@cosmicdrift/kumiko-framework 0.314.0 → 0.315.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.314.0",
+  "version": "0.315.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,8 +198,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.314.0",
-    "@cosmicdrift/kumiko-types": "0.314.0",
+    "@cosmicdrift/kumiko-http": "0.315.0",
+    "@cosmicdrift/kumiko-types": "0.315.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.314.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.315.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.315.0",
+    "type": "breaking",
+    "title": "files: content verification is now keyed by filename extension, covering every signature-bearing type",
+    "migration": "validateFileContent's signature changes from (mimeType: string, content: Uint8Array) to (fileName: string, content: Uint8Array): string | null. It now content-verifies every extension whose EXTENSION_MIME_WHITELIST entry overlaps MAGIC_BYTE_SIGNATURES (jpg/jpeg/png/gif/webp/pdf/doc/docx), not just doc/docx, and derives the check declaratively from the whitelist instead of a hardcoded per-format list. file-routes.ts now passes file.name instead of file.type (Bun derives File#type from the filename anyway, so the mimeType-keyed call was already comparing an extension-derived value to itself). A malicious extension shaped like a JS prototype property (constructor, __proto__, toString) resolves to \"unknown extension\" (no error) instead of crashing with a 500 — the same Object.hasOwn-guarded whitelist lookup is now shared by validateFile and validateFileContent. mime_mismatch remains a metadata-only pre-check; it is not real evidence of file content. Any test that uploads placeholder bytes (e.g. [1,2,3]) through the real upload route under one of the now-verified extensions must switch to real minimal signature bytes or a differently-named/unchecked extension."
+  },
   {
     "version": "0.314.0",
     "type": "improvement",

package/src/derivatives/__tests__/derivatives-context.integration.test.ts

@@ -103,7 +103,7 @@ afterAll(async () => {
 
 async function uploadFile(
   asUser = user,
-  file = new File([Buffer.from([1, 2, 3])], "photo.jpg", { type: "image/jpeg" }),
+  file = new File([Buffer.from([0xff, 0xd8, 0xff, 0xe0])], "photo.jpg", { type: "image/jpeg" }),
 ): Promise<string> {
   const token = await stack.jwt.sign(asUser);
   const fd = new FormData();
@@ -214,7 +214,9 @@ describe("ctx.derivatives — typed errors from variant()", () => {
   test("no renderer registered for the mimeType throws InternalError with httpStatus 500", async () => {
     const fileId = await uploadFile(
       user,
-      new File([Buffer.from([1, 2, 3])], "doc.pdf", { type: "application/pdf" }),
+      new File([Buffer.from(new TextEncoder().encode("%PDF-1.4 minimal"))], "doc.pdf", {
+        type: "application/pdf",
+      }),
     );
 
     const result = await stack.http.writeOk<{

package/src/derivatives/__tests__/variant-route.integration.test.ts

@@ -73,7 +73,10 @@ async function uploadFile(
 ): Promise<string> {
   const token = await stack.jwt.sign(asUser);
   const fd = new FormData();
-  fd.append("file", new File([Buffer.from([1, 2, 3])], "avatar.jpg", { type: "image/jpeg" }));
+  fd.append(
+    "file",
+    new File([Buffer.from([0xff, 0xd8, 0xff, 0xe0])], "avatar.jpg", { type: "image/jpeg" }),
+  );
   if (attach !== null) {
     fd.append("entityType", attach.entityType);
     fd.append("fieldName", attach.fieldName);
@@ -198,7 +201,12 @@ describe("GET /api/files/:id/variant/:name", () => {
   test("a source mimeType with no matching renderer (client uploaded a non-image) returns 415, not a 500", async () => {
     const token = await stack.jwt.sign(user);
     const fd = new FormData();
-    fd.append("file", new File([Buffer.from([1, 2, 3])], "doc.pdf", { type: "application/pdf" }));
+    fd.append(
+      "file",
+      new File([Buffer.from(new TextEncoder().encode("%PDF-1.4 minimal"))], "doc.pdf", {
+        type: "application/pdf",
+      }),
+    );
     fd.append("entityType", "photo");
     fd.append("fieldName", "avatar");
     const { body, contentType } = await buildMultipartBody(fd);

package/src/files/__tests__/file-field-pipeline.integration.test.ts

@@ -89,6 +89,20 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`TRUNCATE pipeline_documents`);
 });
 
+const PDF_BYTES = new TextEncoder().encode("%PDF-1.4 minimal");
+const JPEG_BYTES = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(10).fill(0)]);
+const PNG_BYTES = new Uint8Array([
+  0x89,
+  0x50,
+  0x4e,
+  0x47,
+  0x0d,
+  0x0a,
+  0x1a,
+  0x0a,
+  ...Array(10).fill(0),
+]);
+
 async function uploadFile(fileName: string, body: Uint8Array, mimeType: string): Promise<string> {
   const token = await stack.jwt.sign(user);
   const fd = new FormData();
@@ -107,8 +121,8 @@ async function uploadFile(fileName: string, body: Uint8Array, mimeType: string):
 
 describe("file/image field through the CRUD pipeline", () => {
   test("create entity with file-field UUID → detail round-trips the UUID", async () => {
-    const fileId = await uploadFile("doc.pdf", new Uint8Array([1, 2, 3]), "application/pdf");
-    const imageId = await uploadFile("cover.png", new Uint8Array([4, 5, 6]), "image/png");
+    const fileId = await uploadFile("doc.pdf", PDF_BYTES, "application/pdf");
+    const imageId = await uploadFile("cover.png", PNG_BYTES, "image/png");
 
     // Create through the standard write pipeline — this is the path where the
     // pre-fix validation (z.number() for file/image) would have rejected the
@@ -135,8 +149,8 @@ describe("file/image field through the CRUD pipeline", () => {
   });
 
   test("update entity swaps file-field UUIDs cleanly", async () => {
-    const oldFile = await uploadFile("v1.pdf", new Uint8Array([1]), "application/pdf");
-    const newFile = await uploadFile("v2.pdf", new Uint8Array([2]), "application/pdf");
+    const oldFile = await uploadFile("v1.pdf", PDF_BYTES, "application/pdf");
+    const newFile = await uploadFile("v2.pdf", PDF_BYTES, "application/pdf");
 
     const created = await stack.http.writeOk<{ id: string }>(
       "pipeline-documents:write:document:create",
@@ -177,9 +191,9 @@ describe("file/image field through the CRUD pipeline", () => {
     // files/images) — the array of UUIDs lives in the event payload. The
     // pipeline still has to validate + accept it. Pre-fix this was
     // z.array(z.number()) which would have rejected every UUID array.
-    const a = await uploadFile("a.jpg", new Uint8Array([1]), "image/jpeg");
-    const b = await uploadFile("b.jpg", new Uint8Array([2]), "image/jpeg");
-    const c = await uploadFile("notes.pdf", new Uint8Array([3]), "application/pdf");
+    const a = await uploadFile("a.jpg", JPEG_BYTES, "image/jpeg");
+    const b = await uploadFile("b.jpg", JPEG_BYTES, "image/jpeg");
+    const c = await uploadFile("notes.pdf", PDF_BYTES, "application/pdf");
 
     const created = await stack.http.writeOk<{ id: string }>(
       "pipeline-documents:write:document:create",
@@ -190,8 +204,8 @@ describe("file/image field through the CRUD pipeline", () => {
 
     // Follow-up update: swap one photo out, add a second doc. Proves the
     // update-path handles plural arrays too, not just create.
-    const d = await uploadFile("c.jpg", new Uint8Array([4]), "image/jpeg");
-    const e = await uploadFile("more.pdf", new Uint8Array([5]), "application/pdf");
+    const d = await uploadFile("c.jpg", JPEG_BYTES, "image/jpeg");
+    const e = await uploadFile("more.pdf", PDF_BYTES, "application/pdf");
 
     const updated = await stack.http.writeOk<{ id: string }>(
       "pipeline-documents:write:document:update",
@@ -204,7 +218,7 @@ describe("file/image field through the CRUD pipeline", () => {
   });
 
   test("plural files field rejects non-UUID element (schema validates EACH array element)", async () => {
-    const valid = await uploadFile("ok.pdf", new Uint8Array([1]), "application/pdf");
+    const valid = await uploadFile("ok.pdf", PDF_BYTES, "application/pdf");
     const err = await stack.http.writeErr(
       "pipeline-documents:write:document:create",
       { title: "Bad array", docs: [valid, "not-a-uuid"] },

package/src/files/__tests__/files.integration.test.ts

@@ -265,37 +265,58 @@ describe("file validation", () => {
     ).toBeNull();
   });
 
-  test("validateFileContent accepts .doc/.docx bytes matching their declared mimeType", () => {
-    expect(validateFileContent("application/msword", docBytes)).toBeNull();
-    expect(
-      validateFileContent(
-        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-        docxBytes,
-      ),
-    ).toBeNull();
+  test("validateFileContent accepts .doc/.docx bytes matching their declared extension", () => {
+    expect(validateFileContent("report.doc", docBytes)).toBeNull();
+    expect(validateFileContent("report.docx", docxBytes)).toBeNull();
   });
 
-  test("validateFileContent rejects .doc/.docx whose content doesn't match the declared mimeType", () => {
+  test("validateFileContent rejects .doc/.docx whose content doesn't match the extension", () => {
     const fakeDoc = validateFileContent(
-      "application/msword",
+      "fake.doc",
       new TextEncoder().encode("not actually a Word document, just text"),
     );
     expectErrorIncludes(fakeDoc, "content_mismatch");
 
     const fakeDocx = validateFileContent(
-      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      "fake.docx",
       new TextEncoder().encode("not actually a docx, just text"),
     );
     expectErrorIncludes(fakeDocx, "content_mismatch");
   });
 
-  test("validateFileContent does not content-verify pre-existing types (e.g. pdf) even when content mismatches", () => {
-    expect(
-      validateFileContent(
-        "application/pdf",
-        new TextEncoder().encode("not a PDF at all, just text"),
-      ),
-    ).toBeNull();
+  test("validateFileContent now content-verifies every signature-bearing extension (e.g. pdf), not just doc/docx", () => {
+    const mismatch = validateFileContent(
+      "fake.pdf",
+      new TextEncoder().encode("not a PDF at all, just text"),
+    );
+    expectErrorIncludes(mismatch, "content_mismatch");
+  });
+
+  test("validateFileContent leaves extensions without a magic-byte signature unchecked (csv/txt/svg/md/json/unknown)", () => {
+    const text = new TextEncoder().encode("just plain text, not any binary format");
+    expect(validateFileContent("data.csv", text)).toBeNull();
+    expect(validateFileContent("notes.txt", text)).toBeNull();
+    expect(validateFileContent("readme.md", text)).toBeNull();
+    expect(validateFileContent("data.json", text)).toBeNull();
+    expect(validateFileContent("logo.svg", text)).toBeNull();
+    expect(validateFileContent("file.unknownext", text)).toBeNull();
+  });
+
+  test("validateFileContent treats a prototype-property extension as unknown instead of crashing", () => {
+    expect(validateFileContent("evil.constructor", docBytes)).toBeNull();
+    expect(validateFileContent("evil.__proto__", docBytes)).toBeNull();
+    expect(validateFileContent("evil.toString", docBytes)).toBeNull();
+  });
+
+  test("validateFile with accept: ['constructor'] and a matching filename never throws", () => {
+    let result: string | null = null;
+    expect(() => {
+      result = validateFile(
+        { fileName: "x.constructor", mimeType: "application/octet-stream", size: 10 },
+        { accept: ["constructor"] },
+      );
+    }).not.toThrow();
+    expect(result === null || typeof result === "string").toBe(true);
   });
 
   test("sniffMimeType recognizes doc (OLE) and docx (ZIP) signatures", () => {
@@ -616,6 +637,90 @@ describe("doc/docx upload is content-verified against magic bytes", () => {
   });
 });
 
+// --- Content-verification is keyed on the filename extension, not the ---
+// --- declared/runtime mimeType (Option A, kumiko-framework#3287)       ---
+
+describe("content_mismatch is enforced by filename extension for every signature-bearing type", () => {
+  const jpegBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(20).fill(0)]);
+  const pngBytes = new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a,
+    ...Array(20).fill(0),
+  ]);
+  const pdfBytes = new TextEncoder().encode("%PDF-1.4 minimal");
+  const docBytes = new Uint8Array([
+    0xd0,
+    0xcf,
+    0x11,
+    0xe0,
+    0xa1,
+    0xb1,
+    0x1a,
+    0xe1,
+    ...Array(20).fill(0),
+  ]);
+  const docxBytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...Array(20).fill(0)]);
+
+  test("PDF bytes uploaded as x.jpg against an accept: [jpg] field are rejected with content_mismatch", async () => {
+    const res = await uploadFile(adminUser, "x.jpg", pdfBytes, "image/jpeg", {
+      entityType: "tenant",
+      entityId: "1",
+      fieldName: "logo",
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("content_mismatch");
+  });
+
+  test("real signature bytes with a matching extension upload successfully", async () => {
+    for (const [fileName, bytes, mimeType] of [
+      ["real.jpg", jpegBytes, "image/jpeg"],
+      ["real.png", pngBytes, "image/png"],
+      ["real.pdf", pdfBytes, "application/pdf"],
+      ["real.doc", docBytes, "application/msword"],
+      [
+        "real.docx",
+        docxBytes,
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      ],
+    ] as const) {
+      const res = await uploadFile(adminUser, fileName, bytes, mimeType);
+      expect(res.status).toBe(201);
+    }
+  });
+
+  test(".csv and .txt plain text upload successfully (no magic-byte signature to check)", async () => {
+    const text = new TextEncoder().encode("name,age\nAda,36\n");
+    const csvRes = await uploadFile(adminUser, "data.csv", text, "text/csv");
+    expect(csvRes.status).toBe(201);
+    const txtRes = await uploadFile(adminUser, "notes.txt", text, "text/plain");
+    expect(txtRes.status).toBe(201);
+  });
+
+  test("an unattached upload with a prototype-property extension is handled as unknown, not a 500", async () => {
+    const constructorRes = await uploadFile(adminUser, "evil.constructor", pngBytes, "image/png");
+    expect(constructorRes.status).toBe(201);
+    const protoRes = await uploadFile(adminUser, "evil.__proto__", pngBytes, "image/png");
+    expect(protoRes.status).toBe(201);
+  });
+
+  test("a too-short .png upload (fewer bytes than the PNG signature) is rejected with content_mismatch", async () => {
+    // A zero-byte file part is dropped by Bun's multipart parser before it
+    // ever reaches the route handler as `file`, so this uses one byte
+    // instead — still far short of the 8-byte PNG signature.
+    const res = await uploadFile(adminUser, "empty.png", new Uint8Array([0x00]), "image/png");
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("content_mismatch");
+  });
+});
+
 // Bun's formData() derives File#type from the filename, so .csv never
 // arrives as vnd.ms-excel here; the csv alias is covered by the unit tests above.
 describe("vnd.ms-excel via HTTP (.xls)", () => {
@@ -873,7 +978,7 @@ describe("custom file access guard", () => {
 
 describe("tenant isolation", () => {
   test("tenant 2 uploads a file, tenant 1 cannot see it", async () => {
-    const content = new TextEncoder().encode("tenant2-secret-file");
+    const content = new TextEncoder().encode("%PDF-1.4 tenant2-secret-file");
     const uploadRes = await uploadFile(otherTenantUser, "secret.pdf", content, "application/pdf");
     expect(uploadRes.status).toBe(201);
     const { id } = await uploadRes.json();

package/src/files/__tests__/storage-tracking.integration.test.ts

@@ -38,9 +38,11 @@ const otherAdmin = createTestUser({
 });
 
 // Two tiny payloads with distinct lengths so the sum assertion can tell
-// them apart without relying on the underlying bytes.
-const SMALL = new Uint8Array([0x89, 0x50, 0x4e, 0x47, ...Array(16).fill(0)]); // 20 bytes, PNG-ish
-const LARGE = new Uint8Array([0x89, 0x50, 0x4e, 0x47, ...Array(96).fill(0)]); // 100 bytes
+// them apart without relying on the underlying bytes. Both carry the full
+// 8-byte PNG signature so validateFileContent accepts them.
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+const SMALL = new Uint8Array([...PNG_SIGNATURE, ...Array(12).fill(0)]); // 20 bytes
+const LARGE = new Uint8Array([...PNG_SIGNATURE, ...Array(92).fill(0)]); // 100 bytes
 
 beforeAll(async () => {
   patchFileInstanceofForBunTest();

package/src/files/file-routes.ts

@@ -236,7 +236,7 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
 
     const data = new Uint8Array(await file.arrayBuffer());
 
-    const contentValidationError = validateFileContent(file.type, data);
+    const contentValidationError = validateFileContent(file.name, data);
     if (contentValidationError) {
       return c.json({ error: contentValidationError }, 400);
     }

package/src/files/types.ts

@@ -38,10 +38,10 @@ function extractExtension(fileName: string): string | undefined {
   return fileName.split(".").pop()?.toLowerCase();
 }
 
-// Extension → acceptable MIME-type whitelist. Guards against a client
-// uploading e.g. name="x.jpg" with mimeType="application/pdf" to slip an
-// executable past the extension-only check. Kept small & conservative — add
-// entries on demand rather than importing a heavyweight mime DB.
+// Extension → acceptable MIME-type whitelist. Backs the cheap metadata
+// pre-check in validateFile AND the signature lookup in validateFileContent.
+// Kept small & conservative; add entries on demand rather than importing a
+// heavyweight mime DB.
 const EXTENSION_MIME_WHITELIST: Record<string, readonly string[]> = {
   jpg: ["image/jpeg", "image/jpg"],
   jpeg: ["image/jpeg", "image/jpg"],
@@ -73,8 +73,15 @@ function lookupMimeAlias(ext: string, normalizedMimeType: string): string | unde
   return aliasesForExt[normalizedMimeType];
 }
 
+// Same hasOwn guard as lookupMimeAlias above, for the ext-keyed whitelist.
+function lookupExtensionWhitelist(ext: string): readonly string[] | undefined {
+  if (!Object.hasOwn(EXTENSION_MIME_WHITELIST, ext)) return undefined;
+  return EXTENSION_MIME_WHITELIST[ext];
+}
+
 // Magic-byte signatures for the subset of EXTENSION_MIME_WHITELIST that has
-// a reliable binary signature. Used at SERVE time — never trust the stored/
+// a reliable binary signature. Used both at upload time (validateFileContent)
+// and at serve time (resolveServedContentType) — never trust the stored/
 // client-declared mimeType for Content-Type on its own, sniff the actual
 // bytes instead. Types without a stable signature (svg, txt, csv, json, md)
 // and anything that matches none of these fall back to
@@ -99,9 +106,8 @@ const MAGIC_BYTE_SIGNATURES: ReadonlyArray<{
     matches: (bytes) => startsWithAscii(bytes, "RIFF") && startsWithAscii(bytes, "WEBP", 8),
   },
   { mimeType: "application/pdf", matches: (bytes) => startsWithAscii(bytes, "%PDF-") },
-  // Full 8-byte OLE Compound File signature (legacy .doc/.xls/.ppt share it —
-  // sniffing can't tell them apart by bytes alone, only content-verification
-  // below narrows to msword specifically).
+  // Full 8-byte OLE Compound File signature — legacy .doc/.xls/.ppt share it,
+  // so any OLE file sniffs as msword regardless of which one it really is.
   {
     mimeType: "application/msword",
     matches: (bytes) => startsWithBytes(bytes, [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]),
@@ -172,14 +178,6 @@ export function resolveServedContentType(bytes: Uint8Array, declaredMimeType: st
   return sniffed === declared ? sniffed : "application/octet-stream";
 }
 
-// Signature-checked against the declared mimeType regardless of
-// `options.accept`. Deliberately narrow: most of the whitelist has no magic
-// bytes at all and would reject honestly-mislabeled uploads if checked.
-const CONTENT_VERIFIED_MIME_TYPES = new Set([
-  "application/msword",
-  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-]);
-
 export function validateFile(
   metadata: FileMetadata,
   options: FileValidationOptions,
@@ -196,11 +194,9 @@ export function validateFile(
     if (!ext || !options.accept.includes(ext)) {
       return `invalid_file_type: ".${ext}" is not in [${options.accept.join(", ")}]`;
     }
-    // Extension passed the whitelist — now make sure the client-reported
-    // mimeType is consistent with that extension. Guards against MIME-spoofing:
-    // an attacker can't claim extension=jpg while actually uploading PDF bytes
-    // and having the mimeType reflect that.
-    const allowedMimes = EXTENSION_MIME_WHITELIST[ext];
+    // Cheap metadata pre-check only: the client/runtime mimeType is no
+    // evidence of file content (Bun derives it from the filename itself).
+    const allowedMimes = lookupExtensionWhitelist(ext);
     if (allowedMimes && metadata.mimeType) {
       const normalized = normalizeMimeType(metadata.mimeType);
       const isAliasedMime = lookupMimeAlias(ext, normalized) !== undefined;
@@ -213,17 +209,25 @@ export function validateFile(
   return null;
 }
 
+function signatureMimeTypesForExtension(ext: string): readonly string[] {
+  const whitelist = lookupExtensionWhitelist(ext);
+  if (!whitelist) return [];
+  return whitelist.filter((candidate) =>
+    MAGIC_BYTE_SIGNATURES.some((signature) => signature.mimeType === candidate),
+  );
+}
+
 // Separate from validateFile: metadata is known before the upload body is
 // fully read, content-verification only after — callers reject early on
 // metadata without buffering bytes they'll then have to reject anyway.
-export function validateFileContent(mimeType: string, content: Uint8Array): string | null {
-  const normalizedDeclared = normalizeMimeType(mimeType);
-  if (!CONTENT_VERIFIED_MIME_TYPES.has(normalizedDeclared)) return null;
-  const signature = MAGIC_BYTE_SIGNATURES.find((s) => s.mimeType === normalizedDeclared);
-  if (signature && !signature.matches(content)) {
-    return `content_mismatch: bytes do not match declared mimeType "${mimeType}"`;
-  }
-  return null;
+export function validateFileContent(fileName: string, content: Uint8Array): string | null {
+  const ext = extractExtension(fileName);
+  if (!ext) return null;
+  const signatureMimeTypes = signatureMimeTypesForExtension(ext);
+  if (signatureMimeTypes.length === 0) return null;
+  const sniffed = sniffMimeType(content);
+  if (sniffed && signatureMimeTypes.includes(sniffed)) return null;
+  return `content_mismatch: ".${ext}" upload bytes are ${sniffed ?? "unrecognized"}, expected ${signatureMimeTypes.join(" or ")}`;
 }
 
 export type UploadMimeTypeResolution =