resolution cascade (header → subdomain → custom domain cache → D1)
+ *   - getTenant(event) — returns current tenant or null
+ *   - useTenant(event) — returns current tenant or throws 404
+ *   - setTenant(event, tenant) — assigns tenant to H3 context
+ *   - getTenantBySlug(slug, event?)
+ *   - getTenantById(id, event?)
+ */
+import type { RequestEvent } from "nuxt/server";
+import type { TenantRecord } from "../../../types";
+/** Extract clean hostname without port. */
+export declare function extractHostname(event: RequestEvent): string;
+/** Check if host is a subdomain of rootDomains and return the subdomain slug. */
+export declare function extractSubdomain(host: string, rootDomains: string[]): string | null;
+/** Retrieve a tenant record by slug. */
+export declare function getTenantBySlug(slug: string, event?: RequestEvent): Promise<TenantRecord | null>;
+/** Retrieve a tenant record by ID. */
+export declare function getTenantById(id: string, event?: RequestEvent): Promise<TenantRecord | null>;
+/** Retrieve a tenant record linked to a given auth organization id. */
+export declare function getTenantByOrganization(orgId: string, event?: RequestEvent): Promise<TenantRecord | null>;
+/** Register or update a tenant in memory/DB. */
+export declare function saveTenant(tenant: TenantRecord, event?: RequestEvent): Promise<TenantRecord>;
+/** List all registered tenants (DB with memory fallback). */
+export declare function listTenants(event?: RequestEvent): Promise<TenantRecord[]>;
+/**
+ * Resolves the active tenant for an incoming HTTP request. Cascade order:
+ *
+ * 1. Explicit header override (e.g. `x-tenant-id`)
+ * 2. Subdomain check against configured `rootDomains`
+ * 3. Custom domain edge cache (Cloudflare KV lookup: `domain:<host>`)
+ * 4. Direct database lookup (fallback)
+ */
+export declare function resolveTenant(event: RequestEvent): Promise<TenantRecord | null>;
+/** Assign tenant to request context. */
+export declare function setTenant(event: RequestEvent, tenant: TenantRecord): void;
+/**
+ * Retrieve the resolved tenant for the current request context. Returns `null` if no tenant was
+ * matched.
+ */
+export declare function getTenant(event: RequestEvent): TenantRecord | null;
+/** Retrieve the active tenant or throw a 404 HTTP error. */
+export declare function useTenant(event: RequestEvent): TenantRecord;