zuro-cli 0.0.2-beta.14 → 0.0.2-beta.16

package/dist/index.mjs

@@ -1,11 +1,14 @@
 #!/usr/bin/env node
 import {
+  detectInstalledDatabaseDialect,
   ensureSchemaExport,
+  getDatabaseSelection,
   isDatabaseModule,
+  isDrizzleDatabaseModule,
   parseDatabaseDialect,
   printDatabaseHints,
   promptDatabaseConfig
-} from "./chunk-W36ZIR4Y.mjs";
+} from "./chunk-R3MGV5UR.mjs";
 import {
   injectDocsRoutes,
   isDocsModuleInstalled,
@@ -342,6 +345,22 @@ var ENV_CONFIGS = {
       { name: "DATABASE_URL", schema: "z.string().url()" }
     ]
   },
+  "database-prisma-pg": {
+    envVars: {
+      DATABASE_URL: "postgresql://postgres@localhost:5432/mydb"
+    },
+    schemaFields: [
+      { name: "DATABASE_URL", schema: "z.string().url()" }
+    ]
+  },
+  "database-prisma-mysql": {
+    envVars: {
+      DATABASE_URL: "mysql://root@localhost:3306/mydb"
+    },
+    schemaFields: [
+      { name: "DATABASE_URL", schema: "z.string().url()" }
+    ]
+  },
   auth: {
     envVars: {
       BETTER_AUTH_SECRET: "your-secret-key-at-least-32-characters-long",
@@ -408,6 +427,19 @@ function sanitizeConfig(input) {
   if (typeof raw.srcDir === "string") {
     config.srcDir = raw.srcDir;
   }
+  if (raw.database && typeof raw.database === "object") {
+    const dbRaw = raw.database;
+    const database = {};
+    if (dbRaw.orm === "drizzle" || dbRaw.orm === "prisma") {
+      database.orm = dbRaw.orm;
+    }
+    if (dbRaw.dialect === "postgresql" || dbRaw.dialect === "mysql") {
+      database.dialect = dbRaw.dialect;
+    }
+    if (database.orm || database.dialect) {
+      config.database = database;
+    }
+  }
   return config;
 }
 function getConfigPath(cwd) {
@@ -741,8 +773,8 @@ ${chalk2.bold("Retry:")}`);
 
 // src/commands/add.ts
 import ora2 from "ora";
-import path10 from "path";
-import fs9 from "fs-extra";
+import path11 from "path";
+import fs10 from "fs-extra";
 import { randomBytes } from "crypto";
 
 // src/utils/dependency.ts
@@ -769,9 +801,17 @@ var resolveDependencies = async (moduleDependencies, cwd) => {
   const srcDir = config?.srcDir || "src";
   for (const dep of moduleDependencies) {
     if (dep === "database") {
+      const configuredOrm = config?.database?.orm;
+      const configuredDialect = config?.database?.dialect;
       const pgExists = fs5.existsSync(path5.join(cwd, srcDir, BLOCK_SIGNATURES["database-pg"]));
       const mysqlExists = fs5.existsSync(path5.join(cwd, srcDir, BLOCK_SIGNATURES["database-mysql"]));
-      if (pgExists || mysqlExists) {
+      const prismaSchemaExists = fs5.existsSync(path5.join(cwd, "prisma", "schema.prisma"));
+      const hasDbFiles = pgExists || mysqlExists || prismaSchemaExists;
+      const hasDbConfig = Boolean(configuredOrm && configuredDialect);
+      if (hasDbConfig && hasDbFiles) {
+        continue;
+      }
+      if (!hasDbConfig && hasDbFiles) {
         continue;
       }
       console.log(chalk3.blue(`\u2139 Dependency '${dep}' is missing. Triggering install...`));
@@ -802,7 +842,7 @@ function resolveSafeTargetPath2(projectRoot, srcDir, file) {
 }
 
 // src/commands/add.ts
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 
 // src/handlers/auth.handler.ts
 import path7 from "path";
@@ -1035,8 +1075,8 @@ async function promptAuthConfig(projectRoot, srcDir, options) {
       shouldInstallDocsForAuth = docsResponse.installDocs;
     }
   }
-  const { detectInstalledDatabaseDialect } = await import("./database.handler-D7EVXRJX.mjs");
-  const authDatabaseDialect = await detectInstalledDatabaseDialect(projectRoot, srcDir);
+  const { detectInstalledDatabaseDialect: detectInstalledDatabaseDialect2 } = await import("./database.handler-5OUD6XJZ.mjs");
+  const authDatabaseDialect = await detectInstalledDatabaseDialect2(projectRoot, srcDir);
   return { shouldInstallDocsForAuth, authDatabaseDialect };
 }
 function printAuthHints(generatedAuthSecret) {
@@ -1267,15 +1307,513 @@ app.use(rateLimiter);` + content.slice(insertAt);
   return true;
 }
 
+// src/handlers/uploads.handler.ts
+import path10 from "path";
+import fs9 from "fs-extra";
+import prompts4 from "prompts";
+import chalk6 from "chalk";
+var UPLOAD_PRESETS = {
+  image: {
+    mimeTypes: ["image/jpeg", "image/png", "image/webp", "image/gif"],
+    maxFileSize: 5 * 1024 * 1024,
+    maxFiles: 1
+  },
+  document: {
+    mimeTypes: [
+      "application/pdf",
+      "text/plain",
+      "application/msword",
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+    ],
+    maxFileSize: 10 * 1024 * 1024,
+    maxFiles: 3
+  },
+  video: {
+    mimeTypes: ["video/mp4", "video/quicktime", "video/webm"],
+    maxFileSize: 100 * 1024 * 1024,
+    maxFiles: 1
+  }
+};
+function getUploadEnvSchemaFields(provider) {
+  const shared = [
+    { name: "UPLOAD_PROVIDER", schema: `z.enum(["s3", "r2", "cloudinary"])` },
+    { name: "UPLOAD_MODE", schema: `z.enum(["proxy", "direct", "large"])` },
+    { name: "UPLOAD_AUTH_MODE", schema: `z.enum(["required", "none"])` },
+    { name: "UPLOAD_FILE_ACCESS", schema: `z.enum(["private", "public"])` },
+    { name: "UPLOAD_FILE_PRESET", schema: `z.enum(["image", "document", "video"])` },
+    { name: "UPLOAD_KEY_PREFIX", schema: "z.string().min(1)" },
+    { name: "UPLOAD_ALLOWED_MIME", schema: "z.string().min(1)" },
+    { name: "UPLOAD_MAX_FILE_SIZE", schema: "z.coerce.number().positive()" },
+    { name: "UPLOAD_MAX_FILES", schema: "z.coerce.number().int().positive()" },
+    { name: "UPLOAD_DIRECT_URL_TTL_SECONDS", schema: "z.coerce.number().int().positive().default(900)" },
+    { name: "UPLOAD_ACCESS_URL_TTL_SECONDS", schema: "z.coerce.number().int().positive().default(300)" },
+    { name: "UPLOAD_MULTIPART_PART_SIZE", schema: "z.coerce.number().int().positive().default(5242880)" }
+  ];
+  if (provider === "cloudinary") {
+    return [
+      ...shared,
+      { name: "CLOUDINARY_CLOUD_NAME", schema: "z.string().min(1)" },
+      { name: "CLOUDINARY_API_KEY", schema: "z.string().min(1)" },
+      { name: "CLOUDINARY_API_SECRET", schema: "z.string().min(1)" },
+      { name: "CLOUDINARY_FOLDER", schema: 'z.string().min(1).default("uploads")' },
+      { name: "CLOUDINARY_UPLOAD_PRESET", schema: 'z.string().default("")' }
+    ];
+  }
+  return [
+    ...shared,
+    { name: "UPLOAD_BUCKET", schema: "z.string().min(1)" },
+    { name: "UPLOAD_REGION", schema: "z.string().min(1)" },
+    { name: "UPLOAD_ENDPOINT", schema: 'z.string().default("")' },
+    { name: "UPLOAD_ACCESS_KEY_ID", schema: "z.string().min(1)" },
+    { name: "UPLOAD_SECRET_ACCESS_KEY", schema: "z.string().min(1)" },
+    { name: "UPLOAD_PUBLIC_BASE_URL", schema: 'z.string().default("")' }
+  ];
+}
+async function isAuthInstalled(projectRoot, srcDir) {
+  return fs9.pathExists(path10.join(projectRoot, srcDir, "lib", "auth.ts"));
+}
+function hasDrizzleDatabase(config) {
+  return config?.database?.orm === "drizzle";
+}
+function getProviderEnvDefaults(provider) {
+  if (provider === "cloudinary") {
+    return {
+      CLOUDINARY_CLOUD_NAME: "your-cloud-name",
+      CLOUDINARY_API_KEY: "your-api-key",
+      CLOUDINARY_API_SECRET: "your-api-secret",
+      CLOUDINARY_FOLDER: "uploads",
+      CLOUDINARY_UPLOAD_PRESET: ""
+    };
+  }
+  return {
+    UPLOAD_BUCKET: `your-${provider}-bucket`,
+    UPLOAD_REGION: provider === "r2" ? "auto" : "us-east-1",
+    UPLOAD_ENDPOINT: provider === "r2" ? "https://<account-id>.r2.cloudflarestorage.com" : "",
+    UPLOAD_ACCESS_KEY_ID: "your-access-key-id",
+    UPLOAD_SECRET_ACCESS_KEY: "your-secret-access-key",
+    UPLOAD_PUBLIC_BASE_URL: ""
+  };
+}
+function buildSharedEnvVars(provider, mode, authMode, access, preset, maxFileSize, maxFiles) {
+  return {
+    UPLOAD_PROVIDER: provider,
+    UPLOAD_MODE: mode,
+    UPLOAD_AUTH_MODE: authMode,
+    UPLOAD_FILE_ACCESS: access,
+    UPLOAD_FILE_PRESET: preset,
+    UPLOAD_KEY_PREFIX: "uploads",
+    UPLOAD_ALLOWED_MIME: UPLOAD_PRESETS[preset].mimeTypes.join(","),
+    UPLOAD_MAX_FILE_SIZE: String(maxFileSize),
+    UPLOAD_MAX_FILES: String(maxFiles),
+    UPLOAD_DIRECT_URL_TTL_SECONDS: "900",
+    UPLOAD_ACCESS_URL_TTL_SECONDS: "300",
+    UPLOAD_MULTIPART_PART_SIZE: "5242880"
+  };
+}
+async function promptUploadsConfig(projectRoot, srcDir) {
+  const projectConfig = await readZuroConfig(projectRoot);
+  const authInstalled = await isAuthInstalled(projectRoot, srcDir);
+  const drizzleInstalled = hasDrizzleDatabase(projectConfig);
+  const initial = await prompts4([
+    {
+      type: "select",
+      name: "provider",
+      message: "Which upload provider?",
+      choices: [
+        { title: "S3", value: "s3" },
+        { title: "R2", value: "r2" },
+        { title: "Cloudinary", value: "cloudinary" }
+      ],
+      initial: 0
+    },
+    {
+      type: "select",
+      name: "mode",
+      message: "Which upload mode?",
+      choices: [
+        { title: "Proxy", description: "API server receives the file and uploads it", value: "proxy" },
+        { title: "Direct", description: "Client uploads directly with signed params/URLs", value: "direct" },
+        { title: "Large", description: "Multipart upload flow for large files", value: "large" }
+      ],
+      initial: 1
+    },
+    {
+      type: "select",
+      name: "authMode",
+      message: "Who can upload?",
+      choices: [
+        { title: "Authenticated only", value: "required" },
+        { title: "Public", value: "none" }
+      ],
+      initial: authInstalled ? 0 : 1
+    },
+    {
+      type: "select",
+      name: "access",
+      message: "How should uploaded files be accessed?",
+      choices: [
+        { title: "Private", value: "private" },
+        { title: "Public", value: "public" }
+      ],
+      initial: 0
+    },
+    {
+      type: "select",
+      name: "preset",
+      message: "Which file preset?",
+      choices: [
+        { title: "Image", value: "image" },
+        { title: "Document", value: "document" },
+        { title: "Video", value: "video" }
+      ],
+      initial: 0
+    }
+  ]);
+  if (initial.provider === void 0) {
+    console.log(chalk6.yellow("Operation cancelled."));
+    return null;
+  }
+  const provider = initial.provider;
+  const mode = initial.mode;
+  const authMode = initial.authMode;
+  const access = initial.access;
+  const preset = initial.preset;
+  if (provider === "cloudinary" && mode === "large") {
+    console.log(chalk6.yellow("\nCloudinary large multipart scaffolding is not available in this module yet."));
+    console.log(chalk6.yellow("Use S3 or R2 for large uploads, or pick Proxy/Direct for Cloudinary.\n"));
+    return null;
+  }
+  if (provider === "cloudinary" && preset === "document") {
+    const warning = await prompts4({
+      type: "confirm",
+      name: "continue",
+      message: "Cloudinary is media-first. Continue with Cloudinary for non-media/general files?",
+      initial: false
+    });
+    if (!warning.continue) {
+      console.log(chalk6.yellow("Operation cancelled."));
+      return null;
+    }
+  }
+  const presetDefaults = UPLOAD_PRESETS[preset];
+  let useDatabaseMetadata = false;
+  let shouldInstallDatabase = false;
+  const metadataPrompt = await prompts4({
+    type: "confirm",
+    name: "metadata",
+    message: drizzleInstalled ? "Store upload metadata in your database?" : "Install database and store upload metadata?",
+    initial: true
+  });
+  if (metadataPrompt.metadata === void 0) {
+    console.log(chalk6.yellow("Operation cancelled."));
+    return null;
+  }
+  if (metadataPrompt.metadata === true) {
+    useDatabaseMetadata = true;
+    if (!projectConfig?.database) {
+      shouldInstallDatabase = true;
+    } else if (!drizzleInstalled) {
+      console.log(chalk6.yellow("\nUploads metadata currently supports Drizzle-based database setups only."));
+      console.log(chalk6.yellow("Install or switch to a Drizzle database, or continue without metadata.\n"));
+      return null;
+    }
+  }
+  if (access === "private" && !useDatabaseMetadata) {
+    const warning = await prompts4({
+      type: "confirm",
+      name: "continue",
+      message: "Private uploads work best with metadata. Continue without database tracking?",
+      initial: false
+    });
+    if (!warning.continue) {
+      console.log(chalk6.yellow("Operation cancelled."));
+      return null;
+    }
+  }
+  let shouldInstallAuth = false;
+  if (authMode !== "none" && !authInstalled) {
+    const authPrompt = await prompts4({
+      type: "confirm",
+      name: "installAuth",
+      message: "Uploads auth requires the auth module. Install auth now?",
+      initial: true
+    });
+    if (!authPrompt.installAuth) {
+      console.log(chalk6.yellow("Operation cancelled."));
+      return null;
+    }
+    shouldInstallAuth = true;
+  }
+  return {
+    provider,
+    mode,
+    authMode,
+    access,
+    preset,
+    useDatabaseMetadata,
+    shouldInstallAuth,
+    shouldInstallDatabase,
+    envVars: {
+      ...buildSharedEnvVars(provider, mode, authMode, access, preset, presetDefaults.maxFileSize, presetDefaults.maxFiles),
+      ...getProviderEnvDefaults(provider)
+    }
+  };
+}
+async function injectUploadsRoutes(projectRoot, srcDir) {
+  const routeIndexPath = path10.join(projectRoot, srcDir, "routes", "index.ts");
+  const routeImport = `import uploadsRoutes from "./uploads.routes";`;
+  const routeMountPattern = /rootRouter\.use\(\s*["']\/uploads["']\s*,\s*uploadsRoutes\s*\)/;
+  if (await fs9.pathExists(routeIndexPath)) {
+    let routeContent = await fs9.readFile(routeIndexPath, "utf-8");
+    let routeModified = false;
+    const importResult = appendImport(routeContent, routeImport);
+    if (!importResult.inserted) {
+      return false;
+    }
+    if (importResult.source !== routeContent) {
+      routeContent = importResult.source;
+      routeModified = true;
+    }
+    if (!routeMountPattern.test(routeContent)) {
+      const routeSetup = `
+// Upload routes
+rootRouter.use("/uploads", uploadsRoutes);
+`;
+      const exportMatch = routeContent.match(/export default rootRouter;?\s*$/m);
+      if (!exportMatch || exportMatch.index === void 0) {
+        return false;
+      }
+      routeContent = routeContent.slice(0, exportMatch.index) + routeSetup + "\n" + routeContent.slice(exportMatch.index);
+      routeModified = true;
+    }
+    if (routeModified) {
+      await fs9.writeFile(routeIndexPath, routeContent);
+    }
+    return true;
+  }
+  const appPath = path10.join(projectRoot, srcDir, "app.ts");
+  if (!await fs9.pathExists(appPath)) {
+    return false;
+  }
+  let appContent = await fs9.readFile(appPath, "utf-8");
+  let appModified = false;
+  const appImportResult = appendImport(appContent, `import uploadsRoutes from "./routes/uploads.routes";`);
+  if (!appImportResult.inserted) {
+    return false;
+  }
+  if (appImportResult.source !== appContent) {
+    appContent = appImportResult.source;
+    appModified = true;
+  }
+  const hasMount = /app\.use\(\s*["']\/api\/uploads["']\s*,\s*uploadsRoutes\s*\)/.test(appContent);
+  if (!hasMount) {
+    const setup = `
+// Upload routes
+app.use("/api/uploads", uploadsRoutes);
+`;
+    const exportMatch = appContent.match(/export default app;?\s*$/m);
+    if (!exportMatch || exportMatch.index === void 0) {
+      return false;
+    }
+    appContent = appContent.slice(0, exportMatch.index) + setup + "\n" + appContent.slice(exportMatch.index);
+    appModified = true;
+  }
+  if (appModified) {
+    await fs9.writeFile(appPath, appContent);
+  }
+  return true;
+}
+async function isUploadsModuleInstalled(projectRoot, srcDir) {
+  return fs9.pathExists(path10.join(projectRoot, srcDir, "routes", "uploads.routes.ts"));
+}
+async function detectInstalledUploadsMode(projectRoot) {
+  const envPath = path10.join(projectRoot, ".env");
+  if (!await fs9.pathExists(envPath)) {
+    return null;
+  }
+  const content = await fs9.readFile(envPath, "utf-8");
+  const match = content.match(/^UPLOAD_MODE=(proxy|direct|large)$/m);
+  if (!match) {
+    return null;
+  }
+  return match[1];
+}
+async function injectUploadsDocs(projectRoot, srcDir, mode) {
+  const openApiPath = path10.join(projectRoot, srcDir, "lib", "openapi.ts");
+  if (!await fs9.pathExists(openApiPath)) {
+    return false;
+  }
+  const marker = "// ZURO_UPLOADS_DOCS";
+  let content = await fs9.readFile(openApiPath, "utf-8");
+  if (content.includes(marker)) {
+    return true;
+  }
+  const moduleDocsEndMarker = "// ZURO_DOCS_MODULES_END";
+  if (!content.includes(moduleDocsEndMarker)) {
+    return false;
+  }
+  const commonBlock = `
+const uploadAccessSchema = z.object({
+    key: z.string().openapi({ example: "uploads/users/user_123/2026/03/06/example.png" }),
+    resourceType: z.string().optional().openapi({ example: "image" }),
+    providerAssetId: z.string().optional().openapi({ example: "uploads/users/user_123/example" }),
+});
+
+`;
+  const directBlock = mode === "direct" ? `registry.registerPath({
+    method: "post",
+    path: "/api/uploads/presign",
+    tags: ["Uploads"],
+    summary: "Create a signed direct upload request",
+    request: {
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        originalName: z.string().min(1),
+                        mimeType: z.string().min(1),
+                        bytes: z.number().positive(),
+                    }),
+                },
+            },
+        },
+    },
+    responses: {
+        200: { description: "Signed upload created" },
+    },
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/api/uploads/complete",
+    tags: ["Uploads"],
+    summary: "Finalize a direct upload and persist metadata",
+    responses: {
+        201: { description: "Upload finalized" },
+    },
+});
+` : "";
+  const proxyBlock = mode === "proxy" ? `registry.registerPath({
+    method: "post",
+    path: "/api/uploads",
+    tags: ["Uploads"],
+    summary: "Upload a file through the API server",
+    responses: {
+        201: { description: "File uploaded" },
+    },
+});
+` : "";
+  const largeBlock = mode === "large" ? `registry.registerPath({
+    method: "post",
+    path: "/api/uploads/multipart/init",
+    tags: ["Uploads"],
+    summary: "Start a multipart upload session",
+    responses: {
+        200: { description: "Multipart upload initialized" },
+    },
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/api/uploads/multipart/complete",
+    tags: ["Uploads"],
+    summary: "Complete a multipart upload",
+    responses: {
+        201: { description: "Multipart upload completed" },
+    },
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/api/uploads/multipart/abort",
+    tags: ["Uploads"],
+    summary: "Abort a multipart upload",
+    responses: {
+        204: { description: "Multipart upload aborted" },
+    },
+});
+` : "";
+  const sharedOps = `registry.registerPath({
+    method: "post",
+    path: "/api/uploads/access-url",
+    tags: ["Uploads"],
+    summary: "Create an access URL for an uploaded file",
+    request: {
+        body: {
+            content: {
+                "application/json": {
+                    schema: uploadAccessSchema,
+                },
+            },
+        },
+    },
+    responses: {
+        200: { description: "Access URL generated" },
+    },
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/api/uploads",
+    tags: ["Uploads"],
+    summary: "Delete an uploaded file",
+    request: {
+        body: {
+            content: {
+                "application/json": {
+                    schema: uploadAccessSchema,
+                },
+            },
+        },
+    },
+    responses: {
+        204: { description: "Upload deleted" },
+    },
+});
+`;
+  const block = `
+${commonBlock}${marker}
+${proxyBlock}${directBlock}${largeBlock}${sharedOps}`;
+  content = content.replace(moduleDocsEndMarker, `${block}
+${moduleDocsEndMarker}`);
+  const tagInsert = /(\{\s*name:\s*"Auth".+\},\s*\n\s*\],)/;
+  if (tagInsert.test(content) && !content.includes(`{ name: "Uploads", description: "File uploads and asset access" }`)) {
+    content = content.replace(
+      tagInsert,
+      `{ name: "Auth", description: "Authentication and session endpoints" },
+            { name: "Uploads", description: "File uploads and asset access" },
+        ],`
+    );
+  }
+  await fs9.writeFile(openApiPath, content);
+  return true;
+}
+function printUploadHints(result) {
+  console.log(chalk6.yellow("\u2139 Upload routes are mounted at: /api/uploads"));
+  console.log(chalk6.yellow(`\u2139 Provider: ${result.provider} \xB7 Mode: ${result.mode} \xB7 Access: ${result.access}`));
+  console.log(chalk6.yellow("\u2139 Fill the generated upload env vars in .env before testing uploads."));
+  if (result.mode === "proxy") {
+    console.log(chalk6.yellow("\u2139 Reuse uploadSingle()/uploadArray() from src/lib/uploads/proxy.ts in your own form + file routes."));
+  }
+  if (result.provider === "r2") {
+    console.log(chalk6.yellow("\u2139 R2 presigned URLs use the R2 S3 API endpoint, not your custom domain."));
+  }
+  if (result.useDatabaseMetadata) {
+    console.log(chalk6.yellow("\u2139 Upload metadata is stored in db/schema/uploads.ts."));
+  } else {
+    console.log(chalk6.yellow("\u2139 No upload metadata table was added. Private file ownership checks fall back to key prefixes."));
+  }
+}
+
 // src/commands/add.ts
 function resolvePackageManager(projectRoot) {
-  if (fs9.existsSync(path10.join(projectRoot, "pnpm-lock.yaml"))) {
+  if (fs10.existsSync(path11.join(projectRoot, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (fs9.existsSync(path10.join(projectRoot, "bun.lockb")) || fs9.existsSync(path10.join(projectRoot, "bun.lock"))) {
+  if (fs10.existsSync(path11.join(projectRoot, "bun.lockb")) || fs10.existsSync(path11.join(projectRoot, "bun.lock"))) {
     return "bun";
   }
-  if (fs9.existsSync(path10.join(projectRoot, "yarn.lock"))) {
+  if (fs10.existsSync(path11.join(projectRoot, "yarn.lock"))) {
     return "yarn";
   }
   return "npm";
@@ -1287,16 +1825,16 @@ function getModuleDocsPath(moduleName) {
   return moduleName;
 }
 async function hasEnvVariable(projectRoot, key) {
-  const envPath = path10.join(projectRoot, ".env");
-  if (!await fs9.pathExists(envPath)) {
+  const envPath = path11.join(projectRoot, ".env");
+  if (!await fs10.pathExists(envPath)) {
     return false;
   }
-  const content = await fs9.readFile(envPath, "utf-8");
+  const content = await fs10.readFile(envPath, "utf-8");
   const pattern = new RegExp(`^${escapeRegex(key)}=`, "m");
   return pattern.test(content);
 }
 async function isLikelyEmptyDirectory(cwd) {
-  const entries = await fs9.readdir(cwd);
+  const entries = await fs10.readdir(cwd);
   const ignored = /* @__PURE__ */ new Set([".ds_store", "thumbs.db"]);
   return entries.filter((entry) => !ignored.has(entry.toLowerCase())).length === 0;
 }
@@ -1320,16 +1858,22 @@ var add = async (moduleName, options = {}) => {
   let customDbUrl;
   let usedDefaultDbUrl = false;
   let databaseBackupPath = null;
+  let selectedDatabaseOrm = null;
+  let selectedDatabaseDialect = null;
   let generatedAuthSecret = false;
   let authDatabaseDialect = null;
   let customSmtpVars;
   let usedDefaultSmtp = false;
   let mailerProvider = "smtp";
   let shouldInstallDocsForAuth = false;
+  let uploadConfig = null;
+  let uploadDatabaseDialect = null;
   if (resolvedModuleName === "database" || isDatabaseModule(resolvedModuleName)) {
     const result = await promptDatabaseConfig(resolvedModuleName, projectRoot, srcDir);
     if (!result) return;
     resolvedModuleName = result.resolvedModuleName;
+    selectedDatabaseOrm = result.selectedOrm;
+    selectedDatabaseDialect = result.selectedDialect;
     customDbUrl = result.customDbUrl;
     usedDefaultDbUrl = result.usedDefaultDbUrl;
     databaseBackupPath = result.databaseBackupPath;
@@ -1347,6 +1891,10 @@ var add = async (moduleName, options = {}) => {
     shouldInstallDocsForAuth = result.shouldInstallDocsForAuth;
     authDatabaseDialect = result.authDatabaseDialect;
   }
+  if (resolvedModuleName === "uploads") {
+    uploadConfig = await promptUploadsConfig(projectRoot, srcDir);
+    if (!uploadConfig) return;
+  }
   const pm = resolvePackageManager(projectRoot);
   const spinner = ora2(`Checking registry for ${resolvedModuleName}...`).start();
   let currentStep = "package manager preflight";
@@ -1361,10 +1909,46 @@ var add = async (moduleName, options = {}) => {
       spinner.fail(`Module '${resolvedModuleName}' not found.`);
       return;
     }
-    spinner.succeed(`Found module: ${chalk6.cyan(resolvedModuleName)}`);
+    spinner.succeed(`Found module: ${chalk7.cyan(resolvedModuleName)}`);
     const moduleDeps = module.moduleDependencies || [];
     currentStep = "module dependency resolution";
     await resolveDependencies(moduleDeps, projectRoot);
+    if (resolvedModuleName === "uploads" && uploadConfig) {
+      const errorHandlerInstalled = fs10.existsSync(path11.join(projectRoot, srcDir, "lib", "errors.ts"));
+      if (!errorHandlerInstalled) {
+        console.log(chalk7.blue("\n\u2139 Uploads needs the error-handler module. Installing error-handler..."));
+        await add("error-handler");
+      }
+      if (uploadConfig.shouldInstallDatabase) {
+        console.log(chalk7.blue("\n\u2139 Upload metadata needs a Drizzle database. Installing database module..."));
+        await add("database");
+      }
+      if (uploadConfig.shouldInstallAuth) {
+        console.log(chalk7.blue("\n\u2139 Upload auth needs the auth module. Installing auth module..."));
+        await add("auth", { yes: true });
+      }
+      uploadDatabaseDialect = await detectInstalledDatabaseDialect(projectRoot, srcDir);
+      if (uploadConfig.useDatabaseMetadata) {
+        if (uploadDatabaseDialect === "database-prisma-pg" || uploadDatabaseDialect === "database-prisma-mysql") {
+          spinner.fail("Uploads metadata currently supports Drizzle-based database setup only.");
+          console.log(chalk7.yellow("\u2139 Install a Drizzle database, or rerun uploads without metadata."));
+          return;
+        }
+        if (!uploadDatabaseDialect) {
+          spinner.fail("Could not detect a database setup for uploads metadata.");
+          console.log(chalk7.yellow("\u2139 Install the database module first, then rerun uploads."));
+          return;
+        }
+      }
+    }
+    if (resolvedModuleName === "auth") {
+      authDatabaseDialect = await detectInstalledDatabaseDialect(projectRoot, srcDir);
+      if (authDatabaseDialect === "database-prisma-pg" || authDatabaseDialect === "database-prisma-mysql") {
+        spinner.fail("Auth module currently supports Drizzle-based database setup only.");
+        console.log(chalk7.yellow("\u2139 Install auth after switching database ORM to Drizzle."));
+        return;
+      }
+    }
     currentStep = "dependency installation";
     spinner.start("Installing dependencies...");
     let runtimeDeps = module.dependencies || [];
@@ -1378,6 +1962,15 @@ var add = async (moduleName, options = {}) => {
         devDeps = ["@types/nodemailer"];
       }
     }
+    if (resolvedModuleName === "uploads" && uploadConfig) {
+      runtimeDeps = ["multer"];
+      devDeps = ["@types/multer"];
+      if (uploadConfig.provider === "cloudinary") {
+        runtimeDeps.push("cloudinary");
+      } else {
+        runtimeDeps.push("@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner");
+      }
+    }
     await installDependencies(pm, runtimeDeps, projectRoot);
     await installDependencies(pm, devDeps, projectRoot, { dev: true });
     spinner.succeed("Dependencies installed");
@@ -1397,12 +1990,37 @@ var add = async (moduleName, options = {}) => {
         expectedSha256 = void 0;
         expectedSize = void 0;
       }
+      if (resolvedModuleName === "uploads" && uploadConfig) {
+        if (file.target === "lib/uploads/provider.ts") {
+          fetchPath = uploadConfig.provider === "cloudinary" ? "express/lib/uploads/provider.cloudinary.ts" : "express/lib/uploads/provider.s3.ts";
+          expectedSha256 = void 0;
+          expectedSize = void 0;
+        }
+        if (file.target === "lib/uploads/metadata.ts") {
+          fetchPath = uploadConfig.useDatabaseMetadata ? "express/lib/uploads/metadata.db.ts" : "express/lib/uploads/metadata.noop.ts";
+          expectedSha256 = void 0;
+          expectedSize = void 0;
+        }
+        if (file.target === "middleware/upload-auth.ts") {
+          fetchPath = `express/middleware/upload-auth.${uploadConfig.authMode}.ts`;
+          expectedSha256 = void 0;
+          expectedSize = void 0;
+        }
+        if (file.target === "db/schema/uploads.ts") {
+          if (!uploadConfig.useDatabaseMetadata) {
+            continue;
+          }
+          fetchPath = uploadDatabaseDialect === "database-mysql" ? "express/db/schema/uploads.mysql.ts" : "express/db/schema/uploads.ts";
+          expectedSha256 = void 0;
+          expectedSize = void 0;
+        }
+      }
       let content = await fetchFile(fetchPath, {
         baseUrl: registryContext.fileBaseUrl,
         expectedSha256,
         expectedSize
       });
-      if (isDatabaseModule(resolvedModuleName) && file.target === "../drizzle.config.ts") {
+      if (isDrizzleDatabaseModule(resolvedModuleName) && file.target === "../drizzle.config.ts") {
         const normalizedSrcDir = srcDir.replace(/\\/g, "/");
         content = content.replace(
           /schema:\s*["'][^"']+["']/,
@@ -1410,10 +2028,10 @@ var add = async (moduleName, options = {}) => {
         );
       }
       const targetPath = resolveSafeTargetPath2(projectRoot, srcDir, file);
-      await fs9.ensureDir(path10.dirname(targetPath));
-      await fs9.writeFile(targetPath, content);
+      await fs10.ensureDir(path11.dirname(targetPath));
+      await fs10.writeFile(targetPath, content);
     }
-    const schemaExports = module.files.map((file) => file.target.replace(/\\/g, "/")).filter((target) => /^db\/schema\/[^/]+\.ts$/.test(target)).map((target) => path10.posix.basename(target, ".ts")).filter((name) => name !== "index");
+    const schemaExports = module.files.map((file) => file.target.replace(/\\/g, "/")).filter((target) => /^db\/schema\/[^/]+\.ts$/.test(target)).map((target) => path11.posix.basename(target, ".ts")).filter((name) => name !== "index");
     for (const schemaFileName of schemaExports) {
       await ensureSchemaExport(projectRoot, srcDir, schemaFileName);
     }
@@ -1473,6 +2091,38 @@ var add = async (moduleName, options = {}) => {
           spinner.warn("Could not update API docs automatically");
         }
       }
+      const uploadsInstalled = await isUploadsModuleInstalled(projectRoot, srcDir);
+      if (uploadsInstalled) {
+        const uploadMode = await detectInstalledUploadsMode(projectRoot);
+        if (uploadMode) {
+          spinner.start("Adding uploads endpoints to API docs...");
+          const uploadsDocsInjected = await injectUploadsDocs(projectRoot, srcDir, uploadMode);
+          if (uploadsDocsInjected) {
+            spinner.succeed("Uploads endpoints added to API docs");
+          } else {
+            spinner.warn("Could not update API docs automatically");
+          }
+        }
+      }
+    }
+    if (resolvedModuleName === "uploads" && uploadConfig) {
+      spinner.start("Configuring upload routes...");
+      const injected = await injectUploadsRoutes(projectRoot, srcDir);
+      if (injected) {
+        spinner.succeed("Upload routes configured");
+      } else {
+        spinner.warn("Could not configure upload routes automatically");
+      }
+      const docsInstalled = await isDocsModuleInstalled(projectRoot, srcDir);
+      if (docsInstalled) {
+        spinner.start("Adding uploads endpoints to API docs...");
+        const docsInjected = await injectUploadsDocs(projectRoot, srcDir, uploadConfig.mode);
+        if (docsInjected) {
+          spinner.succeed("Uploads endpoints added to API docs");
+        } else {
+          spinner.warn("Could not update API docs automatically");
+        }
+      }
     }
     let envConfigKey = resolvedModuleName;
     if (resolvedModuleName === "mailer" && mailerProvider === "resend") {
@@ -1502,12 +2152,34 @@ var add = async (moduleName, options = {}) => {
       await updateEnvSchema(projectRoot, srcDir, envConfig.schemaFields);
       spinner.succeed("Environment configured");
     }
-    console.log(chalk6.green(`
+    if (resolvedModuleName === "uploads" && uploadConfig) {
+      currentStep = "environment configuration";
+      spinner.start("Updating environment configuration...");
+      await updateEnvFile(projectRoot, uploadConfig.envVars, true);
+      await updateEnvSchema(projectRoot, srcDir, getUploadEnvSchemaFields(uploadConfig.provider));
+      spinner.succeed("Environment configured");
+    }
+    if (isDatabaseModule(resolvedModuleName)) {
+      const selected = getDatabaseSelection(resolvedModuleName);
+      const orm = selectedDatabaseOrm ?? selected.orm;
+      const dialect = selectedDatabaseDialect ?? selected.dialect;
+      const latestConfig = await readZuroConfig(projectRoot);
+      if (latestConfig) {
+        await writeZuroConfig(projectRoot, {
+          ...latestConfig,
+          database: {
+            orm,
+            dialect
+          }
+        });
+      }
+    }
+    console.log(chalk7.green(`
 \u2714 ${resolvedModuleName} added successfully!
 `));
     const docsPath = getModuleDocsPath(resolvedModuleName);
     const docsUrl = `https://zuro-cli.devbybriyan.com/docs/${docsPath}`;
-    console.log(chalk6.blue(`\u2139 Docs: ${docsUrl}`));
+    console.log(chalk7.blue(`\u2139 Docs: ${docsUrl}`));
     if (isDatabaseModule(resolvedModuleName)) {
       printDatabaseHints(resolvedModuleName, customDbUrl, usedDefaultDbUrl, databaseBackupPath);
     }
@@ -1520,17 +2192,20 @@ var add = async (moduleName, options = {}) => {
     if (resolvedModuleName === "docs") {
       printDocsHints();
     }
+    if (resolvedModuleName === "uploads" && uploadConfig) {
+      printUploadHints(uploadConfig);
+    }
     if (resolvedModuleName === "auth" && shouldInstallDocsForAuth) {
-      console.log(chalk6.blue("\n\u2139 Installing API docs module..."));
+      console.log(chalk7.blue("\n\u2139 Installing API docs module..."));
       await add("docs", { yes: true });
     }
   } catch (error) {
-    spinner.fail(chalk6.red(`Failed during ${currentStep}.`));
+    spinner.fail(chalk7.red(`Failed during ${currentStep}.`));
     const errorMessage = error instanceof Error ? error.message : String(error);
-    console.error(chalk6.red(errorMessage));
+    console.error(chalk7.red(errorMessage));
     console.log(`
-${chalk6.bold("Retry:")}`);
-    console.log(chalk6.cyan(`  npx zuro-cli add ${resolvedModuleName}`));
+${chalk7.bold("Retry:")}`);
+    console.log(chalk7.cyan(`  npx zuro-cli add ${resolvedModuleName}`));
   }
 };