@securecoms/agent-bridge 0.37.0 → 0.38.0

package/dist/attachments.d.ts

@@ -95,9 +95,41 @@ export interface ReceiveDeps {
     mkdirp(dir: string): Promise<void>;
     writeFile(p: string, data: Uint8Array): Promise<void>;
 }
-/** Reduce any name to a safe basename inside the target dir. Strips path
+/** Reduce any name to a safe basename inside the target dir. Strips control
+ *  and bidi characters (review r1 M1: "invoice\u202Efdp.exe"), path
  *  separators and `..`; falls back when nothing usable remains. */
 export declare function sanitizeFilename(name: string, fallback: string): string;
+/**
+ * The image type from a file's leading bytes (PNG, JPEG, GIF, WEBP), or
+ * undefined. Review r1 H1: the reported mime of a received file is derived
+ * from its decrypted bytes, never the sender's claim. Twin of the connectors'
+ * sniffImageMime / sniff_image_mime.
+ */
+export declare function sniffImageMime(b: Uint8Array): string | undefined;
+/** A channel or message id that is not a canonical lowercase UUID would become
+ *  a path segment of the attachments dir. Content-free: the id is never echoed. */
+export declare class InvalidAttachmentTargetError extends Error {
+    constructor();
+}
+/** mkdir -p with 0700, then refuse the leaf if it is not a real directory
+ *  (a symlink planted at <attachmentsDir>/<channel> is never written through). */
+export declare function mkdirPrivateNoFollow(dir: string): Promise<void>;
+/** Byte cap on a saved attachment's name: with the "<uuid>-" prefix and the
+ *  ".<uuid>.part" temp suffix the entry stays far below NAME_MAX (255). */
+export declare const MAX_FILENAME_BYTES = 150;
+/** Truncate `name` to at most `maxBytes` UTF-8 bytes, cutting only between
+ *  code points and keeping a short extension. */
+export declare function truncateFilename(name: string, maxBytes?: number): string;
+/**
+ * Review r1 M4: write `data` to `path` without following a symlink and
+ * without writing into an existing file. The bytes go to a fresh temp name
+ * opened O_CREAT|O_EXCL|O_NOFOLLOW (0600), then rename() moves it into place.
+ * rename replaces a directory ENTRY, never writes through a link at `path`,
+ * and keeps a redelivered message (same id, same path) idempotent: a plain
+ * exclusive create of `path` itself would fail the redelivery, and the
+ * fail-soft share path would ack it and lose the file.
+ */
+export declare function writeFileExclusiveNoFollow(path: string, data: Uint8Array): Promise<void>;
 export declare function mimeForName(name: string): string;
 export interface SendDeps {
     /** Warm libsodium before any WASM-backed call. See src/sodium-ready.ts. */