@miiajs/multipart 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ruslan Matiushev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @miiajs/multipart
+
+Streaming `multipart/form-data` for MiiaJS - `@Multipart` with a backpressured part iterator, per-file and per-form limits, buffered `ctx.form()`, and `@ValidateForm`.
+
+## Installation
+
+```bash
+npm install @miiajs/multipart
+```
+
+## Documentation
+
+**[miiajs.com/docs/packages/multipart](https://miiajs.com/docs/packages/multipart)**
+
+## License
+
+MIT

package/dist/content-disposition.d.ts

@@ -0,0 +1,19 @@
+export interface ParsedDisposition {
+    name?: string;
+    filename?: string;
+}
+/**
+ * `Content-Disposition` reader for part headers.
+ *
+ * multipasta 0.2.8 reads the header with fast-content-type-parse, whose
+ * quoted-string pattern stops at U+00FF: a single character above it voids the
+ * whole header, so `name="файл"; filename="фото.png"` arrives as no name and no
+ * filename at all. The raw header survives on `info.headers`, so the bridge
+ * takes both parameters from here instead.
+ *
+ * RFC 7578 prescribes raw UTF-8 for these parameters and advises against
+ * RFC 2231/5987 encoding, so `filename*` is ignored in favour of `filename` -
+ * which is what the runtime parsers do as well.
+ */
+export declare function parseContentDisposition(header: string | string[] | undefined): ParsedDisposition;
+//# sourceMappingURL=content-disposition.d.ts.map

package/dist/content-disposition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-disposition.d.ts","sourceRoot":"","sources":["../src/content-disposition.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,iBAAiB,CAkBhG"}

package/dist/content-disposition.js

@@ -0,0 +1,35 @@
+import { scanParams } from './params.js';
+const EMPTY = {};
+/**
+ * `Content-Disposition` reader for part headers.
+ *
+ * multipasta 0.2.8 reads the header with fast-content-type-parse, whose
+ * quoted-string pattern stops at U+00FF: a single character above it voids the
+ * whole header, so `name="файл"; filename="фото.png"` arrives as no name and no
+ * filename at all. The raw header survives on `info.headers`, so the bridge
+ * takes both parameters from here instead.
+ *
+ * RFC 7578 prescribes raw UTF-8 for these parameters and advises against
+ * RFC 2231/5987 encoding, so `filename*` is ignored in favour of `filename` -
+ * which is what the runtime parsers do as well.
+ */
+export function parseContentDisposition(header) {
+    // A part with two `content-disposition` headers arrives as an array; the
+    // engine reads nothing out of that shape either.
+    if (typeof header !== 'string')
+        return EMPTY;
+    const semi = header.indexOf(';');
+    if (semi === -1)
+        return EMPTY;
+    let name;
+    let filename;
+    scanParams(header, semi + 1, (key, value) => {
+        // Last one wins, as it does in the engine and in the runtime parsers.
+        if (key === 'name')
+            name = value;
+        else if (key === 'filename')
+            filename = value;
+    });
+    return name === undefined && filename === undefined ? EMPTY : { name, filename };
+}
+//# sourceMappingURL=content-disposition.js.map

package/dist/content-disposition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-disposition.js","sourceRoot":"","sources":["../src/content-disposition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC,MAAM,KAAK,GAAsB,EAAE,CAAA;AAEnC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAqC;IAC3E,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE7B,IAAI,IAAwB,CAAA;IAC5B,IAAI,QAA4B,CAAA;IAEhC,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1C,sEAAsE;QACtE,IAAI,GAAG,KAAK,MAAM;YAAE,IAAI,GAAG,KAAK,CAAA;aAC3B,IAAI,GAAG,KAAK,UAAU;YAAE,QAAQ,GAAG,KAAK,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAClF,CAAC"}

package/dist/content-type.d.ts

@@ -0,0 +1,16 @@
+export interface ParsedContentType {
+    mediaType: string;
+    boundary?: string;
+}
+/**
+ * The media type of a `Content-Type` header - parameters dropped, trimmed,
+ * lower-cased. Read for the request header and for every part header.
+ */
+export declare function parseMediaType(header: string): string;
+/**
+ * Minimal `Content-Type` reader. Only the media type and the `boundary`
+ * parameter are needed: the media type gates the request, the boundary length
+ * sizes the tail buffer in the bridge.
+ */
+export declare function parseContentType(header: string): ParsedContentType;
+//# sourceMappingURL=content-type.d.ts.map

package/dist/content-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type.d.ts","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAMlE"}

package/dist/content-type.js

@@ -0,0 +1,33 @@
+import { scanParams } from './params.js';
+/**
+ * The media type of a `Content-Type` header - parameters dropped, trimmed,
+ * lower-cased. Read for the request header and for every part header.
+ */
+export function parseMediaType(header) {
+    const semi = header.indexOf(';');
+    return (semi === -1 ? header : header.slice(0, semi)).trim().toLowerCase();
+}
+/**
+ * Minimal `Content-Type` reader. Only the media type and the `boundary`
+ * parameter are needed: the media type gates the request, the boundary length
+ * sizes the tail buffer in the bridge.
+ */
+export function parseContentType(header) {
+    const semi = header.indexOf(';');
+    const mediaType = parseMediaType(header);
+    if (semi === -1)
+        return { mediaType };
+    const boundary = extractBoundary(header, semi + 1);
+    return boundary === undefined ? { mediaType } : { mediaType, boundary };
+}
+function extractBoundary(header, start) {
+    let boundary;
+    scanParams(header, start, (name, value) => {
+        if (name !== 'boundary')
+            return true;
+        boundary = value;
+        return false;
+    });
+    return boundary;
+}
+//# sourceMappingURL=content-type.js.map

package/dist/content-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type.js","sourceRoot":"","sources":["../src/content-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAA;IAClD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa;IACpD,IAAI,QAA4B,CAAA;IAChC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;QACpC,QAAQ,GAAG,KAAK,CAAA;QAChB,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/decorators.d.ts

@@ -0,0 +1,36 @@
+import type { ZodLike } from '@miiajs/core';
+import type { MultipartOptions } from './types.js';
+/** Per-handler `@Multipart` options, read back at request time. */
+export declare const MULTIPART_OPTIONS: unique symbol;
+/**
+ * Streams a `multipart/form-data` body: the handler gets `ctx.parts` (an async
+ * iterator over the parts, one consumed at a time) and `ctx.form()` (the whole
+ * form buffered into `File`s and strings). Type the handler's context as
+ * `MultipartContext` to see both.
+ *
+ * A non-`multipart/form-data` request is rejected with 400 before the handler
+ * runs, whether or not it reads the body, and whatever is left unread is
+ * discarded once the handler returns.
+ *
+ * Body budget: an explicit `bodyLimit` wins; otherwise
+ * `maxFileSize * maxFiles + fieldsBudget` becomes the route's limit when both
+ * are finite; with neither, a `@BodyLimit` on the route (or its controller)
+ * becomes the budget, and without one only the adapter ceiling applies. The
+ * route limit belongs to whichever decorator wrote it last, so do not put
+ * `@Multipart` and `@BodyLimit` on the same method.
+ */
+export declare const Multipart: (options?: MultipartOptions | undefined) => (target: Function, context: ClassMethodDecoratorContext) => void;
+/**
+ * Validates the buffered form against a schema. What the schema sees is a flat
+ * object - text fields as strings (last value wins) next to files under their
+ * own names, a single `File` or a `File[]` when the name repeats - which is how
+ * a multipart body is described in OpenAPI, so a schema reads as
+ * `z.object({ title: z.string(), doc: z.instanceof(File) })`.
+ *
+ * A failed parse answers 422 with the schema's issues; a successful one
+ * replaces the cached form, so `ctx.form<T>()` returns the schema's data
+ * instead of the raw `FormResult`. The method also needs `@Multipart` - in
+ * either order.
+ */
+export declare const ValidateForm: (schema: ZodLike<any>) => (target: Function, context: ClassMethodDecoratorContext) => void;
+//# sourceMappingURL=decorators.d.ts.map

package/dist/decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAA8B,OAAO,EAAE,MAAM,cAAc,CAAA;AAGvE,OAAO,KAAK,EAAc,gBAAgB,EAAiB,MAAM,YAAY,CAAA;AAE7E,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,eAA6B,CAAA;AAsC3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,SAAS,8GAYpB,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,4FAqBvB,CAAA"}

package/dist/decorators.js

@@ -0,0 +1,174 @@
+import { addToMapMeta, BODY_LIMITS, createMethodDecorator, METHOD_MW, setInMapMeta, UnprocessableException, } from '@miiajs/core';
+import { collectForm } from './form.js';
+import { createPartStream, DEFAULT_FIELDS_BUDGET } from './parser.js';
+/** Per-handler `@Multipart` options, read back at request time. */
+export const MULTIPART_OPTIONS = Symbol('multipartOptions');
+const MULTIPART_STATE = Symbol('multipartState');
+/**
+ * The class's decorator metadata, which `tsc` creates only when
+ * `Symbol.metadata` exists at class-definition time - a build that drops
+ * `@miiajs/core`'s polyfill import leaves it `undefined`, and the decorators
+ * below would then fail deep inside a metadata write.
+ */
+function metadataOf(context, decorator) {
+    const metadata = context.metadata;
+    if (!metadata) {
+        throw new TypeError(`@${decorator} cannot read decorator metadata. Import @miiajs/core before the decorated class is defined - its Symbol.metadata polyfill has to run first.`);
+    }
+    return metadata;
+}
+/**
+ * Streams a `multipart/form-data` body: the handler gets `ctx.parts` (an async
+ * iterator over the parts, one consumed at a time) and `ctx.form()` (the whole
+ * form buffered into `File`s and strings). Type the handler's context as
+ * `MultipartContext` to see both.
+ *
+ * A non-`multipart/form-data` request is rejected with 400 before the handler
+ * runs, whether or not it reads the body, and whatever is left unread is
+ * discarded once the handler returns.
+ *
+ * Body budget: an explicit `bodyLimit` wins; otherwise
+ * `maxFileSize * maxFiles + fieldsBudget` becomes the route's limit when both
+ * are finite; with neither, a `@BodyLimit` on the route (or its controller)
+ * becomes the budget, and without one only the adapter ceiling applies. The
+ * route limit belongs to whichever decorator wrote it last, so do not put
+ * `@Multipart` and `@BodyLimit` on the same method.
+ */
+export const Multipart = createMethodDecorator((_target, context, options = {}) => {
+    const name = String(context.name);
+    const metadata = metadataOf(context, 'Multipart');
+    setInMapMeta(metadata, MULTIPART_OPTIONS, name, options);
+    const bodyLimit = options.bodyLimit ?? deriveBodyLimit(options);
+    if (bodyLimit !== undefined)
+        setInMapMeta(metadata, BODY_LIMITS, name, bodyLimit);
+    // Options come from the metadata, not from this closure: the state may be
+    // built by whichever multipart middleware the decorator order put outside.
+    const mw = (ctx, next) => withMultipartState(ctx, runtimeOptions(metadata, name), () => next());
+    addToMapMeta(metadata, METHOD_MW, name, [mw]);
+});
+/**
+ * Validates the buffered form against a schema. What the schema sees is a flat
+ * object - text fields as strings (last value wins) next to files under their
+ * own names, a single `File` or a `File[]` when the name repeats - which is how
+ * a multipart body is described in OpenAPI, so a schema reads as
+ * `z.object({ title: z.string(), doc: z.instanceof(File) })`.
+ *
+ * A failed parse answers 422 with the schema's issues; a successful one
+ * replaces the cached form, so `ctx.form<T>()` returns the schema's data
+ * instead of the raw `FormResult`. The method also needs `@Multipart` - in
+ * either order.
+ */
+export const ValidateForm = createMethodDecorator((_target, context, schema) => {
+    const name = String(context.name);
+    const metadata = metadataOf(context, 'ValidateForm');
+    const mw = async (ctx, next) => {
+        const declared = metadata[MULTIPART_OPTIONS];
+        if (!declared?.has(name)) {
+            throw new Error(`@ValidateForm on "${name}" needs @Multipart on the same method - there is no form to validate`);
+        }
+        await withMultipartState(ctx, runtimeOptions(metadata, name), async (state) => {
+            const result = schema.safeParse(flattenForm(await ctx.form()));
+            if (!result.success) {
+                throw new UnprocessableException('Form validation failed', result.error.issues);
+            }
+            state.setForm(result.data);
+            await next();
+        });
+    };
+    addToMapMeta(metadata, METHOD_MW, name, [mw]);
+});
+/** Fields and files side by side under their own names, the way a schema reads them. */
+function flattenForm({ files, fields }) {
+    const flat = { ...fields };
+    for (const [name, group] of Object.entries(files)) {
+        flat[name] = group.length === 1 ? group[0] : group;
+    }
+    return flat;
+}
+/**
+ * Runs the rest of the pipeline with `ctx.parts` and `ctx.form()` in place.
+ * Both multipart middlewares call it, so the decorator order does not matter.
+ *
+ * Whoever built the state disposes of it: an outer `@ValidateForm` answering
+ * 422 keeps the `@Multipart` middleware from ever running, so the stream would
+ * otherwise be left behind by the one middleware that could not clean up.
+ */
+async function withMultipartState(ctx, options, run) {
+    const target = ctx;
+    const existing = target[MULTIPART_STATE];
+    if (existing)
+        return run(existing);
+    const state = createState(target, options);
+    try {
+        await run(state);
+    }
+    finally {
+        await state.parts.return?.();
+    }
+}
+/** Attaches `ctx.parts` and `ctx.form()` for the rest of the request. */
+function createState(target, options) {
+    const parts = createPartStream(target.req, options);
+    const state = {
+        parts,
+        partsUsed: false,
+        form: null,
+        setForm(data) {
+            state.form = Promise.resolve(data);
+        },
+    };
+    target[MULTIPART_STATE] = state;
+    target.parts = trackParts(state);
+    target.form = () => {
+        if (state.form === null && state.partsUsed) {
+            return Promise.reject(new TypeError('ctx.form() cannot run after ctx.parts - the body is consumed once, in one of the two ways'));
+        }
+        return (state.form ??= collectForm(state.parts));
+    };
+    return state;
+}
+/**
+ * `ctx.parts`, wrapped so the two ways of reading the body cannot be mixed.
+ *
+ * Both read the same source, so whichever runs second finds it spent. Left
+ * alone that surfaces as an empty form or an empty loop - the shape of failure
+ * that looks like a working request with no data in it.
+ */
+function trackParts(state) {
+    const tracked = {
+        [Symbol.asyncIterator]() {
+            return tracked;
+        },
+        next() {
+            if (state.form !== null) {
+                return Promise.reject(new TypeError('ctx.parts cannot run after ctx.form() - the body is consumed once, in one of the two ways'));
+            }
+            state.partsUsed = true;
+            return state.parts.next();
+        },
+        return: () => state.parts.return?.() ?? Promise.resolve({ value: undefined, done: true }),
+    };
+    return tracked;
+}
+/**
+ * The route's options with the body budget resolved down to its last fallback:
+ * the metadata is complete by request time, so a `@BodyLimit` written by
+ * another decorator can still become `maxTotalSize`.
+ */
+function runtimeOptions(metadata, name) {
+    const options = metadata[MULTIPART_OPTIONS]?.get(name) ?? {};
+    if (options.bodyLimit !== undefined || deriveBodyLimit(options) !== undefined)
+        return options;
+    const limits = metadata[BODY_LIMITS];
+    const bodyLimit = limits?.get(name) ?? limits?.get('*');
+    return bodyLimit === undefined ? options : { ...options, bodyLimit };
+}
+function deriveBodyLimit(options) {
+    const { maxFileSize, maxFiles } = options;
+    if (maxFileSize === undefined || maxFiles === undefined)
+        return undefined;
+    if (!Number.isFinite(maxFileSize) || !Number.isFinite(maxFiles))
+        return undefined;
+    return maxFileSize * maxFiles + (options.fieldsBudget ?? DEFAULT_FIELDS_BUDGET);
+}
+//# sourceMappingURL=decorators.js.map

package/dist/decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,SAAS,EACT,YAAY,EACZ,sBAAsB,GACvB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGrE,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE3D,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;AAIhD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,OAAoC,EAAE,SAAiB;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CACjB,IAAI,SAAS,6IAA6I,CAC3J,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;IAC9G,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACjD,YAAY,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAExD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAEjF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,GAAe,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3G,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAEpD,MAAM,EAAE,GAAe,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAA8C,CAAA;QACzF,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,sEAAsE,CAAC,CAAA;QAClH,CAAC;QAED,MAAM,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,MAAO,GAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACnF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEF,wFAAwF;AACxF,SAAS,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAc;IAChD,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAA;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAmB,EACnB,OAAyB,EACzB,GAA6C;IAE7C,MAAM,MAAM,GAAG,GAAsB,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;IACxC,IAAI,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAA;IAElC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9B,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,MAAuB,EAAE,OAAyB;IACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAmB;QAC5B,KAAK;QACL,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,IAAI;QACV,OAAO,CAAC,IAAI;YACV,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;KACF,CAAA;IACD,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,CAAA;IAC/B,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,CAAC,IAAI,GAAG,GAA+B,EAAE;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,SAAS,CAAC,2FAA2F,CAAC,CAC3G,CAAA;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAe,CAAA;IAChE,CAAC,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAqB;IACvC,MAAM,OAAO,GAAyC;QACpD,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,IAAI;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,SAAS,CAAC,2FAA2F,CAAC,CAC3G,CAAA;YACH,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;YACtB,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC3B,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAa,EAAE,CAAC;KACnG,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAkB,EAAE,IAAY;IACtD,MAAM,OAAO,GAAI,QAAQ,CAAC,iBAAiB,CAA+C,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3G,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IAE7F,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAoC,CAAA;IACvE,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;IACvD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAA;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,OAAyB;IAChD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACzC,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACjF,OAAO,WAAW,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAA;AACjF,CAAC"}

package/dist/form.d.ts

@@ -0,0 +1,11 @@
+import type { FormResult, MultipartPart } from './types.js';
+/**
+ * Drains the part iterator in a single pass: files are buffered into `File`
+ * objects grouped by part name, fields collapse to the last value under their
+ * name.
+ *
+ * A part with `filename=""` and no bytes is an empty `<input type="file">`, not
+ * an upload - it is left out of `files` while staying visible on `ctx.parts`.
+ */
+export declare function collectForm(parts: AsyncIterableIterator<MultipartPart>): Promise<FormResult>;
+//# sourceMappingURL=form.d.ts.map

package/dist/form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.d.ts","sourceRoot":"","sources":["../src/form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE3D;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,qBAAqB,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBlG"}

package/dist/form.js

@@ -0,0 +1,30 @@
+/**
+ * Drains the part iterator in a single pass: files are buffered into `File`
+ * objects grouped by part name, fields collapse to the last value under their
+ * name.
+ *
+ * A part with `filename=""` and no bytes is an empty `<input type="file">`, not
+ * an upload - it is left out of `files` while staying visible on `ctx.parts`.
+ */
+export async function collectForm(parts) {
+    const files = {};
+    const fields = {};
+    for await (const part of parts) {
+        if (part.type === 'field') {
+            fields[part.name] = part.value;
+            continue;
+        }
+        const bytes = await part.bytes();
+        if (!part.filename && bytes.length === 0)
+            continue;
+        // `File` wants an ArrayBuffer-backed view; the parser never yields a shared one.
+        const file = new File([bytes], part.filename ?? '', { type: part.mediaType });
+        const existing = files[part.name];
+        if (existing)
+            existing.push(file);
+        else
+            files[part.name] = [file];
+    }
+    return { files, fields };
+}
+//# sourceMappingURL=form.js.map

package/dist/form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.js","sourceRoot":"","sources":["../src/form.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA2C;IAC3E,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;YAC9B,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAElD,iFAAiF;QACjF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,KAAgC,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { Multipart, ValidateForm } from './decorators.js';
+export { createPartStream } from './parser.js';
+export type { FieldPart, FilePart, FormResult, MultipartContext, MultipartOptions, MultipartPart, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EACV,SAAS,EACT,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,4 @@
+// @miiajs/multipart - public API
+export { Multipart, ValidateForm } from './decorators.js';
+export { createPartStream } from './parser.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/params.d.ts

@@ -0,0 +1,11 @@
+/**
+ * One pass over an RFC 7231 parameter list - `; name=value` repeated, the value
+ * bare or quoted. `Content-Type` and `Content-Disposition` are read with the
+ * same walk, so a defect fixed here is fixed for both.
+ *
+ * A parameter name ends at the nearest `;`, never at an `=` further along: a
+ * valueless `foo` between two real parameters is skipped instead of swallowing
+ * the name that follows it. `visit` returning `false` ends the walk.
+ */
+export declare function scanParams(input: string, start: number, visit: (name: string, value: string) => boolean | void): void;
+//# sourceMappingURL=params.d.ts.map

package/dist/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,GAAG,IAAI,CAmCrH"}

package/dist/params.js

@@ -0,0 +1,47 @@
+/**
+ * One pass over an RFC 7231 parameter list - `; name=value` repeated, the value
+ * bare or quoted. `Content-Type` and `Content-Disposition` are read with the
+ * same walk, so a defect fixed here is fixed for both.
+ *
+ * A parameter name ends at the nearest `;`, never at an `=` further along: a
+ * valueless `foo` between two real parameters is skipped instead of swallowing
+ * the name that follows it. `visit` returning `false` ends the walk.
+ */
+export function scanParams(input, start, visit) {
+    let i = start;
+    while (i < input.length) {
+        const semi = input.indexOf(';', i);
+        const eq = input.indexOf('=', i);
+        if (eq === -1 || (semi !== -1 && semi < eq)) {
+            if (semi === -1)
+                return;
+            i = semi + 1;
+            continue;
+        }
+        const name = input.slice(i, eq).trim().toLowerCase();
+        let j = eq + 1;
+        while (j < input.length && (input[j] === ' ' || input[j] === '\t'))
+            j++;
+        let value = '';
+        if (input[j] === '"') {
+            j++;
+            while (j < input.length && input[j] !== '"') {
+                if (input[j] === '\\' && j + 1 < input.length)
+                    j++;
+                value += input[j];
+                j++;
+            }
+            const next = input.indexOf(';', j);
+            i = next === -1 ? input.length : next + 1;
+        }
+        else {
+            const next = input.indexOf(';', j);
+            const end = next === -1 ? input.length : next;
+            value = input.slice(j, end).trim();
+            i = next === -1 ? input.length : next + 1;
+        }
+        if (visit(name, value) === false)
+            return;
+    }
+}
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,KAAsD;IAC7G,IAAI,CAAC,GAAG,KAAK,CAAA;IAEb,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAClC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC5C,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,OAAM;YACvB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;YACZ,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,EAAE,CAAA;QAEvE,IAAI,KAAK,GAAG,EAAE,CAAA;QACd,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;oBAAE,CAAC,EAAE,CAAA;gBAClD,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;gBACjB,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAClC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;YAC7C,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YAClC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,KAAK;YAAE,OAAM;IAC1C,CAAC;AACH,CAAC"}

package/dist/parser.d.ts

@@ -0,0 +1,12 @@
+import type { MultipartOptions, MultipartPart } from './types.js';
+export declare const DEFAULT_FIELDS_BUDGET: number;
+/**
+ * Streams a `multipart/form-data` request as an async iterator of parts.
+ *
+ * Backpressure is real: the source is only read when every queue the consumer
+ * can still drain is empty. Exactly one part is consumed at a time - moving the
+ * iterator forward abandons the previous part and errors its stream rather than
+ * closing it, so a half-read upload can never look complete.
+ */
+export declare function createPartStream(req: Request, options?: MultipartOptions): AsyncIterableIterator<MultipartPart>;
+//# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAY,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAI3E,eAAO,MAAM,qBAAqB,QAAY,CAAA;AAgE9C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CA2cnH"}