@nifrajs/uploads 3.1.0 → 3.3.0

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3D;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC9F;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,GAAG,kBAAkB,CAAA;IAC5E,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAC7B,CAAA;AAEL,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAKD,qGAAqG;AACrG,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,EACtC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAuBvB"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3D;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC9F;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,GAAG,kBAAkB,CAAA;IAC5E,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAC7B,CAAA;AAEL,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAKD,qGAAqG;AACrG,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,EACtC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CA0BvB"}

package/dist/validate.js

@@ -2,6 +2,9 @@ import { detectFileType } from "./detect.js";
 const matchesAccept = (mime, pattern) => pattern === mime || (pattern.endsWith("/*") && mime.startsWith(pattern.slice(0, -1)));
 /** Validate uploaded bytes/Blob: size cap + magic-byte type sniff against an optional allow-list. */
 export async function validateUpload(input, options) {
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+        throw new RangeError("validateUpload: maxBytes must be a non-negative safe integer");
+    }
     // Reject an oversized Blob by its declared size before buffering it into memory.
     if (input instanceof Blob && input.size > options.maxBytes)
         return { ok: false, reason: "too_large" };

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAA;AAwB3D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAW,EAAE,CAC/D,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsC,EACtC,OAA8B;IAE9B,iFAAiF;IACjF,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC3C,MAAM,KAAK,GACT,KAAK,YAAY,UAAU;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,WAAW;YAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAEjD,IAAI,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAEjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACnE,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAA;AACpE,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAA;AAwB3D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAW,EAAE,CAC/D,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsC,EACtC,OAA8B;IAE9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAA;IACtF,CAAC;IACD,iFAAiF;IACjF,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC3C,MAAM,KAAK,GACT,KAAK,YAAY,UAAU;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,WAAW;YAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAEjD,IAAI,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAEjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACnE,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAA;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/uploads",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "description": "File-upload hardening for nifra - magic-byte MIME detection, size + type validation, short-TTL signed download URLs, and EXIF/metadata stripping. Dependency-free, edge-safe.",
   "keywords": [
     "bun",

package/src/validate.ts

@@ -30,6 +30,9 @@ export async function validateUpload(
   input: Uint8Array | ArrayBuffer | Blob,
   options: ValidateUploadOptions,
 ): Promise<UploadResult> {
+  if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+    throw new RangeError("validateUpload: maxBytes must be a non-negative safe integer")
+  }
   // Reject an oversized Blob by its declared size before buffering it into memory.
   if (input instanceof Blob && input.size > options.maxBytes)
     return { ok: false, reason: "too_large" }