import "../../../../../base64-CmWvODNW.mjs";
import "../../../../../types-CuW0zWDA.mjs";
import { r as handleError, t as apiError } from "../../../../../error-CkAseSqZ.mjs";

//#region src/astro/routes/api/media/file/[...key].ts
const prerender = false;
/**
* Content types that are safe to display inline (simple raster/vector images, video, audio).
* Everything else gets Content-Disposition: attachment to prevent script execution.
*/
const SAFE_INLINE_TYPES = new Set([
	"image/jpeg",
	"image/png",
	"image/gif",
	"image/webp",
	"image/avif",
	"image/x-icon",
	"video/mp4",
	"video/webm",
	"audio/mpeg",
	"audio/wav",
	"audio/ogg"
]);
const GET = async ({ params, locals }) => {
	const { key } = params;
	const { emdash } = locals;
	if (!key) return apiError("NOT_FOUND", "File not found", 404);
	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
	try {
		const result = await emdash.storage.download(key);
		const headers = {
			"Content-Type": result.contentType,
			"Cache-Control": "public, max-age=31536000, immutable",
			"X-Content-Type-Options": "nosniff",
			"Content-Security-Policy": "sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'"
		};
		if (result.size) headers["Content-Length"] = String(result.size);
		if (SAFE_INLINE_TYPES.has(result.contentType)) headers["Content-Disposition"] = "inline";
		else headers["Content-Disposition"] = "attachment";
		return new Response(result.body, {
			status: 200,
			headers
		});
	} catch (error) {
		if (error instanceof Error && (error.message.includes("not found") || error.message.includes("NOT_FOUND"))) return apiError("NOT_FOUND", "File not found", 404);
		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
	}
};

//#endregion
export { GET, prerender };
//# sourceMappingURL=_...key_.mjs.map