@gentleduck/upload 0.2.6 → 0.3.0

package/src/strategies/multipart/index.ts

@@ -1,54 +1,138 @@
 /**
  * S3/MinIO-style multipart strategy: sign each part on demand via `signPart`,
- * PUT, then finalize with `completeMultipart` using collected ETags. Resumable —
+ * PUT, then finalize with `completeMultipart` using collected ETags. Resumable
  * persists ETags in the cursor and skips already-completed sessions.
  */
 
-import type { CursorMap, IntentMap, UploadResultBase, UploadStrategy } from '../../core/contracts'
-import { sleep } from '../../core/utils/async'
+import type { Contracts } from '../../core'
+import { UploadEngineError } from '../../core'
+import { validateUploadUrl } from '../../core/utils/url-safety'
+import { withRetry } from '../_shared/retry'
 
 const DEFAULT_MAX_PART_CONCURRENCY = 4
 
-export type MultipartIntent = {
-  strategy: 'multipart'
-  fileId: string
-  uploadId: string
-  partSize: number
-  partCount: number
-
-  // Optional legacy mode: backend might provide all urls up front
-  parts?: Array<{
-    partNumber: number
-    url: string
-    headers?: Record<string, string>
-  }>
-}
+/**
+ * Namespace containing types and interfaces specific to the S3/MinIO multipart upload strategy.
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
+export namespace MultipartStrategy {
+  /**
+   * Configuration options for the multipart upload strategy.
+   */
+  export type Config = {
+    /** Maximum concurrent HTTP PUT part uploads. Defaults to 4. */
+    maxPartConcurrency?: number
+    /**
+     * Optional case-insensitive list of trusted hosts (with optional port, e.g. `upload.example.com`).
+     * When specified, every signed part URL must match one of the listed hosts.
+     */
+    allowedHosts?: string[]
+    /**
+     * When `true`, allows private network IP addresses (loopback, link-local, RFC1918) in signed part URLs.
+     * Defaults to `false`.
+     */
+    allowPrivateHosts?: boolean
+  }
 
-export type MultipartCursor = {
-  done: Array<{
-    partNumber: number
-    etag: string
-    size: number
-  }>
+  /**
+   * Intent payload detailing part sizing and active upload session IDs returned by backends.
+   */
+  export type Intent = {
+    /** Discriminant matching strategy configuration registry keys. */
+    strategy: 'multipart'
+    /** Unique database identifier for the file resource. */
+    fileId: string
+    /** Active multipart session ID returned by S3/GCS. */
+    uploadId: string
+    /** Chunk size in bytes for each part slice (typically 5MB minimum). */
+    partSize: number
+    /** Total count of parts predicted for this file size. */
+    partCount: number
+
+    /** Optional array of pre-generated URLs and headers for each part (if signed up front). */
+    parts?: Array<{
+      partNumber: number
+      url: string
+      headers?: Record<string, string>
+    }>
+  }
 
   /**
-   * Marks that the multipart session was completed on the backend (parts assembled).
-   * This prevents re-sending completeMultipart on resume.
+   * Persisted resume state for multipart strategy uploads.
    */
-  completed?: true
+  export type Cursor = {
+    /** List of completed parts. */
+    done: Array<{
+      partNumber: number
+      etag: string
+      size: number
+    }>
+
+    /**
+     * True if the backend assembled the parts.
+     * Prevents repeating completeMultipart calls on subsequent resume attempts.
+     */
+    completed?: true
+  }
 }
 
-function isAbort(err: unknown) {
-  return err instanceof Error && (err.name === 'AbortError' || /abort/i.test(err.message))
+let warnedMissingAllowedHosts = false
+
+/**
+ * Reset internal warn-once latches. Test-only.
+ *
+ * @internal
+ */
+export function __resetMultipartWarningsForTests(): void {
+  warnedMissingAllowedHosts = false
+}
+
+/**
+ * Validate the per-part URL returned by `signPart` before it reaches the
+ * transport. Delegates to the shared {@link validateUploadUrl} SSRF guard and
+ * warns once when no `allowedHosts` are configured. Throws on rejection.
+ *
+ * @internal
+ */
+export function validatePartUrl(
+  rawUrl: string,
+  opts: { allowedHosts?: string[]; allowPrivateHosts?: boolean } = {},
+): void {
+  if ((!opts.allowedHosts || opts.allowedHosts.length === 0) && !warnedMissingAllowedHosts) {
+    warnedMissingAllowedHosts = true
+    console.warn(
+      '[duck-upload] multipartStrategy: no `allowedHosts` configured. Signed part URLs will be host-unrestricted. ' +
+        'Set MultipartStrategy.Config.allowedHosts to lock the upload host.',
+    )
+  }
+  validateUploadUrl(rawUrl, 'multipart.signPart', opts)
 }
 
+// types moved to MultipartStrategy namespace above
+
+/**
+ * S3/GCS-compatible Resumable Multipart Upload Strategy.
+ *
+ * Slices files into chunks, uploads them concurrently using S3 PUT requests,
+ * and completes the upload on the backend once all chunks are transferred.
+ *
+ * @example
+ * ```ts
+ * const registry = createStrategyRegistry([
+ *   multipartStrategy({ maxPartConcurrency: 4 })
+ * ]);
+ * ```
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
 export function multipartStrategy<
-  M extends IntentMap & { multipart: MultipartIntent },
-  C extends CursorMap<M> & { multipart?: MultipartCursor },
+  M extends Contracts.Intent.Map & { multipart: MultipartStrategy.Intent },
+  C extends Contracts.Cursor.Map<M> & { multipart?: MultipartStrategy.Cursor },
   P extends string = string,
-  R extends UploadResultBase = UploadResultBase,
->(opts?: { maxPartConcurrency?: number }): UploadStrategy<M, C, P, R, 'multipart'> {
+  R extends Contracts.Result.Base = Contracts.Result.Base,
+>(opts?: MultipartStrategy.Config): Contracts.Strategy.Me<M, C, P, R, 'multipart'> {
   const maxPartConcurrency = Math.max(1, opts?.maxPartConcurrency ?? DEFAULT_MAX_PART_CONCURRENCY)
+  const allowedHosts = opts?.allowedHosts ?? []
+  const allowPrivateHosts = opts?.allowPrivateHosts === true
 
   return {
     id: 'multipart',
@@ -59,7 +143,7 @@ export function multipartStrategy<
       const totalBytes = ctx.file.size
       const partSize = Math.max(1, intent.partSize)
 
-      // Trust backend `partCount` when provided — S3-style backends enforce a maxParts rule.
+      // Trust backend `partCount` when provided  S3-style backends enforce a maxParts rule.
       const totalParts = Math.max(1, intent.partCount ?? Math.ceil(totalBytes / partSize))
 
       const cursor = ctx.readCursor()
@@ -100,89 +184,88 @@ export function multipartStrategy<
       const running = new Set<Promise<void>>()
 
       const getSignedPart = async (partNumber: number) => {
-        // Legacy fast path: backend pre-signed all parts in `intent.parts`.
+        // Fast path: backend pre-signed all parts in `intent.parts`.
         const fromIntent = intent.parts?.find((x) => x.partNumber === partNumber)
         if (fromIntent) return fromIntent
 
         if (!ctx.api.multipart?.signPart) {
-          throw new Error(
-            'multipart.signPart is missing in UploadApi. Implement it to call your backend sign-part endpoint.',
-          )
+          throw new UploadEngineError('validation_failed', {
+            message:
+              'multipart.signPart is missing in UploadApi. Implement it to call your backend sign-part endpoint.',
+          })
         }
 
         const out = await ctx.api.multipart.signPart(
-          { fileId: intent.fileId, uploadId: intent.uploadId, partNumber },
-          { signal: ctx.signal },
+          { fileId: intent.fileId, uploadId: intent.uploadId, partNumber, attempt: ctx.attempt },
+          {
+            localId: ctx.localId,
+            purpose: ctx.purpose,
+            file: ctx.file,
+            intent: ctx.intent,
+            signal: ctx.signal,
+            fingerprint: ctx.fingerprint,
+            attempt: ctx.attempt,
+            createdAt: ctx.createdAt,
+            steps: ctx.steps,
+            meta: ctx.meta,
+            lastError: ctx.lastError,
+          },
         )
 
         return { partNumber, url: out.url, headers: out.headers }
       }
 
-      const uploadOne = async (
-        p: { partNumber: number; start: number; end: number },
-        retryCount = 0,
-      ): Promise<void> => {
-        const maxRetries = 3
-        try {
-          const blob = ctx.file.slice(p.start, p.end)
-          const size = blob.size
-
-          const signed = await getSignedPart(p.partNumber)
-
-          const res = await ctx.transport.put({
-            url: signed.url,
-            body: blob,
-            headers: signed.headers,
-            signal: ctx.signal,
-            onProgress: (loaded) => {
-              inflightBytes.set(p.partNumber, loaded)
+      const uploadOne = (p: { partNumber: number; start: number; end: number }): Promise<void> =>
+        withRetry(
+          async () => {
+            try {
+              const blob = ctx.file.slice(p.start, p.end)
+              const size = blob.size
+
+              const signed = await getSignedPart(p.partNumber)
+
+              validatePartUrl(signed.url, { allowedHosts, allowPrivateHosts })
+
+              const res = await ctx.transport.put({
+                url: signed.url,
+                body: blob,
+                headers: signed.headers ?? {},
+                signal: ctx.signal,
+                onProgress: (loaded) => {
+                  inflightBytes.set(p.partNumber, loaded)
+                  report()
+                },
+              })
+
+              inflightBytes.delete(p.partNumber)
+
+              const etag = res.etag
+              if (!etag) {
+                throw new UploadEngineError('upload_failed', {
+                  message:
+                    'Missing ETag from upload part response. Ensure MinIO/S3 CORS exposes ETag (Access-Control-Expose-Headers: ETag).',
+                })
+              }
+
+              finishedBytes += size
+              done.set(p.partNumber, { etag, size })
+
+              const snapshot: MultipartStrategy.Cursor = {
+                done: Array.from(done.entries())
+                  .map(([partNumber, v]) => ({ partNumber, etag: v.etag, size: v.size }))
+                  .sort((a, b) => a.partNumber - b.partNumber),
+              }
+              ctx.persistCursor(snapshot as C['multipart'])
               report()
-            },
-          })
-
-          inflightBytes.delete(p.partNumber)
-
-          const etag = res.etag
-          if (!etag) {
-            throw new Error(
-              'Missing ETag from upload part response. Ensure MinIO/S3 CORS exposes ETag (Access-Control-Expose-Headers: ETag).',
-            )
-          }
-
-          finishedBytes += size
-          done.set(p.partNumber, { etag, size })
-
-          const snapshot: MultipartCursor = {
-            done: Array.from(done.entries())
-              .map(([partNumber, v]) => ({ partNumber, etag: v.etag, size: v.size }))
-              .sort((a, b) => a.partNumber - b.partNumber),
-          }
-          ctx.persistCursor(snapshot as C['multipart'])
-          report()
-        } catch (err) {
-          inflightBytes.delete(p.partNumber)
-
-          if (ctx.signal?.aborted || isAbort(err)) throw err
-
-          // Retry transient network errors with exponential backoff.
-          if (retryCount < maxRetries) {
-            const msg = err instanceof Error ? err.message : String(err)
-            const retryable =
-              /network/i.test(msg) ||
-              /timeout/i.test(msg) ||
-              /5\d\d/.test(msg) ||
-              /ECONNRESET/i.test(msg) ||
-              /EHOSTUNREACH/i.test(msg)
-
-            if (retryable) {
-              await sleep(2 ** retryCount * 500)
-              return uploadOne(p, retryCount + 1)
+            } catch (err) {
+              // Clear this part's in-flight bytes before retry/rethrow so the
+              // progress total does not double-count a re-attempted part.
+              inflightBytes.delete(p.partNumber)
+              throw err
             }
-          }
-
-          throw err
-        }
-      }
+          },
+          { signal: ctx.signal },
+        )
 
       while (queue.length > 0 || running.size > 0) {
         while (queue.length > 0 && running.size < maxPartConcurrency) {
@@ -208,9 +291,10 @@ export function multipartStrategy<
       async function completeMultipart() {
         if (alreadyCompleted) return
         if (!ctx.api.multipart?.completeMultipart) {
-          throw new Error(
-            'multipart.completeMultipart is missing in UploadApi. Implement it to call your backend complete endpoint.',
-          )
+          throw new UploadEngineError('validation_failed', {
+            message:
+              'multipart.completeMultipart is missing in UploadApi. Implement it to call your backend complete endpoint.',
+          })
         }
 
         const parts = Array.from(done.entries())
@@ -218,16 +302,30 @@ export function multipartStrategy<
           .sort((a, b) => a.partNumber - b.partNumber)
 
         if (parts.length !== totalParts) {
-          throw new Error(`Cannot complete multipart: expected ${totalParts} parts, got ${parts.length}`)
+          throw new UploadEngineError('complete_failed', {
+            message: `Cannot complete multipart: expected ${totalParts} parts, got ${parts.length}`,
+          })
         }
 
         await ctx.api.multipart.completeMultipart(
           { fileId: intent.fileId, uploadId: intent.uploadId, parts },
-          { signal: ctx.signal },
+          {
+            localId: ctx.localId,
+            purpose: ctx.purpose,
+            file: ctx.file,
+            intent: ctx.intent,
+            signal: ctx.signal,
+            fingerprint: ctx.fingerprint,
+            attempt: ctx.attempt,
+            createdAt: ctx.createdAt,
+            steps: ctx.steps,
+            meta: ctx.meta,
+            lastError: ctx.lastError,
+          },
         )
 
         // Persist `completed: true` so resume after this point does not re-call `completeMultipart`.
-        const snapshot: MultipartCursor = {
+        const snapshot: MultipartStrategy.Cursor = {
           done: Array.from(done.entries())
             .map(([partNumber, v]) => ({ partNumber, etag: v.etag, size: v.size }))
             .sort((a, b) => a.partNumber - b.partNumber),

package/src/strategies/post/__tests__/post-url-safety.test.ts

@@ -0,0 +1,119 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest'
+import { __resetPostWarningsForTests, type PostIntent, PostStrategy } from '../index'
+
+function makeCtx(url: string) {
+  const file = new File(['hello'], 'a.txt', { type: 'text/plain' })
+  return {
+    intent: { strategy: 'post', fileId: 'f', url, fields: {} } satisfies PostIntent,
+    file,
+    signal: new AbortController().signal,
+    reportProgress: vi.fn(),
+    transport: {
+      postForm: vi.fn(async () => ({ headers: {} })),
+    },
+  }
+}
+
+describe('PostStrategy SSRF guard', () => {
+  beforeEach(() => {
+    __resetPostWarningsForTests()
+  })
+
+  test('rejects file://', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects javascript:', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('javascript:alert(1)') as any)).rejects.toThrow(/forbidden protocol/)
+  })
+
+  test('rejects loopback', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://127.0.0.1/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects AWS metadata IPv4', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://169.254.169.254/up') as any)).rejects.toThrow(/private/)
+  })
+
+  test('rejects host outside allowedHosts', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('https://evil.example.com/up') as any)).rejects.toThrow(/allow-list/)
+  })
+
+  test('accepts allowlisted host', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up')
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(ctx.transport.postForm).toHaveBeenCalled()
+  })
+
+  test('allowPrivateHosts lets loopback through (opt-in)', async () => {
+    const s = PostStrategy({ allowPrivateHosts: true })
+    const ctx = makeCtx('https://127.0.0.1/up')
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+  })
+
+  test('warns once when allowedHosts not set', async () => {
+    const s = PostStrategy()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+      await s.start(makeCtx('https://up.example.com/up') as any).catch(() => {})
+      expect(warn).toHaveBeenCalledTimes(1)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  test('caller label is "post.intent"', async () => {
+    const s = PostStrategy()
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(makeCtx('file:///etc/passwd') as any)).rejects.toThrow(/post\.intent/)
+  })
+})
+
+describe('PostStrategy retry', () => {
+  beforeEach(() => {
+    __resetPostWarningsForTests()
+  })
+
+  test('retries a transient failure then succeeds', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'], maxRetries: 2 })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.postForm = vi.fn(async () => {
+      calls++
+      if (calls < 2) throw new Error('network error')
+      return { headers: {} }
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).resolves.toBeUndefined()
+    expect(calls).toBe(2)
+  })
+
+  test('does not retry a non-transient failure', async () => {
+    const s = PostStrategy({ allowedHosts: ['up.example.com'] })
+    const ctx = makeCtx('https://up.example.com/up')
+    let calls = 0
+    ctx.transport.postForm = vi.fn(async () => {
+      calls++
+      throw new Error('Upload failed with status 403')
+    })
+    // biome-ignore lint/suspicious/noExplicitAny: test ctx shape is a subset of the full strategy ctx
+    await expect(s.start(ctx as any)).rejects.toThrow(/403/)
+    expect(calls).toBe(1)
+  })
+})

package/src/strategies/post/index.ts

@@ -1,53 +1,135 @@
+import type { Contracts } from '../../core'
+import { UploadEngineError } from '../../core'
+import { validateUploadUrl } from '../../core/utils/url-safety'
+import { withRetry } from '../_shared/retry'
+
 /**
- * Presigned-POST strategy: a single `multipart/form-data` POST with
- * server-provided fields. Non-resumable; suitable for small/medium files.
+ * Types for the presigned HTTP POST upload strategy.
+ * @author wildduck2 <https://github.com/wildduck2>
  */
+export namespace PostStrategy {
+  /**
+   * Presigned HTTP POST strategy configuration options.
+   */
+  export type Config = {
+    /**
+     * Case-insensitive allow-list of host names (with optional port). When
+     * set, the presigned POST URL must match a listed host or it is rejected.
+     */
+    allowedHosts?: string[]
+    /**
+     * When `true`, allow private-network IP literals in the POST URL.
+     * Defaults to `false`.
+     */
+    allowPrivateHosts?: boolean
+    /**
+     * Retries after the first attempt for transient network failures.
+     * Defaults to the shared retry default (3).
+     */
+    maxRetries?: number
+  }
+
+  /**
+   * Presigned HTTP POST intent payload mapping parameters returned by backend endpoints.
+   */
+  export type Intent = {
+    /** Discriminant identifier matching strategy configuration registry keys. */
+    strategy: 'post'
+    /** Unique database identifier for the file resource. */
+    fileId: string
+    /** Presigned POST action destination URL (e.g. presigned S3/GCS bucket location). */
+    url: string
+    /** Key/value pair list representing form properties (e.g. AWS credential fields, policies). */
+    fields: Record<string, string>
+    /** Optional epoch string indicating when the pre-signed credentials lapse. */
+    expiresAt?: string
+  }
 
-import type { CursorMap, IntentMap, UploadResultBase, UploadStrategy } from '../../core/contracts'
-
-export type PostIntent = {
-  strategy: 'post'
-  fileId: string
-  /** Presigned POST URL (form action). */
-  url: string
-  /** Form fields to include before the file. */
-  fields: Record<string, string>
-  /** Optional expiry of the presigned URL. */
-  expiresAt?: string
+  /**
+   * Direct strategy cursor state representing that no resumable bytes exist.
+   */
+  export type Cursor = Record<string, never>
 }
 
-export type PostCursor = {
-  /** Bytes uploaded — progress display only; not used for resume. */
-  uploadedBytes: number
+/** Convenience alias for {@link PostStrategy.Intent}. */
+export type PostIntent = PostStrategy.Intent
+
+let warnedMissingAllowedHosts = false
+
+/**
+ * Reset the warn-once latch. Test-only.
+ * @internal
+ */
+export function __resetPostWarningsForTests(): void {
+  warnedMissingAllowedHosts = false
 }
 
+/**
+ * Presigned HTTP POST form strategy.
+ *
+ * Sends the entire file along with backend policy fields as a single
+ * `multipart/form-data` request body. Does not support resumability.
+ *
+ * Security: the presigned URL is backend-supplied and flows straight to the
+ * transport, so a compromised backend or MITM could return a `file:`,
+ * `javascript:`, or private-network URL. Every URL is checked with
+ * {@link validateUploadUrl}; set {@link PostStrategy.Config.allowedHosts} to
+ * lock it to known hosts, or leave `allowPrivateHosts` at its default `false`
+ * to block loopback/private addresses.
+ *
+ * @example
+ * ```ts
+ * const strategies = createStrategyRegistry([
+ *   PostStrategy({ allowedHosts: ['uploads.example.com'] }),
+ *   MultipartStrategy()
+ * ]);
+ * ```
+ * @author wildduck2 <https://github.com/wildduck2>
+ */
 export function PostStrategy<
-  M extends IntentMap & { post: PostIntent },
-  C extends CursorMap<M> & { post?: PostCursor },
-  P extends string = string,
-  R extends UploadResultBase = UploadResultBase,
->(): UploadStrategy<M, C, P, R, 'post'> {
+  M extends Contracts.Intent.Map,
+  C extends Contracts.Cursor.Map<M>,
+  P extends string,
+  R extends Contracts.Result.Base = Contracts.Result.Base,
+>(opts: PostStrategy.Config = {}): Contracts.Strategy.Me<M, C, P, R, 'post'> {
+  const allowedHosts = opts.allowedHosts ?? []
+  const allowPrivateHosts = opts.allowPrivateHosts === true
+
   return {
     id: 'post',
     resumable: false,
 
     async start(ctx) {
-      const intent = ctx.intent
+      const intent = ctx.intent as unknown as PostStrategy.Intent
 
       if (!intent.url) {
-        throw new Error('Direct strategy: intent missing url/uploadUrl')
+        throw new UploadEngineError('validation_failed', { message: 'post.start: intent missing url' })
       }
 
-      await ctx.transport.postForm({
-        url: intent.url,
-        file: ctx.file,
-        fields: intent.fields,
-        filename: ctx.file.name,
-        signal: ctx.signal,
-        onProgress(uploadedBytes, totalBytes) {
-          ctx.reportProgress({ uploadedBytes, totalBytes })
-        },
-      })
+      if (allowedHosts.length === 0 && !warnedMissingAllowedHosts) {
+        warnedMissingAllowedHosts = true
+        console.warn(
+          '[duck-upload] PostStrategy: no `allowedHosts` configured. Presigned POST URLs will be host-unrestricted. ' +
+            'Set PostStrategy.Config.allowedHosts to lock the upload host.',
+        )
+      }
+
+      validateUploadUrl(intent.url, 'post.intent', { allowedHosts, allowPrivateHosts })
+
+      await withRetry(
+        () =>
+          ctx.transport.postForm({
+            url: intent.url,
+            file: ctx.file,
+            fields: intent.fields,
+            filename: ctx.file.name,
+            signal: ctx.signal,
+            onProgress(uploadedBytes, totalBytes) {
+              ctx.reportProgress({ uploadedBytes, totalBytes })
+            },
+          }),
+        { signal: ctx.signal, ...(opts.maxRetries !== undefined ? { maxRetries: opts.maxRetries } : {}) },
+      )
     },
   }
 }