@gentleduck/upload 0.2.5 → 0.3.0

package/src/strategies/post/__tests__/post-url-safety.test.ts

@@ -0,0 +1,119 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest'
+import { __resetPostWarningsForTests, type PostIntent, PostStrategy } from '../index'
+
+function makeCtx(url: string) {
+  const file = new File(['hello'], 'a.txt', { type: 'text/plain' })
+  return {
+    intent: { strategy: 'post', fileId: 'f', url, fields: {} } satisfies PostIntent,
+    file,
+    signal: new AbortController().signal,
+    reportProgress: vi.fn(),
+    transport: {
+      postForm: vi.fn(async () => ({ headers: {} })),
+    },
+  }
+}
+
+describe('PostStrategy SSRF guard', () => {
+  beforeEach(() => {
+    __resetPostWarningsForTests()
+  })
+
+  test('rejects file://', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects javascript:', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('javascript:alert(1)') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects loopback', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://127.0.0.1/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects AWS metadata IPv4', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://169.254.169.254/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects host outside allowedHosts', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://evil.example.com/up') as any)).rejects.toThrow(/allow-list/)
+  })
+
+  test('accepts allowlisted host', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up')
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(ctx.transport.postForm).toHaveBeenCalled()
+  })
+
+  test('allowPrivateHosts lets loopback through (opt-in)', async () => {
+    const s = PostStrategy({ allowPrivateHosts: true })
+    const ctx = makeCtx('https://127.0.0.1/up')
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+  })
+
+  test('warns once when allowedHosts not set', async () => {
+    const s = PostStrategy()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      expect(warn).toHaveBeenCalledTimes(1)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  test('caller label is "post.intent"', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/post\.intent/)
+  })
+})
+
+describe('PostStrategy retry', () => {
+  beforeEach(() => {
+    __resetPostWarningsForTests()
+  })
+
+  test('retries a transient failure then succeeds', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'], maxRetries: 2 })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.postForm = vi.fn(async () => {
+      calls++
+      if (calls < 2) throw new Error('network error')
+      return { headers: {} }
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(calls).toBe(2)
+  })
+
+  test('does not retry a non-transient failure', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.postForm = vi.fn(async () => {
+      calls++
+      throw new Error('Upload failed with status 403')
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).rejects.toThrow(/403/)
+    expect(calls).toBe(1)
+  })
+})

package/src/strategies/post/index.ts

@@ -1,93 +1,135 @@
+import type { Contracts } from '../../core'
+import { UploadEngineError } from '../../core'
+import { validateUploadUrl } from '../../core/utils/url-safety'
+import { withRetry } from '../_shared/retry'
+
 /**
- * @fileoverview POST strategy implementation for simple file uploads.
- *
- * Implements the presigned POST upload strategy, suitable for:
- * - Small to medium files (< 100MB typically)
- * - Simple uploads without resume capability
- * - Direct form-based uploads to S3 or similar storage
- *
- * The strategy uses multipart/form-data POST requests with presigned
- * form fields provided by the backend. This is the simplest upload
- * method and doesn't support resumable uploads.
- *
- * @module upload-strategies/post
+ * Types for the presigned HTTP POST upload strategy.
+ * @author wildduck2 <https://github.com/wildduck2>
  */
+export namespace PostStrategy {
+  /**
+   * Presigned HTTP POST strategy configuration options.
+   */
+  export type Config = {
+    /**
+     * Case-insensitive allow-list of host names (with optional port). When
+     * set, the presigned POST URL must match a listed host or it is rejected.
+     */
+    allowedHosts?: string[]
+    /**
+     * When `true`, allow private-network IP literals in the POST URL.
+     * Defaults to `false`.
+     */
+    allowPrivateHosts?: boolean
+    /**
+     * Retries after the first attempt for transient network failures.
+     * Defaults to the shared retry default (3).
+     */
+    maxRetries?: number
+  }
 
-import type { CursorMap, IntentMap, UploadResultBase, UploadStrategy } from '../../core/contracts'
-
-// ============================================================================
-// POST INTENT TYPE
-// ============================================================================
+  /**
+   * Presigned HTTP POST intent payload mapping parameters returned by backend endpoints.
+   */
+  export type Intent = {
+    /** Discriminant identifier matching strategy configuration registry keys. */
+    strategy: 'post'
+    /** Unique database identifier for the file resource. */
+    fileId: string
+    /** Presigned POST action destination URL (e.g. presigned S3/GCS bucket location). */
+    url: string
+    /** Key/value pair list representing form properties (e.g. AWS credential fields, policies). */
+    fields: Record<string, string>
+    /** Optional epoch string indicating when the pre-signed credentials lapse. */
+    expiresAt?: string
+  }
 
-export type PostIntent = {
-  /** Strategy identifier - must be 'post' */
-  strategy: 'post'
-  /** Backend file identifier */
-  fileId: string
-  /** Presigned POST URL (form action) */
-  url: string
-  /** Form fields to include before the file */
-  fields: Record<string, string>
-  /** Optional expiration timestamp for the presigned URL */
-  expiresAt?: string
+  /**
+   * Direct strategy cursor state representing that no resumable bytes exist.
+   */
+  export type Cursor = Record<string, never>
 }
 
-// ============================================================================
-// POST CURSOR TYPE
-// ============================================================================
+/** Convenience alias for {@link PostStrategy.Intent}. */
+export type PostIntent = PostStrategy.Intent
 
-export type PostCursor = {
-  /** Bytes uploaded (for progress display only) */
-  uploadedBytes: number
-}
+let warnedMissingAllowedHosts = false
 
-// ============================================================================
-// POST STRATEGY
-// ============================================================================
+/**
+ * Reset the warn-once latch. Test-only.
+ * @internal
+ */
+export function __resetPostWarningsForTests(): void {
+  warnedMissingAllowedHosts = false
+}
 
+/**
+ * Presigned HTTP POST form strategy.
+ *
+ * Sends the entire file along with backend policy fields as a single
+ * `multipart/form-data` request body. Does not support resumability.
+ *
+ * Security: the presigned URL is backend-supplied and flows straight to the
+ * transport, so a compromised backend or MITM could return a `file:`,
+ * `javascript:`, or private-network URL. Every URL is checked with
+ * {@link validateUploadUrl}; set {@link PostStrategy.Config.allowedHosts} to
+ * lock it to known hosts, or leave `allowPrivateHosts` at its default `false`
+ * to block loopback/private addresses.
+ *
+ * @example
+ * ```ts
+ * const strategies = createStrategyRegistry([
+ *   PostStrategy({ allowedHosts: ['uploads.example.com'] }),
+ *   MultipartStrategy()
+ * ]);
+ * ```
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
 export function PostStrategy<
-  M extends IntentMap & { post: PostIntent },
-  C extends CursorMap<M> & { post?: PostCursor },
-  P extends string = string,
-  R extends UploadResultBase = UploadResultBase,
->(): UploadStrategy<M, C, P, R, 'post'> {
+  M extends Contracts.Intent.Map,
+  C extends Contracts.Cursor.Map<M>,
+  P extends string,
+  R extends Contracts.Result.Base = Contracts.Result.Base,
+>(opts: PostStrategy.Config = {}): Contracts.Strategy.Me<M, C, P, R, 'post'> {
+  const allowedHosts = opts.allowedHosts ?? []
+  const allowPrivateHosts = opts.allowPrivateHosts === true
+
   return {
-    /** Strategy identifier */
     id: 'post',
-
-    /** POST uploads are not resumable */
     resumable: false,
 
-    /**
-     * Execute the POST upload.
-     *
-     * @param ctx - Strategy context
-     * @throws Error if intent is missing URL
-     */
     async start(ctx) {
-      const intent = ctx.intent
+      const intent = ctx.intent as unknown as PostStrategy.Intent
 
-      // Validate intent has required URL
       if (!intent.url) {
-        throw new Error('Direct strategy: intent missing url/uploadUrl')
+        throw new UploadEngineError('validation_failed', { message: 'post.start: intent missing url' })
       }
 
-      // Upload using form POST
-      await ctx.transport.postForm({
-        url: intent.url,
-        file: ctx.file,
-        fields: intent.fields,
-        filename: ctx.file.name,
-        signal: ctx.signal,
-        /**
-         * Report progress during upload.
-         * @param uploadedBytes - Bytes uploaded so far
-         * @param totalBytes - Total file size
-         */
-        onProgress(uploadedBytes, totalBytes) {
-          ctx.reportProgress({ uploadedBytes, totalBytes })
-        },
-      })
+      if (allowedHosts.length === 0 && !warnedMissingAllowedHosts) {
+        warnedMissingAllowedHosts = true
+        console.warn(
+          '[duck-upload] PostStrategy: no `allowedHosts` configured. Presigned POST URLs will be host-unrestricted. ' +
+            'Set PostStrategy.Config.allowedHosts to lock the upload host.',
+        )
+      }
+
+      validateUploadUrl(intent.url, 'post.intent', { allowedHosts, allowPrivateHosts })
+
+      await withRetry(
+        () =>
+          ctx.transport.postForm({
+            url: intent.url,
+            file: ctx.file,
+            fields: intent.fields,
+            filename: ctx.file.name,
+            signal: ctx.signal,
+            onProgress(uploadedBytes, totalBytes) {
+              ctx.reportProgress({ uploadedBytes, totalBytes })
+            },
+          }),
+        { signal: ctx.signal, ...(opts.maxRetries !== undefined ? { maxRetries: opts.maxRetries } : {}) },
+      )
     },
   }
 }

package/src/strategies/put/__tests__/put.test.ts

@@ -0,0 +1,132 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest'
+import { __resetPutWarningsForTests, type PutIntent, PutStrategy } from '../index'
+
+function makeCtx(url: string, overrides: Partial<PutIntent> = {}) {
+  const file = new File(['hello world'], 'a.txt', { type: 'text/plain' })
+  return {
+    intent: { strategy: 'put', fileId: 'f', url, ...overrides } satisfies PutIntent,
+    file,
+    signal: new AbortController().signal,
+    reportProgress: vi.fn(),
+    transport: {
+      put: vi.fn(async () => ({ etag: 'abc', headers: {} })),
+    },
+  }
+}
+
+describe('PutStrategy SSRF guard', () => {
+  beforeEach(() => {
+    __resetPutWarningsForTests()
+  })
+
+  test('rejects file://', async () => {
+    const s = PutStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects javascript:', async () => {
+    const s = PutStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('javascript:alert(1)') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects loopback', async () => {
+    const s = PutStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://127.0.0.1/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects AWS metadata IPv4', async () => {
+    const s = PutStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://169.254.169.254/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects host outside allowedHosts', async () => {
+    const s = PutStrategy({ allowedHosts: ['up.example.com'] })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://evil.example.com/up') as any)).rejects.toThrow(/allow-list/)
+  })
+
+  test('accepts allowlisted host and PUTs the file body', async () => {
+    const s = PutStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up', { headers: { 'Content-Type': 'text/plain' } })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(ctx.transport.put).toHaveBeenCalledTimes(1)
+    const arg = (ctx.transport.put.mock.calls[0] as unknown as [{ url: string; body: unknown; headers: unknown }])[0]
+    expect(arg.url).toBe('https://up.example.com/up')
+    expect(arg.body).toBe(ctx.file)
+    expect(arg.headers).toEqual({ 'Content-Type': 'text/plain' })
+  })
+
+  test('allowPrivateHosts lets loopback through (opt-in)', async () => {
+    const s = PutStrategy({ allowPrivateHosts: true })
+    const ctx = makeCtx('https://127.0.0.1/up')
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+  })
+
+  test('warns once when allowedHosts not set', async () => {
+    const s = PutStrategy()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      expect(warn).toHaveBeenCalledTimes(1)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  test('caller label is "put.intent"', async () => {
+    const s = PutStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/put\.intent/)
+  })
+
+  test('throws when intent has no url', async () => {
+    const s = PutStrategy()
+    const ctx = makeCtx('https://up.example.com/up')
+    // biome-ignore lint/suspicious/noExplicitAny: intentionally clearing the url
+    ;(ctx.intent as any).url = ''
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).rejects.toThrow(/missing url/)
+  })
+})
+
+describe('PutStrategy retry', () => {
+  beforeEach(() => {
+    __resetPutWarningsForTests()
+  })
+
+  test('retries a transient failure then succeeds', async () => {
+    const s = PutStrategy({ allowedHosts: ['up.example.com'], maxRetries: 2 })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.put = vi.fn(async () => {
+      calls++
+      if (calls < 2) throw new Error('network error')
+      return { etag: 'ok', headers: {} }
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(calls).toBe(2)
+  })
+
+  test('does not retry a non-transient failure', async () => {
+    const s = PutStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.put = vi.fn(async () => {
+      calls++
+      throw new Error('Upload failed with status 403')
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).rejects.toThrow(/403/)
+    expect(calls).toBe(1)
+  })
+})

package/src/strategies/put/index.ts

@@ -0,0 +1,139 @@
+import type { Contracts } from '../../core'
+import { UploadEngineError } from '../../core'
+import { validateUploadUrl } from '../../core/utils/url-safety'
+import { withRetry } from '../_shared/retry'
+
+/**
+ * Types for the single-request presigned HTTP PUT upload strategy.
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
+export namespace PutStrategy {
+  /**
+   * Presigned HTTP PUT strategy configuration options.
+   */
+  export type Config = {
+    /**
+     * Case-insensitive allow-list of host names (with optional port). When
+     * set, the presigned PUT URL must match a listed host or it is rejected.
+     */
+    allowedHosts?: string[]
+    /**
+     * When `true`, allow private-network IP literals in the PUT URL.
+     * Defaults to `false`.
+     */
+    allowPrivateHosts?: boolean
+    /**
+     * Retries after the first attempt for transient network failures.
+     * Defaults to the shared retry default (3).
+     */
+    maxRetries?: number
+  }
+
+  /**
+   * Presigned HTTP PUT intent payload. The whole file body is sent in one
+   * request to a backend-signed URL (e.g. S3 `putObject`, GCS signed PUT).
+   */
+  export type Intent = {
+    /** Discriminant identifier matching strategy configuration registry keys. */
+    strategy: 'put'
+    /** Unique database identifier for the file resource. */
+    fileId: string
+    /** Presigned PUT destination URL. */
+    url: string
+    /** Optional request headers required by the signature (e.g. `Content-Type`). */
+    headers?: Record<string, string>
+    /** Optional epoch string indicating when the pre-signed credentials lapse. */
+    expiresAt?: string
+  }
+
+  /**
+   * Direct strategy cursor state representing that no resumable bytes exist.
+   */
+  export type Cursor = Record<string, never>
+}
+
+/** Convenience alias for {@link PutStrategy.Intent}. */
+export type PutIntent = PutStrategy.Intent
+
+let warnedMissingAllowedHosts = false
+
+/**
+ * Reset the warn-once latch. Test-only.
+ * @internal
+ */
+export function __resetPutWarningsForTests(): void {
+  warnedMissingAllowedHosts = false
+}
+
+/**
+ * Presigned single-request HTTP PUT strategy.
+ *
+ * Sends the entire file as the request body to a backend-signed URL in one PUT.
+ * The most common direct-to-storage pattern (S3 `putObject`, GCS/Azure signed
+ * PUT). Not resumable — use {@link multipartStrategy} or the tus strategy for
+ * resumable transfers.
+ *
+ * Security: the presigned URL is backend-supplied and flows straight to the
+ * transport, so a compromised backend or MITM could return a `file:`,
+ * `javascript:`, or private-network URL. Every URL is checked with
+ * {@link validateUploadUrl}; set {@link PutStrategy.Config.allowedHosts} to
+ * lock it to known hosts, or leave `allowPrivateHosts` at its default `false`
+ * to block loopback/private addresses.
+ *
+ * @example
+ * ```ts
+ * const strategies = createStrategyRegistry([
+ *   PutStrategy({ allowedHosts: ['uploads.example.com'] }),
+ *   multipartStrategy(),
+ * ]);
+ * ```
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
+export function PutStrategy<
+  M extends Contracts.Intent.Map,
+  C extends Contracts.Cursor.Map<M>,
+  P extends string,
+  R extends Contracts.Result.Base = Contracts.Result.Base,
+>(opts: PutStrategy.Config = {}): Contracts.Strategy.Me<M, C, P, R, 'put'> {
+  const allowedHosts = opts.allowedHosts ?? []
+  const allowPrivateHosts = opts.allowPrivateHosts === true
+
+  return {
+    id: 'put',
+    resumable: false,
+
+    async start(ctx) {
+      const intent = ctx.intent as unknown as PutStrategy.Intent
+
+      if (!intent.url) {
+        throw new UploadEngineError('validation_failed', { message: 'put.start: intent missing url' })
+      }
+
+      if (allowedHosts.length === 0 && !warnedMissingAllowedHosts) {
+        warnedMissingAllowedHosts = true
+        console.warn(
+          '[duck-upload] PutStrategy: no `allowedHosts` configured. Presigned PUT URLs will be host-unrestricted. ' +
+            'Set PutStrategy.Config.allowedHosts to lock the upload host.',
+        )
+      }
+
+      validateUploadUrl(intent.url, 'put.intent', { allowedHosts, allowPrivateHosts })
+
+      const totalBytes = ctx.file.size
+
+      await withRetry(
+        () =>
+          ctx.transport.put({
+            url: intent.url,
+            body: ctx.file,
+            headers: intent.headers ?? {},
+            signal: ctx.signal,
+            onProgress(uploadedBytes, total) {
+              ctx.reportProgress({ uploadedBytes, totalBytes: total || totalBytes })
+            },
+          }),
+        { signal: ctx.signal, ...(opts.maxRetries !== undefined ? { maxRetries: opts.maxRetries } : {}) },
+      )
+    },
+  }
+}

package/src/strategies/registry/index.ts

@@ -4,17 +4,20 @@
  * Core strategy types live in `core/contracts/strategy.types.ts`.
  */
 
-import type { CursorMap, IntentMap, StrategyRegistry, UploadResultBase, UploadStrategy } from '../../core/contracts'
-
-export type { StrategyCtx, StrategyRegistry, UploadStrategy } from '../../core/contracts'
+import type { Contracts } from '../../core/contracts'
 
+/**
+ * Create an empty strategy registry. Register upload strategies with `set`, then
+ * resolve them by id with `get` / `has`.
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
 export function createStrategyRegistry<
-  M extends IntentMap,
-  C extends CursorMap<M>,
-  P extends string = string,
-  R extends UploadResultBase = UploadResultBase,
->(): StrategyRegistry<M, C, P, R> {
-  const map: Partial<{ [K in keyof M & string]: UploadStrategy<M, C, P, R, K> }> = {}
+  M extends Contracts.Intent.Map,
+  C extends Contracts.Cursor.Map<M>,
+  P extends string,
+  R extends Contracts.Result.Base = Contracts.Result.Base,
+>(): Contracts.Strategy.Registry<M, C, P, R> {
+  const map: Partial<{ [K in keyof M & string]: Contracts.Strategy.Me<M, C, P, R, K> }> = {}
 
   return {
     get(id) {