@nifrajs/uploads 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nifra Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# @nifrajs/uploads
+
+File-upload hardening for nifra — magic-byte MIME detection, size + type validation, short-TTL signed download URLs, and EXIF/metadata stripping. Dependency-free, edge-safe.
+
+Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework — one core, five UI libraries, every runtime. Scaffold a new app with `bun create nifra`.
+
+## Install
+
+```sh
+bun add @nifrajs/uploads
+```
+
+## Docs
+
+- Reference: <https://nifra.dev/docs>
+- AI-readable: <https://nifra.dev/llms.txt>
+
+MIT

package/dist/detect.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Magic-byte file-type detection — trust the bytes, not the `Content-Type` header (which a client
+ * sets freely). Reads only the leading bytes; dependency-free + edge-safe. Covers the common upload
+ * types; returns `null` for anything unrecognized (incl. text formats like SVG/CSV that have no magic
+ * number — handle those explicitly if you accept them).
+ */
+export interface FileType {
+    /** Detected MIME type, e.g. `"image/png"`. */
+    readonly mime: string;
+    /** Canonical extension (no dot), e.g. `"png"`. */
+    readonly ext: string;
+}
+/** Detect a file's type from its magic bytes, or `null` if unrecognized. */
+export declare function detectFileType(bytes: Uint8Array): FileType | null;
+//# sourceMappingURL=detect.d.ts.map

package/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,QAAQ;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,GAAG,IAAI,CAwCjE"}

package/dist/detect.js

@@ -0,0 +1,56 @@
+/**
+ * Magic-byte file-type detection — trust the bytes, not the `Content-Type` header (which a client
+ * sets freely). Reads only the leading bytes; dependency-free + edge-safe. Covers the common upload
+ * types; returns `null` for anything unrecognized (incl. text formats like SVG/CSV that have no magic
+ * number — handle those explicitly if you accept them).
+ */
+/** Detect a file's type from its magic bytes, or `null` if unrecognized. */
+export function detectFileType(bytes) {
+    const at = (offset, ...sig) => sig.every((byte, i) => bytes[offset + i] === byte);
+    // Images
+    if (at(0, 0xff, 0xd8, 0xff))
+        return { mime: "image/jpeg", ext: "jpg" };
+    if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a))
+        return { mime: "image/png", ext: "png" };
+    if (at(0, 0x47, 0x49, 0x46, 0x38))
+        return { mime: "image/gif", ext: "gif" };
+    // RIFF container (bytes 0–3 "RIFF", 8–11 the form type)
+    if (at(0, 0x52, 0x49, 0x46, 0x46)) {
+        if (at(8, 0x57, 0x45, 0x42, 0x50))
+            return { mime: "image/webp", ext: "webp" };
+        if (at(8, 0x57, 0x41, 0x56, 0x45))
+            return { mime: "audio/wav", ext: "wav" };
+        if (at(8, 0x41, 0x56, 0x49, 0x20))
+            return { mime: "video/x-msvideo", ext: "avi" };
+    }
+    // ISO-BMFF (`ftyp` box at offset 4) — mp4 / avif / heic / m4a, disambiguated by the major brand.
+    if (at(4, 0x66, 0x74, 0x79, 0x70)) {
+        const brand = String.fromCharCode(bytes[8] ?? 0, bytes[9] ?? 0, bytes[10] ?? 0, bytes[11] ?? 0);
+        if (brand === "avif" || brand === "avis")
+            return { mime: "image/avif", ext: "avif" };
+        if (brand.startsWith("hei") || brand === "mif1")
+            return { mime: "image/heic", ext: "heic" };
+        // Audio brands share the ISO-BMFF container but are NOT video — labeling them `video/mp4` would
+        // both reject real audio under an `audio/*` allow-list and admit it under `video/*`. `M4A `/`M4B `
+        // are AAC audio / audiobooks.
+        if (brand === "M4A " || brand === "M4B ")
+            return { mime: "audio/mp4", ext: "m4a" };
+        return { mime: "video/mp4", ext: "mp4" };
+    }
+    // A/V + archives
+    if (at(0, 0x1a, 0x45, 0xdf, 0xa3))
+        return { mime: "video/webm", ext: "webm" }; // Matroska/WebM
+    if (at(0, 0x4f, 0x67, 0x67, 0x53))
+        return { mime: "audio/ogg", ext: "ogg" };
+    if (at(0, 0x49, 0x44, 0x33))
+        return { mime: "audio/mpeg", ext: "mp3" }; // ID3 tag
+    if (at(0, 0x25, 0x50, 0x44, 0x46))
+        return { mime: "application/pdf", ext: "pdf" }; // "%PDF"
+    if (at(0, 0x50, 0x4b, 0x03, 0x04) || at(0, 0x50, 0x4b, 0x05, 0x06)) {
+        return { mime: "application/zip", ext: "zip" }; // also docx/xlsx/odt containers
+    }
+    if (at(0, 0x1f, 0x8b))
+        return { mime: "application/gzip", ext: "gz" };
+    return null;
+}
+//# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,GAAG,GAAa,EAAW,EAAE,CACvD,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAEpD,SAAS;IACT,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACtE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAE3E,wDAAwD;IACxD,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC7E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC3E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IAED,iGAAiG;IACjG,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/F,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QACpF,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC3F,gGAAgG;QAChG,mGAAmG;QACnG,8BAA8B;QAC9B,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,iBAAiB;IACjB,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA,CAAC,gBAAgB;IAC9F,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC3E,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,UAAU;IACjF,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,SAAS;IAC3F,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA,CAAC,gCAAgC;IACjF,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAErE,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@nifrajs/uploads` — file-upload hardening, dependency-free + edge-safe.
+ *
+ * - {@link detectFileType} — sniff the real type from magic bytes (not the client's `Content-Type`).
+ * - {@link validateUpload} — size cap + magic-byte type allow-list. Pair with `@nifrajs/core`'s
+ *   `c.boundedBody(maxBytes)` to also bound the read.
+ * - {@link signDownloadUrl} / {@link verifyDownloadUrl} — short-TTL, tamper-evident download URLs.
+ * - {@link stripImageMetadata} — drop EXIF/GPS by re-encoding via any `@nifrajs/image` backend.
+ */
+export { detectFileType, type FileType } from "./detect.js";
+export { type SignDownloadUrlOptions, signDownloadUrl, verifyDownloadUrl, } from "./sign.js";
+export { type ImageReencoder, type StripImageMetadataOptions, stripImageMetadata, } from "./strip.js";
+export { type UploadResult, type ValidateUploadOptions, validateUpload, } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC9B,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,cAAc,GACf,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * `@nifrajs/uploads` — file-upload hardening, dependency-free + edge-safe.
+ *
+ * - {@link detectFileType} — sniff the real type from magic bytes (not the client's `Content-Type`).
+ * - {@link validateUpload} — size cap + magic-byte type allow-list. Pair with `@nifrajs/core`'s
+ *   `c.boundedBody(maxBytes)` to also bound the read.
+ * - {@link signDownloadUrl} / {@link verifyDownloadUrl} — short-TTL, tamper-evident download URLs.
+ * - {@link stripImageMetadata} — drop EXIF/GPS by re-encoding via any `@nifrajs/image` backend.
+ */
+export { detectFileType } from "./detect.js";
+export { signDownloadUrl, verifyDownloadUrl, } from "./sign.js";
+export { stripImageMetadata, } from "./strip.js";
+export { validateUpload, } from "./validate.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAA;AAC3D,OAAO,EAEL,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,OAAO,EAGL,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAGL,cAAc,GACf,MAAM,eAAe,CAAA"}

package/dist/sign.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Short-TTL **signed download URLs** — serve an uploaded file back via a tamper-evident, expiring URL
+ * (HMAC-SHA256 over the path + query + expiry). WebCrypto only (portable across Bun/Node/Deno/workerd,
+ * no `node:crypto`). Verification is constant-time (`crypto.subtle.verify`). Sign a *relative*
+ * URL/path; the returned string is relative so it works behind any host. `vexp` / `vsig` are reserved
+ * signature fields and are excluded from the payload.
+ */
+export interface SignDownloadUrlOptions {
+    /** Seconds until the URL expires. */
+    readonly expiresInSeconds: number;
+    /** Current unix time (seconds); defaults to `Date.now()/1000`. Injectable for tests. */
+    readonly now?: number;
+}
+/** Sign a relative URL/path → a relative URL with `?vexp=&vsig=` appended. */
+export declare function signDownloadUrl(url: string, secret: string, options: SignDownloadUrlOptions): Promise<string>;
+/** Verify a URL produced by {@link signDownloadUrl}: signature (constant-time) + not expired. */
+export declare function verifyDownloadUrl(url: string, secret: string, options?: {
+    readonly now?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8DH,MAAM,WAAW,sBAAsB;IACrC,qCAAqC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,wFAAwF;IACxF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,iGAAiG;AACjG,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/sign.js

@@ -0,0 +1,81 @@
+/**
+ * Short-TTL **signed download URLs** — serve an uploaded file back via a tamper-evident, expiring URL
+ * (HMAC-SHA256 over the path + query + expiry). WebCrypto only (portable across Bun/Node/Deno/workerd,
+ * no `node:crypto`). Verification is constant-time (`crypto.subtle.verify`). Sign a *relative*
+ * URL/path; the returned string is relative so it works behind any host. `vexp` / `vsig` are reserved
+ * signature fields and are excluded from the payload.
+ */
+const ENC = new TextEncoder();
+const DUMMY_BASE = "http://localhost"; // lets us parse a relative path/URL with the WHATWG URL parser
+// 256-bit secret floor — mirrors @nifrajs/core's HMAC guard. This package is deliberately
+// dependency-free (ships its own crypto), so the constant is inlined rather than imported.
+const MIN_SECRET_BYTES = 32;
+const importKey = (secret) => {
+    if (ENC.encode(secret).length < MIN_SECRET_BYTES) {
+        throw new Error(`[nifra/uploads] signing secret must be at least ${MIN_SECRET_BYTES} bytes (256-bit). Generate one with: openssl rand -base64 32`);
+    }
+    return crypto.subtle.importKey("raw", ENC.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+};
+const toBase64Url = (buf) => {
+    const bytes = new Uint8Array(buf);
+    let s = "";
+    for (const byte of bytes)
+        s += String.fromCharCode(byte);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+const fromBase64Url = (value) => {
+    try {
+        const b = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+        const out = new Uint8Array(b.length);
+        for (let i = 0; i < b.length; i++)
+            out[i] = b.charCodeAt(i);
+        return out;
+    }
+    catch {
+        return null;
+    }
+};
+const SIGNATURE_PARAMS = new Set(["vexp", "vsig"]);
+function signedQueryPairs(u) {
+    const pairs = [];
+    for (const [key, value] of u.searchParams) {
+        if (!SIGNATURE_PARAMS.has(key))
+            pairs.push([key, value]);
+    }
+    return pairs;
+}
+function getSingleParam(u, name) {
+    const values = u.searchParams.getAll(name);
+    return values.length === 1 ? (values[0] ?? null) : null;
+}
+// Sign the path + non-signature query pairs + expiry. Query pair order is intentional: a consumer may
+// give repeated params first-value semantics, so reordering must not preserve the signature.
+const canonical = (u, exp) => `${u.pathname}\n${JSON.stringify(signedQueryPairs(u))}\n${exp}`;
+/** Sign a relative URL/path → a relative URL with `?vexp=&vsig=` appended. */
+export async function signDownloadUrl(url, secret, options) {
+    const u = new URL(url, DUMMY_BASE);
+    u.searchParams.delete("vexp");
+    u.searchParams.delete("vsig");
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const exp = now + options.expiresInSeconds;
+    const sig = await crypto.subtle.sign("HMAC", await importKey(secret), ENC.encode(canonical(u, exp)));
+    u.searchParams.set("vexp", String(exp));
+    u.searchParams.set("vsig", toBase64Url(sig));
+    return u.pathname + u.search;
+}
+/** Verify a URL produced by {@link signDownloadUrl}: signature (constant-time) + not expired. */
+export async function verifyDownloadUrl(url, secret, options) {
+    const u = new URL(url, DUMMY_BASE);
+    const exp = getSingleParam(u, "vexp");
+    const sig = getSingleParam(u, "vsig");
+    if (exp === null || sig === null || !/^\d+$/.test(exp))
+        return false;
+    const now = options?.now ?? Math.floor(Date.now() / 1000);
+    if (Number(exp) < now)
+        return false;
+    const sigBytes = fromBase64Url(sig);
+    if (sigBytes === null)
+        return false;
+    return crypto.subtle.verify("HMAC", await importKey(secret), sigBytes, ENC.encode(canonical(u, Number(exp))));
+}
+//# sourceMappingURL=sign.js.map

package/dist/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;AAC7B,MAAM,UAAU,GAAG,kBAAkB,CAAA,CAAC,+DAA+D;AAErG,0FAA0F;AAC1F,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B,MAAM,SAAS,GAAG,CAAC,MAAc,EAAsB,EAAE;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,mDAAmD,gBAAgB,8DAA8D,CAClI,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAClB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAgB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAa,EAAkC,EAAE;IACtE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3D,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAElD,SAAS,gBAAgB,CAAC,CAAM;IAC9B,MAAM,KAAK,GAAqC,EAAE,CAAA;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAM,EAAE,IAAY;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,sGAAsG;AACtG,6FAA6F;AAC7F,MAAM,SAAS,GAAG,CAAC,CAAM,EAAE,GAAW,EAAU,EAAE,CAChD,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAA;AASjE,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,MAAc,EACd,OAA+B;IAE/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAClC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,SAAS,CAAC,MAAM,CAAC,EACvB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC9B,CAAA;IACD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAA;AAC9B,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,MAAc,EACd,OAAmC;IAEnC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,MAAM,SAAS,CAAC,MAAM,CAAC,EACvB,QAAQ,EACR,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACtC,CAAA;AACH,CAAC"}

package/dist/strip.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Strip EXIF/GPS/metadata from an uploaded image by **re-encoding** it — decoders don't carry
+ * embedded metadata through, so a decode→encode round-trip drops it (and normalizes the format).
+ *
+ * Backend-agnostic: pass any `@nifrajs/image` backend (`bunImageBackend`, `sharpImageBackend`,
+ * `wasmImageBackend`) — the structural type below matches them, so this package takes **no** dependency
+ * on `@nifrajs/image`. Run server-side (the codecs are Node/Bun-only); validate the upload first
+ * (`validateUpload`) so you only re-encode real images.
+ */
+type StripFormat = "webp" | "jpeg" | "png";
+/** The slice of `@nifrajs/image`'s `ImageBackend` this needs — `probe` for dims/format, `transform` to re-encode. */
+export interface ImageReencoder {
+    probe(bytes: Uint8Array): Promise<{
+        readonly width: number;
+        readonly height: number;
+        readonly format: string;
+    }>;
+    transform(input: {
+        readonly bytes: Uint8Array;
+        readonly width: number;
+        readonly quality: number;
+        readonly format: StripFormat;
+    }): Promise<{
+        readonly bytes: Uint8Array;
+    }>;
+}
+export interface StripImageMetadataOptions {
+    /** Output format. Default: keep png/jpeg, else re-encode to webp. */
+    readonly format?: StripFormat;
+    /** Encode quality (1–100). Default 82. */
+    readonly quality?: number;
+}
+/** Re-encode an image to its intrinsic size, dropping all embedded metadata. Returns clean bytes. */
+export declare function stripImageMetadata(bytes: Uint8Array, backend: ImageReencoder, options?: StripImageMetadataOptions): Promise<Uint8Array>;
+export {};
+//# sourceMappingURL=strip.d.ts.map

package/dist/strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../src/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,KAAK,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;AAE1C,qHAAqH;AACrH,MAAM,WAAW,cAAc;IAC7B,KAAK,CACH,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,SAAS,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAC7B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,yBAAyB;IACxC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qGAAqG;AACrG,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,UAAU,CAAC,CAWrB"}

package/dist/strip.js

@@ -0,0 +1,22 @@
+/**
+ * Strip EXIF/GPS/metadata from an uploaded image by **re-encoding** it — decoders don't carry
+ * embedded metadata through, so a decode→encode round-trip drops it (and normalizes the format).
+ *
+ * Backend-agnostic: pass any `@nifrajs/image` backend (`bunImageBackend`, `sharpImageBackend`,
+ * `wasmImageBackend`) — the structural type below matches them, so this package takes **no** dependency
+ * on `@nifrajs/image`. Run server-side (the codecs are Node/Bun-only); validate the upload first
+ * (`validateUpload`) so you only re-encode real images.
+ */
+/** Re-encode an image to its intrinsic size, dropping all embedded metadata. Returns clean bytes. */
+export async function stripImageMetadata(bytes, backend, options = {}) {
+    const probed = await backend.probe(bytes);
+    const format = options.format ?? (probed.format === "png" ? "png" : probed.format === "jpeg" ? "jpeg" : "webp");
+    const out = await backend.transform({
+        bytes,
+        width: probed.width,
+        quality: options.quality ?? 82,
+        format,
+    });
+    return out.bytes;
+}
+//# sourceMappingURL=strip.js.map

package/dist/strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../src/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwBH,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAiB,EACjB,OAAuB,EACvB,UAAqC,EAAE;IAEvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAClG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC;QAClC,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,MAAM;KACP,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC"}

package/dist/validate.d.ts

@@ -0,0 +1,26 @@
+import { type FileType } from "./detect.js";
+/**
+ * Validate an upload's **size** and **real type** (by magic bytes, not the client's `Content-Type`).
+ * Pair with `c.boundedBody(maxBytes)` from `@nifrajs/core` to bound the *read* itself: read the body
+ * under the cap, then `validateUpload(bytes, …)` to confirm the size + sniff the type.
+ */
+export type UploadResult = {
+    readonly ok: true;
+    readonly mime: string;
+    readonly ext: string;
+    readonly bytes: Uint8Array;
+} | {
+    readonly ok: false;
+    readonly reason: "too_large" | "empty" | "unrecognized" | "type_not_allowed";
+    /** The sniffed type, when one was detected (set for `type_not_allowed`). */
+    readonly detected?: FileType;
+};
+export interface ValidateUploadOptions {
+    /** Max byte length. A `Blob` over this is rejected without reading it. */
+    readonly maxBytes: number;
+    /** Allowed MIME types — exact (`"image/png"`) or a `image/*` wildcard. Omit ⇒ any recognized type. */
+    readonly accept?: readonly string[];
+}
+/** Validate uploaded bytes/Blob: size cap + magic-byte type sniff against an optional allow-list. */
+export declare function validateUpload(input: Uint8Array | ArrayBuffer | Blob, options: ValidateUploadOptions): Promise<UploadResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3D;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC9F;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,GAAG,kBAAkB,CAAA;IAC5E,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAC7B,CAAA;AAEL,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAKD,qGAAqG;AACrG,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,EACtC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAuBvB"}

package/dist/validate.js

@@ -0,0 +1,26 @@
+import { detectFileType } from "./detect.js";
+const matchesAccept = (mime, pattern) => pattern === mime || (pattern.endsWith("/*") && mime.startsWith(pattern.slice(0, -1)));
+/** Validate uploaded bytes/Blob: size cap + magic-byte type sniff against an optional allow-list. */
+export async function validateUpload(input, options) {
+    // Reject an oversized Blob by its declared size before buffering it into memory.
+    if (input instanceof Blob && input.size > options.maxBytes)
+        return { ok: false, reason: "too_large" };
+    const bytes = input instanceof Uint8Array
+        ? input
+        : input instanceof ArrayBuffer
+            ? new Uint8Array(input)
+            : new Uint8Array(await input.arrayBuffer());
+    if (bytes.byteLength > options.maxBytes)
+        return { ok: false, reason: "too_large" };
+    if (bytes.byteLength === 0)
+        return { ok: false, reason: "empty" };
+    const detected = detectFileType(bytes);
+    if (detected === null)
+        return { ok: false, reason: "unrecognized" };
+    if (options.accept !== undefined &&
+        !options.accept.some((p) => matchesAccept(detected.mime, p))) {
+        return { ok: false, reason: "type_not_allowed", detected };
+    }
+    return { ok: true, mime: detected.mime, ext: detected.ext, bytes };
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAA;AAwB3D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAW,EAAE,CAC/D,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsC,EACtC,OAA8B;IAE9B,iFAAiF;IACjF,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC3C,MAAM,KAAK,GACT,KAAK,YAAY,UAAU;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,WAAW;YAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAEjD,IAAI,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAEjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACnE,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAA;AACpE,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@nifrajs/uploads",
+  "version": "0.1.0-alpha.1",
+  "description": "File-upload hardening for nifra — magic-byte MIME detection, size + type validation, short-TTL signed download URLs, and EXIF/metadata stripping. Dependency-free, edge-safe.",
+  "keywords": [
+    "bun",
+    "typescript",
+    "nifra",
+    "web-framework",
+    "full-stack",
+    "edge",
+    "ssr",
+    "file-upload",
+    "s3",
+    "presigned-url",
+    "magic-bytes"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && bun run ../../scripts/fix-dts.ts dist"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nifrajs/nifra.git",
+    "directory": "packages/uploads"
+  },
+  "bugs": {
+    "url": "https://github.com/nifrajs/nifra/issues"
+  },
+  "homepage": "https://github.com/nifrajs/nifra#readme"
+}

package/src/detect.ts

@@ -0,0 +1,56 @@
+/**
+ * Magic-byte file-type detection — trust the bytes, not the `Content-Type` header (which a client
+ * sets freely). Reads only the leading bytes; dependency-free + edge-safe. Covers the common upload
+ * types; returns `null` for anything unrecognized (incl. text formats like SVG/CSV that have no magic
+ * number — handle those explicitly if you accept them).
+ */
+
+export interface FileType {
+  /** Detected MIME type, e.g. `"image/png"`. */
+  readonly mime: string
+  /** Canonical extension (no dot), e.g. `"png"`. */
+  readonly ext: string
+}
+
+/** Detect a file's type from its magic bytes, or `null` if unrecognized. */
+export function detectFileType(bytes: Uint8Array): FileType | null {
+  const at = (offset: number, ...sig: number[]): boolean =>
+    sig.every((byte, i) => bytes[offset + i] === byte)
+
+  // Images
+  if (at(0, 0xff, 0xd8, 0xff)) return { mime: "image/jpeg", ext: "jpg" }
+  if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a))
+    return { mime: "image/png", ext: "png" }
+  if (at(0, 0x47, 0x49, 0x46, 0x38)) return { mime: "image/gif", ext: "gif" }
+
+  // RIFF container (bytes 0–3 "RIFF", 8–11 the form type)
+  if (at(0, 0x52, 0x49, 0x46, 0x46)) {
+    if (at(8, 0x57, 0x45, 0x42, 0x50)) return { mime: "image/webp", ext: "webp" }
+    if (at(8, 0x57, 0x41, 0x56, 0x45)) return { mime: "audio/wav", ext: "wav" }
+    if (at(8, 0x41, 0x56, 0x49, 0x20)) return { mime: "video/x-msvideo", ext: "avi" }
+  }
+
+  // ISO-BMFF (`ftyp` box at offset 4) — mp4 / avif / heic / m4a, disambiguated by the major brand.
+  if (at(4, 0x66, 0x74, 0x79, 0x70)) {
+    const brand = String.fromCharCode(bytes[8] ?? 0, bytes[9] ?? 0, bytes[10] ?? 0, bytes[11] ?? 0)
+    if (brand === "avif" || brand === "avis") return { mime: "image/avif", ext: "avif" }
+    if (brand.startsWith("hei") || brand === "mif1") return { mime: "image/heic", ext: "heic" }
+    // Audio brands share the ISO-BMFF container but are NOT video — labeling them `video/mp4` would
+    // both reject real audio under an `audio/*` allow-list and admit it under `video/*`. `M4A `/`M4B `
+    // are AAC audio / audiobooks.
+    if (brand === "M4A " || brand === "M4B ") return { mime: "audio/mp4", ext: "m4a" }
+    return { mime: "video/mp4", ext: "mp4" }
+  }
+
+  // A/V + archives
+  if (at(0, 0x1a, 0x45, 0xdf, 0xa3)) return { mime: "video/webm", ext: "webm" } // Matroska/WebM
+  if (at(0, 0x4f, 0x67, 0x67, 0x53)) return { mime: "audio/ogg", ext: "ogg" }
+  if (at(0, 0x49, 0x44, 0x33)) return { mime: "audio/mpeg", ext: "mp3" } // ID3 tag
+  if (at(0, 0x25, 0x50, 0x44, 0x46)) return { mime: "application/pdf", ext: "pdf" } // "%PDF"
+  if (at(0, 0x50, 0x4b, 0x03, 0x04) || at(0, 0x50, 0x4b, 0x05, 0x06)) {
+    return { mime: "application/zip", ext: "zip" } // also docx/xlsx/odt containers
+  }
+  if (at(0, 0x1f, 0x8b)) return { mime: "application/gzip", ext: "gz" }
+
+  return null
+}

package/src/index.ts

@@ -0,0 +1,25 @@
+/**
+ * `@nifrajs/uploads` — file-upload hardening, dependency-free + edge-safe.
+ *
+ * - {@link detectFileType} — sniff the real type from magic bytes (not the client's `Content-Type`).
+ * - {@link validateUpload} — size cap + magic-byte type allow-list. Pair with `@nifrajs/core`'s
+ *   `c.boundedBody(maxBytes)` to also bound the read.
+ * - {@link signDownloadUrl} / {@link verifyDownloadUrl} — short-TTL, tamper-evident download URLs.
+ * - {@link stripImageMetadata} — drop EXIF/GPS by re-encoding via any `@nifrajs/image` backend.
+ */
+export { detectFileType, type FileType } from "./detect.ts"
+export {
+  type SignDownloadUrlOptions,
+  signDownloadUrl,
+  verifyDownloadUrl,
+} from "./sign.ts"
+export {
+  type ImageReencoder,
+  type StripImageMetadataOptions,
+  stripImageMetadata,
+} from "./strip.ts"
+export {
+  type UploadResult,
+  type ValidateUploadOptions,
+  validateUpload,
+} from "./validate.ts"

package/src/sign.ts

@@ -0,0 +1,117 @@
+/**
+ * Short-TTL **signed download URLs** — serve an uploaded file back via a tamper-evident, expiring URL
+ * (HMAC-SHA256 over the path + query + expiry). WebCrypto only (portable across Bun/Node/Deno/workerd,
+ * no `node:crypto`). Verification is constant-time (`crypto.subtle.verify`). Sign a *relative*
+ * URL/path; the returned string is relative so it works behind any host. `vexp` / `vsig` are reserved
+ * signature fields and are excluded from the payload.
+ */
+
+const ENC = new TextEncoder()
+const DUMMY_BASE = "http://localhost" // lets us parse a relative path/URL with the WHATWG URL parser
+
+// 256-bit secret floor — mirrors @nifrajs/core's HMAC guard. This package is deliberately
+// dependency-free (ships its own crypto), so the constant is inlined rather than imported.
+const MIN_SECRET_BYTES = 32
+
+const importKey = (secret: string): Promise<CryptoKey> => {
+  if (ENC.encode(secret).length < MIN_SECRET_BYTES) {
+    throw new Error(
+      `[nifra/uploads] signing secret must be at least ${MIN_SECRET_BYTES} bytes (256-bit). Generate one with: openssl rand -base64 32`,
+    )
+  }
+  return crypto.subtle.importKey(
+    "raw",
+    ENC.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"],
+  )
+}
+
+const toBase64Url = (buf: ArrayBuffer): string => {
+  const bytes = new Uint8Array(buf)
+  let s = ""
+  for (const byte of bytes) s += String.fromCharCode(byte)
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
+
+const fromBase64Url = (value: string): Uint8Array<ArrayBuffer> | null => {
+  try {
+    const b = atob(value.replace(/-/g, "+").replace(/_/g, "/"))
+    const out = new Uint8Array(b.length)
+    for (let i = 0; i < b.length; i++) out[i] = b.charCodeAt(i)
+    return out
+  } catch {
+    return null
+  }
+}
+
+const SIGNATURE_PARAMS = new Set(["vexp", "vsig"])
+
+function signedQueryPairs(u: URL): ReadonlyArray<readonly [string, string]> {
+  const pairs: Array<readonly [string, string]> = []
+  for (const [key, value] of u.searchParams) {
+    if (!SIGNATURE_PARAMS.has(key)) pairs.push([key, value])
+  }
+  return pairs
+}
+
+function getSingleParam(u: URL, name: string): string | null {
+  const values = u.searchParams.getAll(name)
+  return values.length === 1 ? (values[0] ?? null) : null
+}
+
+// Sign the path + non-signature query pairs + expiry. Query pair order is intentional: a consumer may
+// give repeated params first-value semantics, so reordering must not preserve the signature.
+const canonical = (u: URL, exp: number): string =>
+  `${u.pathname}\n${JSON.stringify(signedQueryPairs(u))}\n${exp}`
+
+export interface SignDownloadUrlOptions {
+  /** Seconds until the URL expires. */
+  readonly expiresInSeconds: number
+  /** Current unix time (seconds); defaults to `Date.now()/1000`. Injectable for tests. */
+  readonly now?: number
+}
+
+/** Sign a relative URL/path → a relative URL with `?vexp=&vsig=` appended. */
+export async function signDownloadUrl(
+  url: string,
+  secret: string,
+  options: SignDownloadUrlOptions,
+): Promise<string> {
+  const u = new URL(url, DUMMY_BASE)
+  u.searchParams.delete("vexp")
+  u.searchParams.delete("vsig")
+  const now = options.now ?? Math.floor(Date.now() / 1000)
+  const exp = now + options.expiresInSeconds
+  const sig = await crypto.subtle.sign(
+    "HMAC",
+    await importKey(secret),
+    ENC.encode(canonical(u, exp)),
+  )
+  u.searchParams.set("vexp", String(exp))
+  u.searchParams.set("vsig", toBase64Url(sig))
+  return u.pathname + u.search
+}
+
+/** Verify a URL produced by {@link signDownloadUrl}: signature (constant-time) + not expired. */
+export async function verifyDownloadUrl(
+  url: string,
+  secret: string,
+  options?: { readonly now?: number },
+): Promise<boolean> {
+  const u = new URL(url, DUMMY_BASE)
+  const exp = getSingleParam(u, "vexp")
+  const sig = getSingleParam(u, "vsig")
+  if (exp === null || sig === null || !/^\d+$/.test(exp)) return false
+  const now = options?.now ?? Math.floor(Date.now() / 1000)
+  if (Number(exp) < now) return false
+  const sigBytes = fromBase64Url(sig)
+  if (sigBytes === null) return false
+  return crypto.subtle.verify(
+    "HMAC",
+    await importKey(secret),
+    sigBytes,
+    ENC.encode(canonical(u, Number(exp))),
+  )
+}

package/src/strip.ts

@@ -0,0 +1,49 @@
+/**
+ * Strip EXIF/GPS/metadata from an uploaded image by **re-encoding** it — decoders don't carry
+ * embedded metadata through, so a decode→encode round-trip drops it (and normalizes the format).
+ *
+ * Backend-agnostic: pass any `@nifrajs/image` backend (`bunImageBackend`, `sharpImageBackend`,
+ * `wasmImageBackend`) — the structural type below matches them, so this package takes **no** dependency
+ * on `@nifrajs/image`. Run server-side (the codecs are Node/Bun-only); validate the upload first
+ * (`validateUpload`) so you only re-encode real images.
+ */
+
+type StripFormat = "webp" | "jpeg" | "png"
+
+/** The slice of `@nifrajs/image`'s `ImageBackend` this needs — `probe` for dims/format, `transform` to re-encode. */
+export interface ImageReencoder {
+  probe(
+    bytes: Uint8Array,
+  ): Promise<{ readonly width: number; readonly height: number; readonly format: string }>
+  transform(input: {
+    readonly bytes: Uint8Array
+    readonly width: number
+    readonly quality: number
+    readonly format: StripFormat
+  }): Promise<{ readonly bytes: Uint8Array }>
+}
+
+export interface StripImageMetadataOptions {
+  /** Output format. Default: keep png/jpeg, else re-encode to webp. */
+  readonly format?: StripFormat
+  /** Encode quality (1–100). Default 82. */
+  readonly quality?: number
+}
+
+/** Re-encode an image to its intrinsic size, dropping all embedded metadata. Returns clean bytes. */
+export async function stripImageMetadata(
+  bytes: Uint8Array,
+  backend: ImageReencoder,
+  options: StripImageMetadataOptions = {},
+): Promise<Uint8Array> {
+  const probed = await backend.probe(bytes)
+  const format: StripFormat =
+    options.format ?? (probed.format === "png" ? "png" : probed.format === "jpeg" ? "jpeg" : "webp")
+  const out = await backend.transform({
+    bytes,
+    width: probed.width,
+    quality: options.quality ?? 82,
+    format,
+  })
+  return out.bytes
+}

package/src/validate.ts

@@ -0,0 +1,55 @@
+import { detectFileType, type FileType } from "./detect.ts"
+
+/**
+ * Validate an upload's **size** and **real type** (by magic bytes, not the client's `Content-Type`).
+ * Pair with `c.boundedBody(maxBytes)` from `@nifrajs/core` to bound the *read* itself: read the body
+ * under the cap, then `validateUpload(bytes, …)` to confirm the size + sniff the type.
+ */
+
+export type UploadResult =
+  | { readonly ok: true; readonly mime: string; readonly ext: string; readonly bytes: Uint8Array }
+  | {
+      readonly ok: false
+      readonly reason: "too_large" | "empty" | "unrecognized" | "type_not_allowed"
+      /** The sniffed type, when one was detected (set for `type_not_allowed`). */
+      readonly detected?: FileType
+    }
+
+export interface ValidateUploadOptions {
+  /** Max byte length. A `Blob` over this is rejected without reading it. */
+  readonly maxBytes: number
+  /** Allowed MIME types — exact (`"image/png"`) or a `image/*` wildcard. Omit ⇒ any recognized type. */
+  readonly accept?: readonly string[]
+}
+
+const matchesAccept = (mime: string, pattern: string): boolean =>
+  pattern === mime || (pattern.endsWith("/*") && mime.startsWith(pattern.slice(0, -1)))
+
+/** Validate uploaded bytes/Blob: size cap + magic-byte type sniff against an optional allow-list. */
+export async function validateUpload(
+  input: Uint8Array | ArrayBuffer | Blob,
+  options: ValidateUploadOptions,
+): Promise<UploadResult> {
+  // Reject an oversized Blob by its declared size before buffering it into memory.
+  if (input instanceof Blob && input.size > options.maxBytes)
+    return { ok: false, reason: "too_large" }
+  const bytes =
+    input instanceof Uint8Array
+      ? input
+      : input instanceof ArrayBuffer
+        ? new Uint8Array(input)
+        : new Uint8Array(await input.arrayBuffer())
+
+  if (bytes.byteLength > options.maxBytes) return { ok: false, reason: "too_large" }
+  if (bytes.byteLength === 0) return { ok: false, reason: "empty" }
+
+  const detected = detectFileType(bytes)
+  if (detected === null) return { ok: false, reason: "unrecognized" }
+  if (
+    options.accept !== undefined &&
+    !options.accept.some((p) => matchesAccept(detected.mime, p))
+  ) {
+    return { ok: false, reason: "type_not_allowed", detected }
+  }
+  return { ok: true, mime: detected.mime, ext: detected.ext, bytes }
+}