@modern-admin/feature-upload 0.2.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Modern Admin contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AASH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAE5B,MAAM,uBAAuB,CAAA;AAS9B,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,6BAAkC,GAC1C,CAAC,GAAG,EAAE,gBAAgB,KAAK,sBAAsB,CAwFnD"}
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AASH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAE5B,MAAM,uBAAuB,CAAA;AAW9B,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,6BAAkC,GAC1C,CAAC,GAAG,EAAE,gBAAgB,KAAK,sBAAsB,CAuGnD"}

package/dist/graphql.js

@@ -27,6 +27,8 @@ import { GraphQLBoolean, GraphQLNonNull, GraphQLObjectType, GraphQLString, Graph
 import { ForbiddenError, ResourceNotFoundError } from '@modern-admin/core';
 import { UploadProviderRegistry } from './registry.js';
 import { PendingUploadsRegistry } from './pending-registry.js';
+import { isUnsafeKey, sanitizeFilename } from './path-safety.js';
+import { mimeMatches } from './mime.js';
 /** Default TTL for pending upload entries, mirrored from the controller. */
 const DEFAULT_PENDING_TTL_MS = 60 * 60 * 1000;
 export function uploadGraphqlExtension(options = {}) {
@@ -60,11 +62,25 @@ export function uploadGraphqlExtension(options = {}) {
                         const { resourceId, field } = args;
                         const { providerId, registered } = resolveProperty(ctx, resourceId, field);
                         const upload = args.file;
+                        // Server-side MIME / size enforcement (the multipart parser has
+                        // already applied the global hard size cap; this adds the tighter
+                        // per-property limits).
+                        if (!mimeMatches(upload.mimeType, registered.mimeTypes)) {
+                            throw new Error(`File type "${upload.mimeType}" is not allowed`);
+                        }
+                        if (registered.maxSize != null && upload.size > registered.maxSize) {
+                            throw new Error(`File exceeds the maximum size of ${registered.maxSize} bytes`);
+                        }
+                        // Sanitise the client filename before it can steer key generation.
+                        const originalName = sanitizeFilename(upload.filename);
                         const computedKey = registered.uploadPath
-                            ? registered.uploadPath(upload.filename)
+                            ? registered.uploadPath(originalName)
                             : undefined;
+                        if (computedKey !== undefined && isUnsafeKey(computedKey)) {
+                            throw new Error('Computed upload key is not allowed');
+                        }
                         const key = await registered.provider.upload({
-                            originalName: upload.filename,
+                            originalName,
                             mimeType: upload.mimeType,
                             size: upload.size,
                             buffer: upload.buffer,
@@ -74,7 +90,7 @@ export function uploadGraphqlExtension(options = {}) {
                         const info = {
                             key,
                             url,
-                            name: upload.filename,
+                            name: originalName,
                             size: upload.size,
                             mimeType: upload.mimeType,
                         };
@@ -96,6 +112,8 @@ export function uploadGraphqlExtension(options = {}) {
                         // the REST controller's check — prevents leaking arbitrary
                         // resource ids to authenticated clients.
                         resolveProperty(ctx, resourceId, field);
+                        if (isUnsafeKey(key))
+                            return false;
                         return PendingUploadsRegistry.cancel(key);
                     },
                 },
@@ -116,9 +134,9 @@ function resolveProperty(ctx, resourceId, field) {
     }
     catch (err) {
         if (err instanceof ResourceNotFoundError)
-            throw new Error(err.message);
+            throw new Error(err.message, { cause: err });
         if (err instanceof ForbiddenError)
-            throw new Error(err.message);
+            throw new Error(err.message, { cause: err });
         throw err;
     }
     const decorator = resource.decorate();

package/dist/graphql.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.js","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,SAAS,CAAA;AAMhB,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAG9D,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAW7C,MAAM,UAAU,sBAAsB,CACpC,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,EAA0B,EAAE;QAC5C,MAAM,oBAAoB,GAAG,IAAI,iBAAiB,CAAmC;YACnF,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,uDAAuD;YACpE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACb,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBAChD,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBAChD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBACjD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;aACtD,CAAC;SACH,CAAC,CAAA;QAEF,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,CAAC,oBAAoB,CAAC;YAC7B,SAAS,EAAE;gBACT,WAAW,EAAE;oBACX,IAAI,EAAE,IAAI,cAAc,CAAC,oBAAoB,CAAC;oBAC9C,WAAW,EACT,kEAAkE;wBAClE,qDAAqD;oBACvD,IAAI,EAAE;wBACJ,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBACvD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBAClD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE;qBAC3C;oBACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;wBAC3B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAA6C,CAAA;wBAC3E,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAKnB,CAAA;wBACD,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU;4BACvC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;4BACxC,CAAC,CAAC,SAAS,CAAA;wBACb,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAC1C;4BACE,YAAY,EAAE,MAAM,CAAC,QAAQ;4BAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,MAAM,EAAE,MAAM,CAAC,MAAM;yBACtB,EACD,WAAW,CACZ,CAAA;wBACD,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;wBACjD,MAAM,IAAI,GAAqB;4BAC7B,GAAG;4BACH,GAAG;4BACH,IAAI,EAAE,MAAM,CAAC,QAAQ;4BACrB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;yBAC1B,CAAA;wBACD,OAAO,IAAI,CAAA;oBACb,CAAC;iBACF;gBACD,iBAAiB,EAAE;oBACjB,IAAI,EAAE,IAAI,cAAc,CAAC,cAAc,CAAC;oBACxC,WAAW,EACT,kEAAkE;wBAClE,0DAA0D;oBAC5D,IAAI,EAAE;wBACJ,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBACvD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBAClD,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;qBACjD;oBACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;wBAC3B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAIlC,CAAA;wBACD,kEAAkE;wBAClE,2DAA2D;wBAC3D,yCAAyC;wBACzC,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBACvC,OAAO,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;oBAC3C,CAAC;iBACF;aACF;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,GAAmB,EACnB,UAAkB,EAClB,KAAa;IAEb,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtE,IAAI,GAAG,YAAY,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC/D,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,4BAA4B,UAAU,GAAG,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,gBAAsC,CAAA;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,kBAAkB,UAAU,kCAAkC;YAC9E,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,sBAAsB,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACnC,CAAC"}
+{"version":3,"file":"graphql.js","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,SAAS,CAAA;AAMhB,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAGvC,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAW7C,MAAM,UAAU,sBAAsB,CACpC,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,EAA0B,EAAE;QAC5C,MAAM,oBAAoB,GAAG,IAAI,iBAAiB,CAAmC;YACnF,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,uDAAuD;YACpE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACb,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBAChD,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBAChD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;gBACjD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;aACtD,CAAC;SACH,CAAC,CAAA;QAEF,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,CAAC,oBAAoB,CAAC;YAC7B,SAAS,EAAE;gBACT,WAAW,EAAE;oBACX,IAAI,EAAE,IAAI,cAAc,CAAC,oBAAoB,CAAC;oBAC9C,WAAW,EACT,kEAAkE;wBAClE,qDAAqD;oBACvD,IAAI,EAAE;wBACJ,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBACvD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBAClD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE;qBAC3C;oBACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;wBAC3B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAA6C,CAAA;wBAC3E,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAKnB,CAAA;wBACD,gEAAgE;wBAChE,kEAAkE;wBAClE,wBAAwB;wBACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;4BACxD,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,QAAQ,kBAAkB,CAAC,CAAA;wBAClE,CAAC;wBACD,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;4BACnE,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAA;wBACjF,CAAC;wBACD,mEAAmE;wBACnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;wBACtD,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU;4BACvC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;4BACrC,CAAC,CAAC,SAAS,CAAA;wBACb,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC1D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;wBACvD,CAAC;wBACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAC1C;4BACE,YAAY;4BACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,MAAM,EAAE,MAAM,CAAC,MAAM;yBACtB,EACD,WAAW,CACZ,CAAA;wBACD,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;wBACjD,MAAM,IAAI,GAAqB;4BAC7B,GAAG;4BACH,GAAG;4BACH,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;yBAC1B,CAAA;wBACD,OAAO,IAAI,CAAA;oBACb,CAAC;iBACF;gBACD,iBAAiB,EAAE;oBACjB,IAAI,EAAE,IAAI,cAAc,CAAC,cAAc,CAAC;oBACxC,WAAW,EACT,kEAAkE;wBAClE,0DAA0D;oBAC5D,IAAI,EAAE;wBACJ,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBACvD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;wBAClD,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;qBACjD;oBACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;wBAC3B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAIlC,CAAA;wBACD,kEAAkE;wBAClE,2DAA2D;wBAC3D,yCAAyC;wBACzC,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;wBACvC,IAAI,WAAW,CAAC,GAAG,CAAC;4BAAE,OAAO,KAAK,CAAA;wBAClC,OAAO,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;oBAC3C,CAAC;iBACF;aACF;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,GAAmB,EACnB,UAAkB,EAClB,KAAa;IAEb,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACtF,IAAI,GAAG,YAAY,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/E,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,4BAA4B,UAAU,GAAG,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,gBAAsC,CAAA;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,kBAAkB,UAAU,kCAAkC;YAC9E,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,sBAAsB,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACnC,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { uploadFeature } from './upload-feature.js';
 export { UploadProviderRegistry } from './registry.js';
 export { PendingUploadsRegistry } from './pending-registry.js';
+export { isUnsafeKey, sanitizeFilename, resolveWithinDir } from './path-safety.js';
+export { mimeMatches } from './mime.js';
 export { LocalUploadProvider, type LocalUploadOptions } from './providers/local.js';
 export { S3UploadProvider, type S3UploadOptions } from './providers/s3.js';
 export type { IUploadProvider, UploadedFile, UploadedFileInfo, UploadFeatureOptions, UploadPropertyConfig, } from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAG9D,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAG1E,YAAY,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAG9D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAGvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAG1E,YAAY,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -6,6 +6,10 @@
 export { uploadFeature } from './upload-feature.js';
 export { UploadProviderRegistry } from './registry.js';
 export { PendingUploadsRegistry } from './pending-registry.js';
+// Path-safety helpers (shared by providers + custom upload backends).
+export { isUnsafeKey, sanitizeFilename, resolveWithinDir } from './path-safety.js';
+// Server-side MIME allow-list matcher (HTML `accept` syntax).
+export { mimeMatches } from './mime.js';
 // Built-in providers
 export { LocalUploadProvider } from './providers/local.js';
 export { S3UploadProvider } from './providers/s3.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,SAAS;AACT,wGAAwG;AACxG,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE9D,qBAAqB;AACrB,OAAO,EAAE,mBAAmB,EAA2B,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAwB,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,SAAS;AACT,wGAAwG;AACxG,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE9D,sEAAsE;AACtE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAClF,8DAA8D;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,qBAAqB;AACrB,OAAO,EAAE,mBAAmB,EAA2B,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAwB,MAAM,mBAAmB,CAAA"}

package/dist/mime.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Server-side MIME allow-list matching.
+ *
+ * `UploadPropertyConfig.mimeTypes` uses the same syntax as the HTML `accept`
+ * attribute — exact types (`image/jpeg`), type wildcards (`image/*`), or the
+ * catch-all wildcard (`*`, or its explicit `type`/`subtype` form). The
+ * frontend enforces it for UX; the server
+ * re-checks it so a hand-crafted request cannot store a disallowed type.
+ *
+ * Note: the matched MIME is the *declared* `Content-Type` from the multipart
+ * part, which a client can spoof. This is defense-in-depth (it stops the
+ * trivial "bypass the frontend accept filter" attack and pairs with the size
+ * limits), not content sniffing — magic-byte inspection would need a decoder
+ * per format and is intentionally out of scope here.
+ */
+/**
+ * True when `type` matches at least one pattern in `patterns`. An empty or
+ * omitted pattern list allows everything (no restriction configured).
+ */
+export declare function mimeMatches(type: string, patterns: readonly string[] | null | undefined): boolean;
+//# sourceMappingURL=mime.d.ts.map

package/dist/mime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../src/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAgBjG"}

package/dist/mime.js

@@ -0,0 +1,46 @@
+/**
+ * Server-side MIME allow-list matching.
+ *
+ * `UploadPropertyConfig.mimeTypes` uses the same syntax as the HTML `accept`
+ * attribute — exact types (`image/jpeg`), type wildcards (`image/*`), or the
+ * catch-all wildcard (`*`, or its explicit `type`/`subtype` form). The
+ * frontend enforces it for UX; the server
+ * re-checks it so a hand-crafted request cannot store a disallowed type.
+ *
+ * Note: the matched MIME is the *declared* `Content-Type` from the multipart
+ * part, which a client can spoof. This is defense-in-depth (it stops the
+ * trivial "bypass the frontend accept filter" attack and pairs with the size
+ * limits), not content sniffing — magic-byte inspection would need a decoder
+ * per format and is intentionally out of scope here.
+ */
+/** Normalise a raw MIME to `type/subtype`, lower-cased, without parameters. */
+function normalizeType(raw) {
+    return raw.split(';')[0].trim().toLowerCase();
+}
+/**
+ * True when `type` matches at least one pattern in `patterns`. An empty or
+ * omitted pattern list allows everything (no restriction configured).
+ */
+export function mimeMatches(type, patterns) {
+    if (!patterns || patterns.length === 0)
+        return true;
+    const t = normalizeType(type);
+    if (!t)
+        return false;
+    const [tMain, tSub] = t.split('/');
+    for (const raw of patterns) {
+        const p = normalizeType(raw);
+        if (p === '*' || p === '*/*')
+            return true;
+        const [pMain, pSub] = p.split('/');
+        if (pSub === '*') {
+            if (pMain === tMain)
+                return true;
+        }
+        else if (pMain === tMain && pSub === tSub) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=mime.js.map

package/dist/mime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime.js","sourceRoot":"","sources":["../src/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA8C;IACtF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;QACzC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAA;QAClC,CAAC;aAAM,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/nest/upload-sweeper.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-sweeper.service.d.ts","sourceRoot":"","sources":["../../src/nest/upload-sweeper.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE5F,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAI/F,qBACa,oBAAqB,YAAW,YAAY,EAAE,eAAe;IAG7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFnE,OAAO,CAAC,KAAK,CAA8C;gBAEC,OAAO,EAAE,8BAA8B;IAEnG,YAAY,IAAI,IAAI;IAUpB,eAAe,IAAI,IAAI;CAMxB"}
+{"version":3,"file":"upload-sweeper.service.d.ts","sourceRoot":"","sources":["../../src/nest/upload-sweeper.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE5F,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAI/F,qBACa,oBAAqB,YAAW,YAAY,EAAE,eAAe;IAG7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFnE,OAAO,CAAC,KAAK,CAA8C;gBAEC,OAAO,EAAE,8BAA8B;IAEnG,YAAY,IAAI,IAAI;IAmBpB,eAAe,IAAI,IAAI;CAMxB"}

package/dist/nest/upload-sweeper.service.js

@@ -45,6 +45,13 @@ let UploadSweeperService = class UploadSweeperService {
         const interval = this.options.sweepIntervalMs ?? DEFAULT_SWEEP_INTERVAL_MS;
         if (interval <= 0)
             return;
+        if (!this.options.acknowledgeSingleInstance) {
+            console.warn('[modern-admin/feature-upload] The pending-upload registry and sweeper are ' +
+                'in-process (single-instance). Behind a load balancer with ≥2 replicas the ' +
+                'sweeper can delete a just-saved file (see PendingUploadsRegistry docs). ' +
+                'Run single-instance until a shared store lands, or pass ' +
+                '`acknowledgeSingleInstance: true` to silence this warning.');
+        }
         this.timer = setInterval(() => {
             void PendingUploadsRegistry.sweep();
         }, interval);

package/dist/nest/upload-sweeper.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload-sweeper.service.js","sourceRoot":"","sources":["../../src/nest/upload-sweeper.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAA2C,MAAM,gBAAgB,CAAA;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAE/F,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAGxC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAG/B,YAA2C,OAAwD;QAAvC,YAAO,GAAP,OAAO,CAAgC;QAF3F,UAAK,GAA0C,IAAI,CAAA;IAE2C,CAAC;IAEvG,YAAY;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAA;QAC1E,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,sBAAsB,CAAC,KAAK,EAAE,CAAA;QACrC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACZ,0EAA0E;QAC1E,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IAChE,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AArBY,oBAAoB;IADhC,UAAU,EAAE;IAIE,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;;GAH/B,oBAAoB,CAqBhC"}
+{"version":3,"file":"upload-sweeper.service.js","sourceRoot":"","sources":["../../src/nest/upload-sweeper.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAA2C,MAAM,gBAAgB,CAAA;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAE/F,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAGxC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAG/B,YAA2C,OAAwD;QAAvC,YAAO,GAAP,OAAO,CAAgC;QAF3F,UAAK,GAA0C,IAAI,CAAA;IAE2C,CAAC;IAEvG,YAAY;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAA;QAC1E,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CACV,4EAA4E;gBAC1E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,0DAA0D;gBAC1D,4DAA4D,CAC/D,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,sBAAsB,CAAC,KAAK,EAAE,CAAA;QACrC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACZ,0EAA0E;QAC1E,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IAChE,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AA9BY,oBAAoB;IADhC,UAAU,EAAE;IAIE,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;;GAH/B,oBAAoB,CA8BhC"}

package/dist/nest/upload.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.controller.d.ts","sourceRoot":"","sources":["../../src/nest/upload.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAkBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAA;AAI3B,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAiEjE,qBAIa,gBAAgB;IAEH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACb,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADtB,KAAK,EAAE,WAAW,EACT,aAAa,EAAE,8BAA8B;IAG/F;;;;;;OAMG;IAEG,MAAM,CACW,UAAU,EAAE,MAAM,EACvB,KAAK,EAAE,MAAM,EACtB,GAAG,EAAE,eAAe,GAC1B,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA2B9B;;;;;;;;OAQG;IAGG,MAAM,CACW,UAAU,EAAE,MAAM,EACvB,KAAK,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAchB,oFAAoF;IACpF,OAAO,CAAC,eAAe;CAkCxB"}
+{"version":3,"file":"upload.controller.d.ts","sourceRoot":"","sources":["../../src/nest/upload.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAA;AAM3B,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AA4HjE,qBAIa,gBAAgB;IAEH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACb,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADtB,KAAK,EAAE,WAAW,EACT,aAAa,EAAE,8BAA8B;IAG/F;;;;;;OAMG;IAEG,MAAM,CACW,UAAU,EAAE,MAAM,EACvB,KAAK,EAAE,MAAM,EACtB,GAAG,EAAE,eAAe,GAC1B,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA4C9B;;;;;;;;OAQG;IAGG,MAAM,CACW,UAAU,EAAE,MAAM,EACvB,KAAK,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAehB,oFAAoF;IACpF,OAAO,CAAC,eAAe;CAkCxB"}

package/dist/nest/upload.controller.js

@@ -31,20 +31,40 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { BadRequestException, Controller, Delete, ForbiddenException, HttpCode, Inject, InternalServerErrorException, NotFoundException, Post, Param, Query, Req, UseGuards, } from '@nestjs/common';
+import { BadRequestException, Controller, Delete, ForbiddenException, HttpCode, Inject, InternalServerErrorException, NotFoundException, PayloadTooLargeException, Post, Param, Query, Req, UnsupportedMediaTypeException, UseGuards, } from '@nestjs/common';
 import { ApiCookieAuth, ApiTags } from '@nestjs/swagger';
 import Busboy from 'busboy';
 import { ForbiddenError, ResourceNotFoundError, } from '@modern-admin/core';
 import { MODERN_ADMIN, ModernAdminAuthGuard } from '@modern-admin/nest';
 import { UploadProviderRegistry } from '../registry.js';
 import { PendingUploadsRegistry } from '../pending-registry.js';
+import { isUnsafeKey, sanitizeFilename } from '../path-safety.js';
+import { mimeMatches } from '../mime.js';
 import { UPLOAD_MODULE_OPTIONS } from './upload.tokens.js';
-/** Reads every file from a multipart/form-data stream using busboy. */
-function parseAllFiles(req) {
+/** Default hard cap on a single buffered file (bytes) — 25 MiB. */
+const DEFAULT_MAX_FILE_SIZE = 25 * 1024 * 1024;
+/** Default cap on files per multipart request for `isArray` properties. */
+const DEFAULT_MAX_FILES = 20;
+/**
+ * Reads every file from a multipart/form-data stream using busboy, enforcing
+ * size / count / MIME limits *as it streams* so a hostile request cannot
+ * buffer unbounded bytes into memory before any check runs.
+ */
+function parseAllFiles(req, limits) {
     return new Promise((resolve, reject) => {
         let bb;
         try {
-            bb = Busboy({ headers: req.headers });
+            bb = Busboy({
+                headers: req.headers,
+                limits: {
+                    fileSize: limits.maxFileSize,
+                    files: limits.maxFiles,
+                    // The upload endpoint carries no data fields — keep them tightly
+                    // bounded so field spam cannot buffer memory either.
+                    fields: 10,
+                    fieldSize: 100 * 1024,
+                },
+            });
         }
         catch {
             reject(new BadRequestException('Request is not multipart/form-data'));
@@ -56,6 +76,9 @@ function parseAllFiles(req) {
         let finished = false;
         let settled = false;
         let firstError;
+        const fail = (err) => {
+            firstError = firstError ?? err;
+        };
         const tryResolve = () => {
             if (settled || !finished || pending > 0)
                 return;
@@ -69,31 +92,56 @@ function parseAllFiles(req) {
         };
         bb.on('file', (_fieldname, stream, info) => {
             pending++;
+            // Reject a disallowed MIME up front — don't buffer a single byte of it.
+            const mimeType = info.mimeType || 'application/octet-stream';
+            if (!mimeMatches(mimeType, limits.mimeTypes)) {
+                fail(new UnsupportedMediaTypeException(`File type "${mimeType}" is not allowed`));
+                stream.resume(); // drain so busboy keeps parsing the rest of the body
+                stream.on('close', () => {
+                    pending--;
+                    tryResolve();
+                });
+                return;
+            }
             const chunks = [];
             stream.on('data', (chunk) => chunks.push(chunk));
+            // Busboy emits 'limit' when the per-file byte cap is exceeded.
+            stream.on('limit', () => {
+                fail(new PayloadTooLargeException(`File exceeds the maximum size of ${limits.maxFileSize} bytes`));
+            });
             stream.on('end', () => {
-                const buffer = Buffer.concat(chunks);
-                files.push({
-                    originalName: info.filename || 'upload',
-                    mimeType: info.mimeType || 'application/octet-stream',
-                    size: buffer.length,
-                    buffer,
-                });
+                // `truncated` is set when the fileSize limit tripped mid-stream.
+                if (!stream.truncated) {
+                    const buffer = Buffer.concat(chunks);
+                    files.push({
+                        // Sanitise before the name can steer key generation (extname /
+                        // custom uploadPath) — strips separators and traversal segments.
+                        originalName: sanitizeFilename(info.filename),
+                        mimeType,
+                        size: buffer.length,
+                        buffer,
+                    });
+                }
                 pending--;
                 tryResolve();
             });
             stream.on('error', (err) => {
-                firstError = firstError ?? err;
+                fail(err);
                 pending--;
                 tryResolve();
             });
         });
+        // Busboy stops emitting files past the `files` limit — surface it as a 400
+        // rather than silently dropping the extras.
+        bb.on('filesLimit', () => {
+            fail(new BadRequestException(`Too many files — at most ${limits.maxFiles} allowed`));
+        });
         bb.on('finish', () => {
             finished = true;
             tryResolve();
         });
         bb.on('error', (err) => {
-            firstError = firstError ?? err;
+            fail(err);
             finished = true;
             tryResolve();
         });
@@ -114,8 +162,20 @@ let UploadController = class UploadController {
      */
     async upload(resourceId, field, req) {
         const { providerId, registered } = this.resolveProperty(resourceId, field);
-        // 1 — Parse the multipart body (collect every file).
-        const files = await parseAllFiles(req);
+        // 1 — Parse the multipart body (collect every file), enforcing size /
+        //     count / MIME limits while streaming so nothing unbounded is buffered.
+        const moduleMax = this.moduleOptions.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+        // Per-property maxSize tightens the cap but can never raise it above the
+        // module-wide hard bound.
+        const maxFileSize = Math.min(moduleMax, registered.maxSize ?? Number.POSITIVE_INFINITY);
+        const maxFiles = registered.isArray
+            ? (this.moduleOptions.maxFiles ?? DEFAULT_MAX_FILES)
+            : 1;
+        const files = await parseAllFiles(req, {
+            maxFileSize,
+            maxFiles,
+            ...(registered.mimeTypes ? { mimeTypes: registered.mimeTypes } : {}),
+        });
         // 2 — If the property is single-value, only the first file is honoured.
         //     The frontend sends one anyway; this is a safety bound.
         const accepted = registered.isArray ? files : files.slice(0, 1);
@@ -125,6 +185,11 @@ let UploadController = class UploadController {
         const results = [];
         for (const file of accepted) {
             const computedKey = registered.uploadPath ? registered.uploadPath(file.originalName) : undefined;
+            // A custom `uploadPath` could still produce a traversal/absolute key —
+            // reject at the boundary (the provider also contains it defensively).
+            if (computedKey !== undefined && isUnsafeKey(computedKey)) {
+                throw new BadRequestException('Computed upload key is not allowed');
+            }
             const key = await registered.provider.upload(file, computedKey);
             // Track as pending — it will be confirmed by `new.after`/`edit.after`
             // when the form is saved, or cleaned up by the sweeper when the TTL
@@ -147,6 +212,8 @@ let UploadController = class UploadController {
     async cancel(resourceId, field, key) {
         if (!key)
             throw new BadRequestException('Missing "key" query parameter');
+        if (isUnsafeKey(key))
+            throw new BadRequestException('Invalid "key" query parameter');
         // Validate that the resource/field is actually upload-enabled. This avoids
         // leaking the existence of arbitrary resource ids to unauthenticated callers
         // (the auth guard already requires authentication).

package/dist/nest/upload.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.controller.js","sourceRoot":"","sources":["../../src/nest/upload.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;;;;;;AAEH,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,kBAAkB,EAClB,QAAQ,EACR,MAAM,EACN,4BAA4B,EAC5B,iBAAiB,EACjB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,GAAG,EACH,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAExD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAG/F,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAoB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,EAA6B,CAAA;QACjC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiC,EAAE,CAAC,CAAA;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACrE,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAmB,EAAE,CAAA;QAChC,6DAA6D;QAC7D,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,UAAmB,CAAA;QAEvB,MAAM,UAAU,GAAG,GAAS,EAAE;YAC5B,IAAI,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAM;YAC/C,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,CAAC,CAAA;iBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC,CAAA;;gBACxF,OAAO,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC,CAAA;QAED,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YACzC,OAAO,EAAE,CAAA;YACT,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACxD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpC,KAAK,CAAC,IAAI,CAAC;oBACT,YAAY,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;oBACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,0BAA0B;oBACrD,IAAI,EAAE,MAAM,CAAC,MAAM;oBACnB,MAAM;iBACP,CAAC,CAAA;gBACF,OAAO,EAAE,CAAA;gBACT,UAAU,EAAE,CAAA;YACd,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,UAAU,GAAG,UAAU,IAAI,GAAG,CAAA;gBAC9B,OAAO,EAAE,CAAA;gBACT,UAAU,EAAE,CAAA;YACd,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACnB,QAAQ,GAAG,IAAI,CAAA;YACf,UAAU,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE;YAC9B,UAAU,GAAG,UAAU,IAAI,GAAG,CAAA;YAC9B,QAAQ,GAAG,IAAI,CAAA;YACf,UAAU,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAMM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACyC,KAAkB,EACT,aAA6C;QADtD,UAAK,GAAL,KAAK,CAAa;QACT,kBAAa,GAAb,aAAa,CAAgC;IAC5F,CAAC;IAEJ;;;;;;OAMG;IAEG,AAAN,KAAK,CAAC,MAAM,CACW,UAAkB,EACvB,KAAa,EACtB,GAAoB;QAE3B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE1E,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAEtC,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAE/D,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC/D,MAAM,OAAO,GAAuB,EAAE,CAAA;QACtC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAChG,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YAC/D,sEAAsE;YACtE,oEAAoE;YACpE,mCAAmC;YACnC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IAGG,AAAN,KAAK,CAAC,MAAM,CACW,UAAkB,EACvB,KAAa,EACf,GAAW;QAEzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,oDAAoD;QACpD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED,8EAA8E;IAE9E,oFAAoF;IAC5E,eAAe,CACrB,UAAkB,EAClB,KAAa;QAEb,IAAI,QAAoD,CAAA;QACxD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAClF,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC5E,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,aAAa,KAAK,4BAA4B,UAAU,GAAG,CAAC,CAAA;QAC1F,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,gBAAsC,CAAA;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,KAAK,kBAAkB,UAAU,kCAAkC;gBAC9E,wCAAwC,CAC3C,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CAAC,oBAAoB,UAAU,sBAAsB,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;IACnC,CAAC;CACF,CAAA;AA/FO;IADL,IAAI,CAAC,QAAQ,CAAC;IAEZ,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;IACnB,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,GAAG,EAAE,CAAA;;;;8CA0BP;AAaK;IAFL,MAAM,CAAC,QAAQ,CAAC;IAChB,QAAQ,CAAC,GAAG,CAAC;IAEX,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;IACnB,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,KAAK,CAAC,KAAK,CAAC,CAAA;;;;8CAWd;AAtEU,gBAAgB;IAJ5B,OAAO,CAAC,iBAAiB,CAAC;IAC1B,aAAa,CAAC,SAAS,CAAC;IACxB,UAAU,CAAC,yCAAyC,CAAC;IACrD,SAAS,CAAC,oBAAoB,CAAC;IAG3B,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;IACpB,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;;GAHrB,gBAAgB,CA6G5B"}
+{"version":3,"file":"upload.controller.js","sourceRoot":"","sources":["../../src/nest/upload.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;;;;;;AAEH,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,kBAAkB,EAClB,QAAQ,EACR,MAAM,EACN,4BAA4B,EAC5B,iBAAiB,EACjB,wBAAwB,EACxB,IAAI,EACJ,KAAK,EACL,KAAK,EACL,GAAG,EACH,6BAA6B,EAC7B,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAExD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAG/F,mEAAmE;AACnE,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC9C,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAY5B;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAmB;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,EAA6B,CAAA;QACjC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,OAAiC;gBAC9C,MAAM,EAAE;oBACN,QAAQ,EAAE,MAAM,CAAC,WAAW;oBAC5B,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,iEAAiE;oBACjE,qDAAqD;oBACrD,MAAM,EAAE,EAAE;oBACV,SAAS,EAAE,GAAG,GAAG,IAAI;iBACtB;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACrE,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAmB,EAAE,CAAA;QAChC,6DAA6D;QAC7D,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,UAAmB,CAAA;QAEvB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAQ,EAAE;YAClC,UAAU,GAAG,UAAU,IAAI,GAAG,CAAA;QAChC,CAAC,CAAA;QAED,MAAM,UAAU,GAAG,GAAS,EAAE;YAC5B,IAAI,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAM;YAC/C,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,CAAC,CAAA;iBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC,CAAA;;gBACxF,OAAO,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC,CAAA;QAED,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YACzC,OAAO,EAAE,CAAA;YACT,wEAAwE;YACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAA;YAC5D,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,6BAA6B,CAAC,cAAc,QAAQ,kBAAkB,CAAC,CAAC,CAAA;gBACjF,MAAM,CAAC,MAAM,EAAE,CAAA,CAAC,qDAAqD;gBACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,OAAO,EAAE,CAAA;oBACT,UAAU,EAAE,CAAA;gBACd,CAAC,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACxD,+DAA+D;YAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,IAAI,wBAAwB,CAAC,oCAAoC,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAA;YACpG,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,iEAAiE;gBACjE,IAAI,CAAE,MAAkC,CAAC,SAAS,EAAE,CAAC;oBACnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;oBACpC,KAAK,CAAC,IAAI,CAAC;wBACT,+DAA+D;wBAC/D,iEAAiE;wBACjE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC7C,QAAQ;wBACR,IAAI,EAAE,MAAM,CAAC,MAAM;wBACnB,MAAM;qBACP,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;gBACT,UAAU,EAAE,CAAA;YACd,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,OAAO,EAAE,CAAA;gBACT,UAAU,EAAE,CAAA;YACd,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4CAA4C;QAC5C,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,IAAI,mBAAmB,CAAC,4BAA4B,MAAM,CAAC,QAAQ,UAAU,CAAC,CAAC,CAAA;QACtF,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACnB,QAAQ,GAAG,IAAI,CAAA;YACf,UAAU,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,QAAQ,GAAG,IAAI,CAAA;YACf,UAAU,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAMM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACyC,KAAkB,EACT,aAA6C;QADtD,UAAK,GAAL,KAAK,CAAa;QACT,kBAAa,GAAb,aAAa,CAAgC;IAC5F,CAAC;IAEJ;;;;;;OAMG;IAEG,AAAN,KAAK,CAAC,MAAM,CACW,UAAkB,EACvB,KAAa,EACtB,GAAoB;QAE3B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE1E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,IAAI,qBAAqB,CAAA;QACzE,yEAAyE;QACzE,0BAA0B;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO;YACjC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,IAAI,iBAAiB,CAAC;YACpD,CAAC,CAAC,CAAC,CAAA;QACL,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;YACrC,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAA;QAEF,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAE/D,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC/D,MAAM,OAAO,GAAuB,EAAE,CAAA;QACtC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAChG,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YAC/D,sEAAsE;YACtE,oEAAoE;YACpE,mCAAmC;YACnC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IAGG,AAAN,KAAK,CAAC,MAAM,CACW,UAAkB,EACvB,KAAa,EACf,GAAW;QAEzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QACxE,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QACpF,2EAA2E;QAC3E,6EAA6E;QAC7E,oDAAoD;QACpD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED,8EAA8E;IAE9E,oFAAoF;IAC5E,eAAe,CACrB,UAAkB,EAClB,KAAa;QAEb,IAAI,QAAoD,CAAA;QACxD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAClF,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC5E,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,aAAa,KAAK,4BAA4B,UAAU,GAAG,CAAC,CAAA;QAC1F,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,gBAAsC,CAAA;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,KAAK,kBAAkB,UAAU,kCAAkC;gBAC9E,wCAAwC,CAC3C,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CAAC,oBAAoB,UAAU,sBAAsB,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;IACnC,CAAC;CACF,CAAA;AAjHO;IADL,IAAI,CAAC,QAAQ,CAAC;IAEZ,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;IACnB,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,GAAG,EAAE,CAAA;;;;8CA2CP;AAaK;IAFL,MAAM,CAAC,QAAQ,CAAC;IAChB,QAAQ,CAAC,GAAG,CAAC;IAEX,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;IACnB,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,KAAK,CAAC,KAAK,CAAC,CAAA;;;;8CAYd;AAxFU,gBAAgB;IAJ5B,OAAO,CAAC,iBAAiB,CAAC;IAC1B,aAAa,CAAC,SAAS,CAAC;IACxB,UAAU,CAAC,yCAAyC,CAAC;IACrD,SAAS,CAAC,oBAAoB,CAAC;IAG3B,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;IACpB,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;;GAHrB,gBAAgB,CA+H5B"}

package/dist/nest/upload.module.d.ts

@@ -18,6 +18,11 @@
  * The module depends on `MODERN_ADMIN` and `ModernAdminAuthGuard` being
  * available in the DI tree, which is satisfied when `ModernAdminModule.forRoot`
  * is registered with `global: true` (the recommended default).
+ *
+ * ⚠️ Single-instance: the pending-upload registry + sweeper are in-process.
+ * Behind a load balancer with ≥2 replicas the sweeper can delete a just-saved
+ * file (see `PendingUploadsRegistry` docs). The sweeper warns once at startup;
+ * pass `acknowledgeSingleInstance: true` to silence it once understood.
  */
 import { type DynamicModule } from '@nestjs/common';
 import { type ModernAdminUploadModuleOptions } from './upload.tokens.js';

package/dist/nest/upload.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.module.d.ts","sourceRoot":"","sources":["../../src/nest/upload.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,MAAM,gBAAgB,CAAA;AAG3D,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAE/F,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAExE,qBACa,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,8BAAmC,GAAG,aAAa;CAY5E"}
+{"version":3,"file":"upload.module.d.ts","sourceRoot":"","sources":["../../src/nest/upload.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,MAAM,gBAAgB,CAAA;AAG3D,OAAO,EAAyB,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAE/F,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAExE,qBACa,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,8BAAmC,GAAG,aAAa;CAY5E"}

package/dist/nest/upload.module.js

@@ -18,6 +18,11 @@
  * The module depends on `MODERN_ADMIN` and `ModernAdminAuthGuard` being
  * available in the DI tree, which is satisfied when `ModernAdminModule.forRoot`
  * is registered with `global: true` (the recommended default).
+ *
+ * ⚠️ Single-instance: the pending-upload registry + sweeper are in-process.
+ * Behind a load balancer with ≥2 replicas the sweeper can delete a just-saved
+ * file (see `PendingUploadsRegistry` docs). The sweeper warns once at startup;
+ * pass `acknowledgeSingleInstance: true` to silence it once understood.
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/nest/upload.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.module.js","sourceRoot":"","sources":["../../src/nest/upload.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;AAEH,OAAO,EAAsB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAKxF,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,UAA0C,EAAE;QACzD,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,WAAW,EAAE,CAAC,gBAAgB,CAAC;YAC/B,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrD,oBAAoB;aACrB;YACD,OAAO,EAAE,CAAC,qBAAqB,CAAC;SACjC,CAAA;IACH,CAAC;CACF,CAAA;AAbY,uBAAuB;IADnC,MAAM,CAAC,EAAE,CAAC;GACE,uBAAuB,CAanC"}
+{"version":3,"file":"upload.module.js","sourceRoot":"","sources":["../../src/nest/upload.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;;;;;;AAEH,OAAO,EAAsB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAA;AAKxF,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,UAA0C,EAAE;QACzD,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,WAAW,EAAE,CAAC,gBAAgB,CAAC;YAC/B,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrD,oBAAoB;aACrB;YACD,OAAO,EAAE,CAAC,qBAAqB,CAAC;SACjC,CAAA;IACH,CAAC;CACF,CAAA;AAbY,uBAAuB;IADnC,MAAM,CAAC,EAAE,CAAC;GACE,uBAAuB,CAanC"}

package/dist/nest/upload.tokens.d.ts

@@ -19,5 +19,28 @@ export interface ModernAdminUploadModuleOptions {
      * just never expire).
      */
     sweepIntervalMs?: number;
+    /**
+     * Hard upper bound (bytes) on a single uploaded file, applied by the
+     * multipart parser regardless of per-property `maxSize`. Files are buffered
+     * in memory, so this caps memory use per request and blocks OOM-style DoS.
+     * A property's own `maxSize` still applies when it is *smaller* than this.
+     * Default: 25 MiB.
+     */
+    maxFileSize?: number;
+    /**
+     * Maximum number of files accepted in a single multipart request for an
+     * `isArray` property. Single-value properties always cap at 1. Default: 20.
+     */
+    maxFiles?: number;
+    /**
+     * Suppress the single-instance startup warning.
+     *
+     * `PendingUploadsRegistry` is an in-process `Map`: behind a load balancer
+     * with ≥2 replicas the confirm/sweeper lifecycle can delete a just-saved
+     * file (see the class docs). The sweeper logs a warning once at startup to
+     * make this loud. Set `true` once you have confirmed a single-instance
+     * deployment (or accepted the risk) to silence it.
+     */
+    acknowledgeSingleInstance?: boolean;
 }
 //# sourceMappingURL=upload.tokens.d.ts.map

package/dist/nest/upload.tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.tokens.d.ts","sourceRoot":"","sources":["../../src/nest/upload.tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,qBAAqB,eAAmD,CAAA;AAErF,MAAM,WAAW,8BAA8B;IAC7C,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB"}
+{"version":3,"file":"upload.tokens.d.ts","sourceRoot":"","sources":["../../src/nest/upload.tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,qBAAqB,eAAmD,CAAA;AAErF,MAAM,WAAW,8BAA8B;IAC7C,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC"}

package/dist/path-safety.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Path-safety helpers shared by the upload providers and the upload
+ * entry points (REST controller + GraphQL extension).
+ *
+ * Storage keys and filenames are attacker-controllable in two ways:
+ *
+ *   1. **Upload** — the client-supplied `originalName` flows into key
+ *      generation (default `uuid + extname`, or a custom `uploadPath`). A raw
+ *      name like `../../evil.sh` must never be able to steer the key outside
+ *      the intended storage space.
+ *   2. **Delete** — a `type: 'file'` property is just a string in the DB. An
+ *      attacker who can edit a record can write `../../../../etc/passwd` into
+ *      it; the next edit/delete would call `provider.delete(key)` with that
+ *      value. Without containment the local provider's `unlink` escapes the
+ *      upload directory.
+ *
+ * Defense is layered: keys are rejected at the transport boundary
+ * (`isUnsafeKey`), filenames are sanitised before they can influence a key
+ * (`sanitizeFilename`), and the local provider resolves every path against its
+ * upload directory (`resolveWithinDir`) as the authoritative backstop.
+ */
+/**
+ * True when `key` must be refused: empty, containing a NUL byte, absolute
+ * (POSIX `/…` or Windows `C:\…`), or containing a `..` traversal segment.
+ *
+ * Forward and back slashes are both treated as separators so a key crafted on
+ * one platform cannot escape on another. Legitimate nested keys
+ * (`avatars/2024/uuid.jpg`) and prefixes are allowed — only traversal and
+ * absolute paths are rejected.
+ */
+export declare function isUnsafeKey(key: unknown): boolean;
+/**
+ * Reduce a client-supplied filename to a safe basename that cannot influence
+ * the directory a key resolves into. Strips any directory components (either
+ * separator), NUL bytes, and leading dots (so `..` / hidden-traversal names
+ * collapse). Falls back to `'upload'` when nothing safe remains.
+ */
+export declare function sanitizeFilename(name: unknown): string;
+/**
+ * Resolve `key` against `baseDir` and guarantee the result stays inside it.
+ * Throws when the resolved path escapes the directory (traversal / absolute
+ * key). Returns the absolute, contained path for the caller to read/write.
+ */
+export declare function resolveWithinDir(baseDir: string, key: string): string;
+//# sourceMappingURL=path-safety.d.ts.map

package/dist/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../src/path-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQtD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CASrE"}