payload 3.89.0 → 3.90.0

package/dist/queues/config/types/index.d.ts

@@ -186,7 +186,8 @@ export type JobsConfig = {
     runHooks?: boolean;
     /**
      * A function that will be executed before Payload picks up jobs which are configured by the `jobs.autorun` function.
-     * If this function returns true, jobs will be queried and picked up. If it returns false, jobs will not be run.
+     * If this function returns true, jobs will be queried and picked up. If it returns false, jobs will not be run
+     * for that tick. The cron will check again on its next scheduled run.
      * @default undefined - if this function is not defined, jobs will be run - as if () => true was passed.
      * @param payload
      * @returns boolean

package/dist/queues/config/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/queues/config/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAE5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,kBAAkB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAEhF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAAA;AACd,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,MAAM,CAAC,EAAE,eAAe,CAAA;QACxB;;WAEG;QACH,KAAK,CAAC,EAAE,cAAc,CAAA;QACtB;;WAEG;QACH,GAAG,CAAC,EAAE,YAAY,CAAA;KACnB,CAAA;IACD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAA;IACzF;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,qBAAqB,EAAE,gBAAgB,CAAA;KAAE,KAAK,gBAAgB,CAAA;IACjG;;;;;;OAMG;IACH,eAAe,CAAC,EACZ,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAC7C;QACE,OAAO,CAAC,EAAE,IAAI,CAAA;QACd,MAAM,EAAE;YACN,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SACtB,CAAA;KACF,GACD,IAAI,CAAA;IACR;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC3D;;OAEG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;IACzB;;OAEG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,cAAc,EAAE,cAAc,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,YAAY,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAAC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE;IACJ,oBAAoB,EAAE,eAAe,CAAA;IACrC;;OAEG;IACH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,KAAK,EAAE,KAAK,CAAA;IACZ,GAAG,CAAC,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,OAAO,CAAA;CAChB,GACD;IACE,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;CAClB,GACD;IACE,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;OAEG;IACH,MAAM,EAAE,SAAS,CAAA;CAClB,CACJ,KACE,YAAY,CAAC,IAAI,CAAC,CAAA;AAEvB,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE;QACN;;;;WAIG;QACH,aAAa,CAAC,EAAE,eAAe,CAAA;QAC/B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/queues/config/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAE5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AACD,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,kBAAkB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;AAEhF,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAAA;AACd,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,MAAM,CAAC,EAAE,eAAe,CAAA;QACxB;;WAEG;QACH,KAAK,CAAC,EAAE,cAAc,CAAA;QACtB;;WAEG;QACH,GAAG,CAAC,EAAE,YAAY,CAAA;KACnB,CAAA;IACD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAA;IACzF;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,qBAAqB,EAAE,gBAAgB,CAAA;KAAE,KAAK,gBAAgB,CAAA;IACjG;;;;;;OAMG;IACH,eAAe,CAAC,EACZ,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAC7C;QACE,OAAO,CAAC,EAAE,IAAI,CAAA;QACd,MAAM,EAAE;YACN,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SACtB,CAAA;KACF,GACD,IAAI,CAAA;IACR;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC3D;;OAEG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;IACzB;;OAEG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,cAAc,EAAE,cAAc,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC;;OAEG;IACH,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAK,YAAY,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB,CAAC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE;IACJ,oBAAoB,EAAE,eAAe,CAAA;IACrC;;OAEG;IACH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,CACA;IACE,KAAK,EAAE,KAAK,CAAA;IACZ,GAAG,CAAC,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,OAAO,CAAA;CAChB,GACD;IACE,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,SAAS,CAAA;CAClB,GACD;IACE,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;OAEG;IACH,MAAM,EAAE,SAAS,CAAA;CAClB,CACJ,KACE,YAAY,CAAC,IAAI,CAAC,CAAA;AAEvB,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE;QACN;;;;WAIG;QACH,aAAa,CAAC,EAAE,eAAe,CAAA;QAC/B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd,CAAA"}

package/dist/queues/config/types/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/queues/config/types/index.ts"],"sourcesContent":["import type { CollectionConfig, Job } from '../../../index.js'\nimport type { MaybePromise, Payload, PayloadRequest, Sort } from '../../../types/index.js'\nimport type { RunJobsSilent } from '../../localAPI.js'\nimport type { RunJobsArgs } from '../../operations/runJobs/index.js'\nimport type { JobStats } from '../global.js'\nimport type { TaskConfig } from './taskTypes.js'\nimport type { WorkflowConfig } from './workflowTypes.js'\n\nexport type AutorunCronConfig = {\n  /**\n   * If you want to autoRUn jobs from all queues, set this to true.\n   * If you set this to true, the `queue` property will be ignored.\n   *\n   * @default false\n   */\n  allQueues?: boolean\n  /**\n   * The cron schedule for the job.\n   * @default '* * * * *' (every minute).\n   *\n   * @example\n   *     ┌───────────── (optional) second (0 - 59)\n   *     │ ┌───────────── minute (0 - 59)\n   *     │ │ ┌───────────── hour (0 - 23)\n   *     │ │ │ ┌───────────── day of the month (1 - 31)\n   *     │ │ │ │ ┌───────────── month (1 - 12)\n   *     │ │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)\n   *     │ │ │ │ │ │\n   *     │ │ │ │ │ │\n   *  - '* 0 * * * *' every hour at minute 0\n   *  - '* 0 0 * * *' daily at midnight\n   *  - '* 0 0 * * 0' weekly at midnight on Sundays\n   *  - '* 0 0 1 * *' monthly at midnight on the 1st day of the month\n   *  - '* 0/5 * * * *' every 5 minutes\n   *  - '* * * * * *' every second\n   */\n  cron?: string\n  /**\n   * By default, the autorun will attempt to schedule jobs for tasks and workflows that have a `schedule` property, given\n   * the queue name is the same.\n   *\n   * Set this to `true` to disable the scheduling of jobs automatically.\n   *\n   * @default false\n   */\n  disableScheduling?: boolean\n  /**\n   * The limit for the job. This can be overridden by the user. Defaults to 10.\n   */\n  limit?: number\n  /**\n   * The queue name for the job.\n   *\n   * @default 'default'\n   */\n  queue?: string\n  /**\n   * If set to true, the job system will not log any output to the console (for both info and error logs).\n   * Can be an option for more granular control over logging.\n   *\n   * This will not automatically affect user-configured logs (e.g. if you call `console.log` or `payload.logger.info` in your job code).\n   *\n   * @default false\n   */\n  silent?: RunJobsSilent\n}\n\nexport type RunJobAccessArgs = {\n  req: PayloadRequest\n}\n\nexport type RunJobAccess = (args: RunJobAccessArgs) => MaybePromise<boolean>\n\nexport type QueueJobAccessArgs = {\n  req: PayloadRequest\n}\n\nexport type CancelJobAccessArgs = {\n  req: PayloadRequest\n}\nexport type CancelJobAccess = (args: CancelJobAccessArgs) => MaybePromise<boolean>\nexport type QueueJobAccess = (args: QueueJobAccessArgs) => MaybePromise<boolean>\n\nexport type SanitizedJobsConfig = {\n  /**\n   * If set to `true`, the job system is enabled and a payload-jobs collection exists.\n   * This property is automatically set during sanitization.\n   */\n  enabled?: boolean\n  /**\n   * If set to `true`, at least one task or workflow has scheduling enabled.\n   * This property is automatically set during sanitization.\n   */\n  scheduling?: boolean\n  /**\n   * If set to `true`, a payload-job-stats global exists.\n   * This property is automatically set during sanitization.\n   */\n  stats?: boolean\n} & JobsConfig\nexport type JobsConfig = {\n  /**\n   * Specify access control to determine who can interact with jobs.\n   */\n  access?: {\n    /**\n     * By default, all logged-in users can cancel jobs.\n     */\n    cancel?: CancelJobAccess\n    /**\n     * By default, all logged-in users can queue jobs.\n     */\n    queue?: QueueJobAccess\n    /**\n     * By default, all logged-in users can run jobs.\n     */\n    run?: RunJobAccess\n  }\n  /** Adds information about the parent job to the task log. This is useful for debugging and tracking the flow of tasks.\n   *\n   * In 4.0, this will default to `true`.\n   *\n   * @default false\n   */\n  addParentToTaskLog?: boolean\n  /**\n   * Allows you to configure cron jobs that automatically run queued jobs\n   * at specified intervals. Note that this does not _queue_ new jobs - only\n   * _runs_ jobs that are already in the specified queue.\n   *\n   * @remark this property should not be used on serverless platforms like Vercel\n   */\n  autoRun?: ((payload: Payload) => MaybePromise<AutorunCronConfig[]>) | AutorunCronConfig[]\n  /**\n   * Determine whether or not to delete a job after it has successfully completed.\n   */\n  deleteJobOnComplete?: boolean\n  /**\n   * Specify depth for retrieving jobs from the queue.\n   * This should be as low as possible in order for job retrieval\n   * to be as efficient as possible. Setting it to anything higher than\n   * 0 will drastically affect performance, as less efficient database\n   * queries will be used.\n   *\n   * @default 0\n   * @deprecated - this will be removed in 4.0\n   */\n  depth?: number\n  /**\n   * Enable concurrency controls for workflows and tasks.\n   * When enabled, adds a `concurrencyKey` field to the jobs collection schema.\n   * This allows workflows and tasks to use the `concurrency` option to prevent race conditions.\n   *\n   * **Important:** Enabling this may require a database migration depending on your database adapter,\n   * as it adds a new indexed field to the jobs collection schema.\n   *\n   * @default false\n   * @todo In 4.0, this will default to `true`.\n   */\n  enableConcurrencyControl?: boolean\n  /**\n   * Override any settings on the default Jobs collection. Accepts the default collection and allows you to return\n   * a new collection.\n   *\n   * @experimental\n   */\n  jobsCollectionOverrides?: (args: { defaultJobsCollection: CollectionConfig }) => CollectionConfig\n  /**\n   * Adjust the job processing order using a Payload sort string. This can be set globally or per queue.\n   *\n   * FIFO would equal `createdAt` and LIFO would equal `-createdAt`.\n   *\n   * @default all jobs for all queues will be executed in FIFO order.\n   */\n  processingOrder?:\n    | ((args: RunJobsArgs) => Promise<Sort> | Sort)\n    | {\n        default?: Sort\n        queues: {\n          [queue: string]: Sort\n        }\n      }\n    | Sort\n  /**\n   * By default, the job system uses direct database calls for optimal performance.\n   * If you added custom hooks to your jobs collection, you can set this to true to\n   * use the standard Payload API for all job operations. This is discouraged, as it will\n   * drastically affect performance.\n   *\n   * @default false\n   * @deprecated - this will be removed in 4.0\n   */\n  runHooks?: boolean\n  /**\n   * A function that will be executed before Payload picks up jobs which are configured by the `jobs.autorun` function.\n   * If this function returns true, jobs will be queried and picked up. If it returns false, jobs will not be run.\n   * @default undefined - if this function is not defined, jobs will be run - as if () => true was passed.\n   * @param payload\n   * @returns boolean\n   */\n  shouldAutoRun?: (payload: Payload) => MaybePromise<boolean>\n  /**\n   * Define all possible tasks here\n   */\n  tasks?: TaskConfig<any>[]\n  /**\n   * Define all the workflows here. Workflows orchestrate the flow of multiple tasks.\n   */\n  workflows?: WorkflowConfig<any>[]\n}\n\nexport type Queueable = {\n  scheduleConfig: ScheduleConfig\n  taskConfig?: TaskConfig\n  // If not set, queue it immediately\n  waitUntil?: Date\n  workflowConfig?: WorkflowConfig\n}\n\nexport type BeforeScheduleFn = (args: {\n  defaultBeforeSchedule: BeforeScheduleFn\n  /**\n   * payload-job-stats global data\n   */\n  jobStats: JobStats\n  queueable: Queueable\n  req: PayloadRequest\n}) => MaybePromise<{\n  input?: object\n  shouldSchedule: boolean\n  waitUntil?: Date\n}>\n\nexport type AfterScheduleFn = (\n  args: {\n    defaultAfterSchedule: AfterScheduleFn\n    /**\n     * payload-job-stats global data. If the global does not exist, it will be null.\n     */\n    jobStats: JobStats | null\n    queueable: Queueable\n    req: PayloadRequest\n  } & (\n    | {\n        error: Error\n        job?: never\n        status: 'error'\n      }\n    | {\n        error?: never\n        job: Job\n        status: 'success'\n      }\n    | {\n        error?: never\n        job?: never\n        /**\n         * If the beforeSchedule hook returned `shouldSchedule: false`, this will be called with status `skipped`.\n         */\n        status: 'skipped'\n      }\n  ),\n) => MaybePromise<void>\n\nexport type ScheduleConfig = {\n  /**\n   * The cron for scheduling the job.\n   *\n   * @example\n   *     ┌───────────── (optional) second (0 - 59)\n   *     │ ┌───────────── minute (0 - 59)\n   *     │ │ ┌───────────── hour (0 - 23)\n   *     │ │ │ ┌───────────── day of the month (1 - 31)\n   *     │ │ │ │ ┌───────────── month (1 - 12)\n   *     │ │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)\n   *     │ │ │ │ │ │\n   *     │ │ │ │ │ │\n   *  - '* 0 * * * *' every hour at minute 0\n   *  - '* 0 0 * * *' daily at midnight\n   *  - '* 0 0 * * 0' weekly at midnight on Sundays\n   *  - '* 0 0 1 * *' monthly at midnight on the 1st day of the month\n   *  - '* 0/5 * * * *' every 5 minutes\n   *  - '* * * * * *' every second\n   */\n  cron: string\n  hooks?: {\n    /**\n     * Functions that will be executed after the job has been successfully scheduled.\n     *\n     * @default By default, global update?? Unless global update should happen before\n     */\n    afterSchedule?: AfterScheduleFn\n    /**\n     * Functions that will be executed before the job is scheduled.\n     * You can use this to control whether or not the job should be scheduled, or what input\n     * data should be passed to the job.\n     *\n     * @default By default, this has one function that returns { shouldSchedule: true } if the following conditions are met:\n     * - There currently is no job of the same type in the specified queue that is currently running\n     * - There currently is no job of the same type in the specified queue that is scheduled to run in the future\n     * - There currently is no job of the same type in the specified queue that failed previously but can be retried\n     */\n    beforeSchedule?: BeforeScheduleFn\n  }\n  /**\n   * Queue to which the scheduled job will be added.\n   */\n  queue: string\n}\n"],"names":[],"mappings":"AAwQA,WA4CC"}
+{"version":3,"sources":["../../../../src/queues/config/types/index.ts"],"sourcesContent":["import type { CollectionConfig, Job } from '../../../index.js'\nimport type { MaybePromise, Payload, PayloadRequest, Sort } from '../../../types/index.js'\nimport type { RunJobsSilent } from '../../localAPI.js'\nimport type { RunJobsArgs } from '../../operations/runJobs/index.js'\nimport type { JobStats } from '../global.js'\nimport type { TaskConfig } from './taskTypes.js'\nimport type { WorkflowConfig } from './workflowTypes.js'\n\nexport type AutorunCronConfig = {\n  /**\n   * If you want to autoRUn jobs from all queues, set this to true.\n   * If you set this to true, the `queue` property will be ignored.\n   *\n   * @default false\n   */\n  allQueues?: boolean\n  /**\n   * The cron schedule for the job.\n   * @default '* * * * *' (every minute).\n   *\n   * @example\n   *     ┌───────────── (optional) second (0 - 59)\n   *     │ ┌───────────── minute (0 - 59)\n   *     │ │ ┌───────────── hour (0 - 23)\n   *     │ │ │ ┌───────────── day of the month (1 - 31)\n   *     │ │ │ │ ┌───────────── month (1 - 12)\n   *     │ │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)\n   *     │ │ │ │ │ │\n   *     │ │ │ │ │ │\n   *  - '* 0 * * * *' every hour at minute 0\n   *  - '* 0 0 * * *' daily at midnight\n   *  - '* 0 0 * * 0' weekly at midnight on Sundays\n   *  - '* 0 0 1 * *' monthly at midnight on the 1st day of the month\n   *  - '* 0/5 * * * *' every 5 minutes\n   *  - '* * * * * *' every second\n   */\n  cron?: string\n  /**\n   * By default, the autorun will attempt to schedule jobs for tasks and workflows that have a `schedule` property, given\n   * the queue name is the same.\n   *\n   * Set this to `true` to disable the scheduling of jobs automatically.\n   *\n   * @default false\n   */\n  disableScheduling?: boolean\n  /**\n   * The limit for the job. This can be overridden by the user. Defaults to 10.\n   */\n  limit?: number\n  /**\n   * The queue name for the job.\n   *\n   * @default 'default'\n   */\n  queue?: string\n  /**\n   * If set to true, the job system will not log any output to the console (for both info and error logs).\n   * Can be an option for more granular control over logging.\n   *\n   * This will not automatically affect user-configured logs (e.g. if you call `console.log` or `payload.logger.info` in your job code).\n   *\n   * @default false\n   */\n  silent?: RunJobsSilent\n}\n\nexport type RunJobAccessArgs = {\n  req: PayloadRequest\n}\n\nexport type RunJobAccess = (args: RunJobAccessArgs) => MaybePromise<boolean>\n\nexport type QueueJobAccessArgs = {\n  req: PayloadRequest\n}\n\nexport type CancelJobAccessArgs = {\n  req: PayloadRequest\n}\nexport type CancelJobAccess = (args: CancelJobAccessArgs) => MaybePromise<boolean>\nexport type QueueJobAccess = (args: QueueJobAccessArgs) => MaybePromise<boolean>\n\nexport type SanitizedJobsConfig = {\n  /**\n   * If set to `true`, the job system is enabled and a payload-jobs collection exists.\n   * This property is automatically set during sanitization.\n   */\n  enabled?: boolean\n  /**\n   * If set to `true`, at least one task or workflow has scheduling enabled.\n   * This property is automatically set during sanitization.\n   */\n  scheduling?: boolean\n  /**\n   * If set to `true`, a payload-job-stats global exists.\n   * This property is automatically set during sanitization.\n   */\n  stats?: boolean\n} & JobsConfig\nexport type JobsConfig = {\n  /**\n   * Specify access control to determine who can interact with jobs.\n   */\n  access?: {\n    /**\n     * By default, all logged-in users can cancel jobs.\n     */\n    cancel?: CancelJobAccess\n    /**\n     * By default, all logged-in users can queue jobs.\n     */\n    queue?: QueueJobAccess\n    /**\n     * By default, all logged-in users can run jobs.\n     */\n    run?: RunJobAccess\n  }\n  /** Adds information about the parent job to the task log. This is useful for debugging and tracking the flow of tasks.\n   *\n   * In 4.0, this will default to `true`.\n   *\n   * @default false\n   */\n  addParentToTaskLog?: boolean\n  /**\n   * Allows you to configure cron jobs that automatically run queued jobs\n   * at specified intervals. Note that this does not _queue_ new jobs - only\n   * _runs_ jobs that are already in the specified queue.\n   *\n   * @remark this property should not be used on serverless platforms like Vercel\n   */\n  autoRun?: ((payload: Payload) => MaybePromise<AutorunCronConfig[]>) | AutorunCronConfig[]\n  /**\n   * Determine whether or not to delete a job after it has successfully completed.\n   */\n  deleteJobOnComplete?: boolean\n  /**\n   * Specify depth for retrieving jobs from the queue.\n   * This should be as low as possible in order for job retrieval\n   * to be as efficient as possible. Setting it to anything higher than\n   * 0 will drastically affect performance, as less efficient database\n   * queries will be used.\n   *\n   * @default 0\n   * @deprecated - this will be removed in 4.0\n   */\n  depth?: number\n  /**\n   * Enable concurrency controls for workflows and tasks.\n   * When enabled, adds a `concurrencyKey` field to the jobs collection schema.\n   * This allows workflows and tasks to use the `concurrency` option to prevent race conditions.\n   *\n   * **Important:** Enabling this may require a database migration depending on your database adapter,\n   * as it adds a new indexed field to the jobs collection schema.\n   *\n   * @default false\n   * @todo In 4.0, this will default to `true`.\n   */\n  enableConcurrencyControl?: boolean\n  /**\n   * Override any settings on the default Jobs collection. Accepts the default collection and allows you to return\n   * a new collection.\n   *\n   * @experimental\n   */\n  jobsCollectionOverrides?: (args: { defaultJobsCollection: CollectionConfig }) => CollectionConfig\n  /**\n   * Adjust the job processing order using a Payload sort string. This can be set globally or per queue.\n   *\n   * FIFO would equal `createdAt` and LIFO would equal `-createdAt`.\n   *\n   * @default all jobs for all queues will be executed in FIFO order.\n   */\n  processingOrder?:\n    | ((args: RunJobsArgs) => Promise<Sort> | Sort)\n    | {\n        default?: Sort\n        queues: {\n          [queue: string]: Sort\n        }\n      }\n    | Sort\n  /**\n   * By default, the job system uses direct database calls for optimal performance.\n   * If you added custom hooks to your jobs collection, you can set this to true to\n   * use the standard Payload API for all job operations. This is discouraged, as it will\n   * drastically affect performance.\n   *\n   * @default false\n   * @deprecated - this will be removed in 4.0\n   */\n  runHooks?: boolean\n  /**\n   * A function that will be executed before Payload picks up jobs which are configured by the `jobs.autorun` function.\n   * If this function returns true, jobs will be queried and picked up. If it returns false, jobs will not be run\n   * for that tick. The cron will check again on its next scheduled run.\n   * @default undefined - if this function is not defined, jobs will be run - as if () => true was passed.\n   * @param payload\n   * @returns boolean\n   */\n  shouldAutoRun?: (payload: Payload) => MaybePromise<boolean>\n  /**\n   * Define all possible tasks here\n   */\n  tasks?: TaskConfig<any>[]\n  /**\n   * Define all the workflows here. Workflows orchestrate the flow of multiple tasks.\n   */\n  workflows?: WorkflowConfig<any>[]\n}\n\nexport type Queueable = {\n  scheduleConfig: ScheduleConfig\n  taskConfig?: TaskConfig\n  // If not set, queue it immediately\n  waitUntil?: Date\n  workflowConfig?: WorkflowConfig\n}\n\nexport type BeforeScheduleFn = (args: {\n  defaultBeforeSchedule: BeforeScheduleFn\n  /**\n   * payload-job-stats global data\n   */\n  jobStats: JobStats\n  queueable: Queueable\n  req: PayloadRequest\n}) => MaybePromise<{\n  input?: object\n  shouldSchedule: boolean\n  waitUntil?: Date\n}>\n\nexport type AfterScheduleFn = (\n  args: {\n    defaultAfterSchedule: AfterScheduleFn\n    /**\n     * payload-job-stats global data. If the global does not exist, it will be null.\n     */\n    jobStats: JobStats | null\n    queueable: Queueable\n    req: PayloadRequest\n  } & (\n    | {\n        error: Error\n        job?: never\n        status: 'error'\n      }\n    | {\n        error?: never\n        job: Job\n        status: 'success'\n      }\n    | {\n        error?: never\n        job?: never\n        /**\n         * If the beforeSchedule hook returned `shouldSchedule: false`, this will be called with status `skipped`.\n         */\n        status: 'skipped'\n      }\n  ),\n) => MaybePromise<void>\n\nexport type ScheduleConfig = {\n  /**\n   * The cron for scheduling the job.\n   *\n   * @example\n   *     ┌───────────── (optional) second (0 - 59)\n   *     │ ┌───────────── minute (0 - 59)\n   *     │ │ ┌───────────── hour (0 - 23)\n   *     │ │ │ ┌───────────── day of the month (1 - 31)\n   *     │ │ │ │ ┌───────────── month (1 - 12)\n   *     │ │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)\n   *     │ │ │ │ │ │\n   *     │ │ │ │ │ │\n   *  - '* 0 * * * *' every hour at minute 0\n   *  - '* 0 0 * * *' daily at midnight\n   *  - '* 0 0 * * 0' weekly at midnight on Sundays\n   *  - '* 0 0 1 * *' monthly at midnight on the 1st day of the month\n   *  - '* 0/5 * * * *' every 5 minutes\n   *  - '* * * * * *' every second\n   */\n  cron: string\n  hooks?: {\n    /**\n     * Functions that will be executed after the job has been successfully scheduled.\n     *\n     * @default By default, global update?? Unless global update should happen before\n     */\n    afterSchedule?: AfterScheduleFn\n    /**\n     * Functions that will be executed before the job is scheduled.\n     * You can use this to control whether or not the job should be scheduled, or what input\n     * data should be passed to the job.\n     *\n     * @default By default, this has one function that returns { shouldSchedule: true } if the following conditions are met:\n     * - There currently is no job of the same type in the specified queue that is currently running\n     * - There currently is no job of the same type in the specified queue that is scheduled to run in the future\n     * - There currently is no job of the same type in the specified queue that failed previously but can be retried\n     */\n    beforeSchedule?: BeforeScheduleFn\n  }\n  /**\n   * Queue to which the scheduled job will be added.\n   */\n  queue: string\n}\n"],"names":[],"mappings":"AAyQA,WA4CC"}

package/dist/uploads/assertClientUploadAccess.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadRequest } from '../types/index.js';
+/** Checks collection write permissions before an adapter grants access to upload file bytes. */
+export declare const assertClientUploadAccess: ({ collectionSlug, req, }: {
+    collectionSlug: string;
+    req: PayloadRequest;
+}) => Promise<void>;
+//# sourceMappingURL=assertClientUploadAccess.d.ts.map

package/dist/uploads/assertClientUploadAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertClientUploadAccess.d.ts","sourceRoot":"","sources":["../../src/uploads/assertClientUploadAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,6BAGlC;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,IAAI,CA4Bf,CAAA"}

package/dist/uploads/assertClientUploadAccess.js

@@ -0,0 +1,27 @@
+import { executeAccess } from '../auth/executeAccess.js';
+import { Forbidden } from '../errors/Forbidden.js';
+/** Checks collection write permissions before an adapter grants access to upload file bytes. */ export const assertClientUploadAccess = async ({ collectionSlug, req })=>{
+    if (!req.user) {
+        throw new Forbidden(req.t);
+    }
+    const collectionConfig = req.payload.collections[collectionSlug]?.config;
+    if (!collectionConfig) {
+        throw new Forbidden(req.t);
+    }
+    const canCreate = await executeAccess({
+        disableErrors: true,
+        req
+    }, collectionConfig.access.create);
+    if (canCreate) {
+        return;
+    }
+    const canUpdate = await executeAccess({
+        disableErrors: true,
+        req
+    }, collectionConfig.access.update);
+    if (!canUpdate) {
+        throw new Forbidden(req.t);
+    }
+};
+
+//# sourceMappingURL=assertClientUploadAccess.js.map

package/dist/uploads/assertClientUploadAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAccess.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { Forbidden } from '../errors/Forbidden.js'\n\n/** Checks collection write permissions before an adapter grants access to upload file bytes. */\nexport const assertClientUploadAccess = async ({\n  collectionSlug,\n  req,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n}): Promise<void> => {\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const collectionConfig = req.payload.collections[collectionSlug]?.config\n\n  if (!collectionConfig) {\n    throw new Forbidden(req.t)\n  }\n\n  const canCreate = await executeAccess(\n    { disableErrors: true, req },\n    collectionConfig.access.create,\n  )\n\n  if (canCreate) {\n    return\n  }\n\n  const canUpdate = await executeAccess(\n    { disableErrors: true, req },\n    collectionConfig.access.update,\n  )\n\n  if (!canUpdate) {\n    throw new Forbidden(req.t)\n  }\n}\n"],"names":["executeAccess","Forbidden","assertClientUploadAccess","collectionSlug","req","user","t","collectionConfig","payload","collections","config","canCreate","disableErrors","access","create","canUpdate","update"],"mappings":"AAEA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,yBAAwB;AAElD,8FAA8F,GAC9F,OAAO,MAAMC,2BAA2B,OAAO,EAC7CC,cAAc,EACdC,GAAG,EAIJ;IACC,IAAI,CAACA,IAAIC,IAAI,EAAE;QACb,MAAM,IAAIJ,UAAUG,IAAIE,CAAC;IAC3B;IAEA,MAAMC,mBAAmBH,IAAII,OAAO,CAACC,WAAW,CAACN,eAAe,EAAEO;IAElE,IAAI,CAACH,kBAAkB;QACrB,MAAM,IAAIN,UAAUG,IAAIE,CAAC;IAC3B;IAEA,MAAMK,YAAY,MAAMX,cACtB;QAAEY,eAAe;QAAMR;IAAI,GAC3BG,iBAAiBM,MAAM,CAACC,MAAM;IAGhC,IAAIH,WAAW;QACb;IACF;IAEA,MAAMI,YAAY,MAAMf,cACtB;QAAEY,eAAe;QAAMR;IAAI,GAC3BG,iBAAiBM,MAAM,CAACG,MAAM;IAGhC,IAAI,CAACD,WAAW;QACd,MAAM,IAAId,UAAUG,IAAIE,CAAC;IAC3B;AACF,EAAC"}

package/dist/uploads/assertClientUploadAllowed.d.ts

@@ -0,0 +1,11 @@
+export declare const assertClientUploadFileSize: (filesize: unknown) => void;
+export declare const assertClientUploadAllowed: ({ collection, filename, mimeType, }: {
+    collection?: {
+        upload?: {
+            allowRestrictedFileTypes?: boolean;
+        } | boolean;
+    };
+    filename: unknown;
+    mimeType?: unknown;
+}) => void;
+//# sourceMappingURL=assertClientUploadAllowed.d.ts.map

package/dist/uploads/assertClientUploadAllowed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertClientUploadAllowed.d.ts","sourceRoot":"","sources":["../../src/uploads/assertClientUploadAllowed.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,0BAA0B,aAAc,OAAO,SAI3D,CAAA;AAED,eAAO,MAAM,yBAAyB,wCAInC;IACD,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE;YAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAA;KAC1D,CAAA;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,KAAG,IA+BH,CAAA"}

package/dist/uploads/assertClientUploadAllowed.js

@@ -0,0 +1,46 @@
+import { APIError } from '../errors/APIError.js';
+import { getSanitizedUploadFilename, uploadRequiresServerValidation } from './getFileTypeIdentity.js';
+const MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\w-]+\/[!#$%&'*+.^`|~\w-]+$/;
+const isValidMimeType = (mimeType)=>{
+    if (typeof mimeType !== 'string' || mimeType.length === 0 || mimeType !== mimeType.trim() || [
+        ...mimeType
+    ].some((character)=>{
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+    })) {
+        return false;
+    }
+    const [essence, ...parameters] = mimeType.split(';');
+    return MIME_TYPE_PATTERN.test(essence ?? '') && parameters.every((parameter)=>parameter.trim().length > 0);
+};
+export const assertClientUploadFileSize = (filesize)=>{
+    if (typeof filesize !== 'number' || !Number.isSafeInteger(filesize) || filesize < 0) {
+        throw new APIError('A valid file size is required for client uploads.', 400);
+    }
+};
+export const assertClientUploadAllowed = ({ collection, filename, mimeType })=>{
+    if (typeof filename !== 'string' || filename.length === 0 || filename.trim().length === 0 || !getSanitizedUploadFilename(filename)) {
+        throw new APIError('A valid filename is required for client uploads.', 400);
+    }
+    const allowRestrictedFileTypes = collection && typeof collection.upload === 'object' ? collection.upload.allowRestrictedFileTypes : false;
+    // The explicit restricted-file opt-out also preserves legacy provider clients that did not
+    // send MIME metadata. Secure-default collections always require a bindable MIME identity.
+    if (mimeType === undefined || mimeType === null || mimeType === '') {
+        if (allowRestrictedFileTypes) {
+            return;
+        }
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (!isValidMimeType(mimeType)) {
+        throw new APIError('A valid MIME type is required for client uploads.', 400);
+    }
+    if (uploadRequiresServerValidation({
+        allowRestrictedFileTypes,
+        filename,
+        mimeType
+    })) {
+        throw new APIError('SVG and XML files must be uploaded through Payload.', 400);
+    }
+};
+
+//# sourceMappingURL=assertClientUploadAllowed.js.map

package/dist/uploads/assertClientUploadAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAllowed.ts"],"sourcesContent":["import { APIError } from '../errors/APIError.js'\nimport {\n  getSanitizedUploadFilename,\n  uploadRequiresServerValidation,\n} from './getFileTypeIdentity.js'\n\nconst MIME_TYPE_PATTERN = /^[!#$%&'*+.^`|~\\w-]+\\/[!#$%&'*+.^`|~\\w-]+$/\n\nconst isValidMimeType = (mimeType: unknown): mimeType is string => {\n  if (\n    typeof mimeType !== 'string' ||\n    mimeType.length === 0 ||\n    mimeType !== mimeType.trim() ||\n    [...mimeType].some((character) => {\n      const codePoint = character.codePointAt(0)\n      return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)\n    })\n  ) {\n    return false\n  }\n\n  const [essence, ...parameters] = mimeType.split(';')\n  return (\n    MIME_TYPE_PATTERN.test(essence ?? '') &&\n    parameters.every((parameter) => parameter.trim().length > 0)\n  )\n}\n\nexport const assertClientUploadFileSize = (filesize: unknown) => {\n  if (typeof filesize !== 'number' || !Number.isSafeInteger(filesize) || filesize < 0) {\n    throw new APIError('A valid file size is required for client uploads.', 400)\n  }\n}\n\nexport const assertClientUploadAllowed = ({\n  collection,\n  filename,\n  mimeType,\n}: {\n  collection?: {\n    upload?: { allowRestrictedFileTypes?: boolean } | boolean\n  }\n  filename: unknown\n  mimeType?: unknown\n}): void => {\n  if (\n    typeof filename !== 'string' ||\n    filename.length === 0 ||\n    filename.trim().length === 0 ||\n    !getSanitizedUploadFilename(filename)\n  ) {\n    throw new APIError('A valid filename is required for client uploads.', 400)\n  }\n\n  const allowRestrictedFileTypes =\n    collection && typeof collection.upload === 'object'\n      ? collection.upload.allowRestrictedFileTypes\n      : false\n\n  // The explicit restricted-file opt-out also preserves legacy provider clients that did not\n  // send MIME metadata. Secure-default collections always require a bindable MIME identity.\n  if (mimeType === undefined || mimeType === null || mimeType === '') {\n    if (allowRestrictedFileTypes) {\n      return\n    }\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (!isValidMimeType(mimeType)) {\n    throw new APIError('A valid MIME type is required for client uploads.', 400)\n  }\n\n  if (uploadRequiresServerValidation({ allowRestrictedFileTypes, filename, mimeType })) {\n    throw new APIError('SVG and XML files must be uploaded through Payload.', 400)\n  }\n}\n"],"names":["APIError","getSanitizedUploadFilename","uploadRequiresServerValidation","MIME_TYPE_PATTERN","isValidMimeType","mimeType","length","trim","some","character","codePoint","codePointAt","undefined","essence","parameters","split","test","every","parameter","assertClientUploadFileSize","filesize","Number","isSafeInteger","assertClientUploadAllowed","collection","filename","allowRestrictedFileTypes","upload"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SACEC,0BAA0B,EAC1BC,8BAA8B,QACzB,2BAA0B;AAEjC,MAAMC,oBAAoB;AAE1B,MAAMC,kBAAkB,CAACC;IACvB,IACE,OAAOA,aAAa,YACpBA,SAASC,MAAM,KAAK,KACpBD,aAAaA,SAASE,IAAI,MAC1B;WAAIF;KAAS,CAACG,IAAI,CAAC,CAACC;QAClB,MAAMC,YAAYD,UAAUE,WAAW,CAAC;QACxC,OAAOD,cAAcE,aAAcF,CAAAA,aAAa,QAAQA,cAAc,IAAG;IAC3E,IACA;QACA,OAAO;IACT;IAEA,MAAM,CAACG,SAAS,GAAGC,WAAW,GAAGT,SAASU,KAAK,CAAC;IAChD,OACEZ,kBAAkBa,IAAI,CAACH,WAAW,OAClCC,WAAWG,KAAK,CAAC,CAACC,YAAcA,UAAUX,IAAI,GAAGD,MAAM,GAAG;AAE9D;AAEA,OAAO,MAAMa,6BAA6B,CAACC;IACzC,IAAI,OAAOA,aAAa,YAAY,CAACC,OAAOC,aAAa,CAACF,aAAaA,WAAW,GAAG;QACnF,MAAM,IAAIpB,SAAS,qDAAqD;IAC1E;AACF,EAAC;AAED,OAAO,MAAMuB,4BAA4B,CAAC,EACxCC,UAAU,EACVC,QAAQ,EACRpB,QAAQ,EAOT;IACC,IACE,OAAOoB,aAAa,YACpBA,SAASnB,MAAM,KAAK,KACpBmB,SAASlB,IAAI,GAAGD,MAAM,KAAK,KAC3B,CAACL,2BAA2BwB,WAC5B;QACA,MAAM,IAAIzB,SAAS,oDAAoD;IACzE;IAEA,MAAM0B,2BACJF,cAAc,OAAOA,WAAWG,MAAM,KAAK,WACvCH,WAAWG,MAAM,CAACD,wBAAwB,GAC1C;IAEN,2FAA2F;IAC3F,0FAA0F;IAC1F,IAAIrB,aAAaO,aAAaP,aAAa,QAAQA,aAAa,IAAI;QAClE,IAAIqB,0BAA0B;YAC5B;QACF;QACA,MAAM,IAAI1B,SAAS,qDAAqD;IAC1E;IAEA,IAAI,CAACI,gBAAgBC,WAAW;QAC9B,MAAM,IAAIL,SAAS,qDAAqD;IAC1E;IAEA,IAAIE,+BAA+B;QAAEwB;QAA0BD;QAAUpB;IAAS,IAAI;QACpF,MAAM,IAAIL,SAAS,uDAAuD;IAC5E;AACF,EAAC"}

package/dist/uploads/assertClientUploadAllowed.spec.js

@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest';
+import { assertClientUploadAllowed } from './assertClientUploadAllowed.js';
+describe('assertClientUploadAllowed', ()=>{
+    it.each([
+        [
+            'missing',
+            undefined
+        ],
+        [
+            'whitespace',
+            '   '
+        ]
+    ])('should validate %s filename metadata', (_, filename)=>{
+        expect(()=>assertClientUploadAllowed({
+                filename: filename,
+                mimeType: 'image/png'
+            })).toThrow('A valid filename is required for client uploads.');
+    });
+    it.each([
+        [
+            'missing',
+            undefined
+        ],
+        [
+            'invalid',
+            'image'
+        ]
+    ])('should validate %s MIME metadata', (_, mimeType)=>{
+        expect(()=>assertClientUploadAllowed({
+                filename: 'image.png',
+                mimeType: mimeType
+            })).toThrow('A valid MIME type is required for client uploads.');
+    });
+    it.each([
+        [
+            'filename extension',
+            'image.SVG',
+            'application/octet-stream'
+        ],
+        [
+            'declared MIME parameters',
+            'image.txt',
+            'image/svg+xml; charset=utf-8'
+        ],
+        [
+            'XML extension',
+            'image.xml',
+            'application/octet-stream'
+        ],
+        [
+            'XML structured-suffix MIME',
+            'image.txt',
+            'application/xhtml+xml; charset=utf-8'
+        ],
+        [
+            'sanitized trailing period',
+            'image.svg.',
+            'application/octet-stream'
+        ]
+    ])('should require a server upload for content identified by %s', (_, filename, mimeType)=>{
+        expect(()=>assertClientUploadAllowed({
+                filename,
+                mimeType
+            })).toThrow('SVG and XML files must be uploaded through Payload.');
+    });
+    it('should preserve configured client upload paths', ()=>{
+        expect(()=>assertClientUploadAllowed({
+                filename: 'image.png',
+                mimeType: 'image/png'
+            })).not.toThrow();
+        expect(()=>assertClientUploadAllowed({
+                collection: {
+                    upload: {
+                        allowRestrictedFileTypes: true
+                    }
+                },
+                filename: 'image.svg',
+                mimeType: 'image/svg+xml'
+            })).not.toThrow();
+        expect(()=>assertClientUploadAllowed({
+                collection: {
+                    upload: {
+                        allowRestrictedFileTypes: true
+                    }
+                },
+                filename: 'image.png'
+            })).not.toThrow();
+    });
+});
+
+//# sourceMappingURL=assertClientUploadAllowed.spec.js.map

package/dist/uploads/assertClientUploadAllowed.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/assertClientUploadAllowed.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { assertClientUploadAllowed } from './assertClientUploadAllowed.js'\n\ndescribe('assertClientUploadAllowed', () => {\n  it.each([\n    ['missing', undefined],\n    ['whitespace', '   '],\n  ])('should validate %s filename metadata', (_, filename) => {\n    expect(() =>\n      assertClientUploadAllowed({\n        filename: filename as unknown as string,\n        mimeType: 'image/png',\n      }),\n    ).toThrow('A valid filename is required for client uploads.')\n  })\n\n  it.each([\n    ['missing', undefined],\n    ['invalid', 'image'],\n  ])('should validate %s MIME metadata', (_, mimeType) => {\n    expect(() =>\n      assertClientUploadAllowed({\n        filename: 'image.png',\n        mimeType: mimeType as unknown as string,\n      }),\n    ).toThrow('A valid MIME type is required for client uploads.')\n  })\n\n  it.each([\n    ['filename extension', 'image.SVG', 'application/octet-stream'],\n    ['declared MIME parameters', 'image.txt', 'image/svg+xml; charset=utf-8'],\n    ['XML extension', 'image.xml', 'application/octet-stream'],\n    ['XML structured-suffix MIME', 'image.txt', 'application/xhtml+xml; charset=utf-8'],\n    ['sanitized trailing period', 'image.svg.', 'application/octet-stream'],\n  ])('should require a server upload for content identified by %s', (_, filename, mimeType) => {\n    expect(() => assertClientUploadAllowed({ filename, mimeType })).toThrow(\n      'SVG and XML files must be uploaded through Payload.',\n    )\n  })\n\n  it('should preserve configured client upload paths', () => {\n    expect(() =>\n      assertClientUploadAllowed({ filename: 'image.png', mimeType: 'image/png' }),\n    ).not.toThrow()\n    expect(() =>\n      assertClientUploadAllowed({\n        collection: { upload: { allowRestrictedFileTypes: true } },\n        filename: 'image.svg',\n        mimeType: 'image/svg+xml',\n      }),\n    ).not.toThrow()\n    expect(() =>\n      assertClientUploadAllowed({\n        collection: { upload: { allowRestrictedFileTypes: true } },\n        filename: 'image.png',\n      }),\n    ).not.toThrow()\n  })\n})\n"],"names":["describe","expect","it","assertClientUploadAllowed","each","undefined","_","filename","mimeType","toThrow","not","collection","upload","allowRestrictedFileTypes"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,yBAAyB,QAAQ,iCAAgC;AAE1EH,SAAS,6BAA6B;IACpCE,GAAGE,IAAI,CAAC;QACN;YAAC;YAAWC;SAAU;QACtB;YAAC;YAAc;SAAM;KACtB,EAAE,wCAAwC,CAACC,GAAGC;QAC7CN,OAAO,IACLE,0BAA0B;gBACxBI,UAAUA;gBACVC,UAAU;YACZ,IACAC,OAAO,CAAC;IACZ;IAEAP,GAAGE,IAAI,CAAC;QACN;YAAC;YAAWC;SAAU;QACtB;YAAC;YAAW;SAAQ;KACrB,EAAE,oCAAoC,CAACC,GAAGE;QACzCP,OAAO,IACLE,0BAA0B;gBACxBI,UAAU;gBACVC,UAAUA;YACZ,IACAC,OAAO,CAAC;IACZ;IAEAP,GAAGE,IAAI,CAAC;QACN;YAAC;YAAsB;YAAa;SAA2B;QAC/D;YAAC;YAA4B;YAAa;SAA+B;QACzE;YAAC;YAAiB;YAAa;SAA2B;QAC1D;YAAC;YAA8B;YAAa;SAAuC;QACnF;YAAC;YAA6B;YAAc;SAA2B;KACxE,EAAE,+DAA+D,CAACE,GAAGC,UAAUC;QAC9EP,OAAO,IAAME,0BAA0B;gBAAEI;gBAAUC;YAAS,IAAIC,OAAO,CACrE;IAEJ;IAEAP,GAAG,kDAAkD;QACnDD,OAAO,IACLE,0BAA0B;gBAAEI,UAAU;gBAAaC,UAAU;YAAY,IACzEE,GAAG,CAACD,OAAO;QACbR,OAAO,IACLE,0BAA0B;gBACxBQ,YAAY;oBAAEC,QAAQ;wBAAEC,0BAA0B;oBAAK;gBAAE;gBACzDN,UAAU;gBACVC,UAAU;YACZ,IACAE,GAAG,CAACD,OAAO;QACbR,OAAO,IACLE,0BAA0B;gBACxBQ,YAAY;oBAAEC,QAAQ;wBAAEC,0BAA0B;oBAAK;gBAAE;gBACzDN,UAAU;YACZ,IACAG,GAAG,CAACD,OAAO;IACf;AACF"}

package/dist/uploads/checkFileRestrictions.d.ts

@@ -3,5 +3,8 @@ import type { checkFileRestrictionsParams, FileAllowList } from './types.js';
  * Restricted file types and their extensions.
  */
 export declare const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList;
-export declare const checkFileRestrictions: ({ collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
+export declare const checkFileRestrictions: ({ collection, file, req, }: checkFileRestrictionsParams) => Promise<{
+    ext: string;
+    mime: string;
+} | undefined>;
 //# sourceMappingURL=checkFileRestrictions.d.ts.map

package/dist/uploads/checkFileRestrictions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,+BAI/B,2BAA2B,KAAG,OAAO,CAAC,IAAI,CAyJ5C,CAAA"}
+{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAqB5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAiC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,+BAI/B,2BAA2B,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8LjF,CAAA"}

package/dist/uploads/checkFileRestrictions.js

@@ -3,9 +3,11 @@ import fs from 'fs/promises';
 import { ValidationError } from '../errors/index.js';
 import { validateMimeType } from '../utilities/validateMimeType.js';
 import { validatePDF } from '../utilities/validatePDF.js';
-import { detectSvgFromXml } from './detectSvgFromXml.js';
 import { getFileTypeFallback } from './getFileTypeFallback.js';
-import { validateSvg } from './validateSvg.js';
+import { getFileExtension, getMimeTypeEssence, getSanitizedUploadFilename, isSvgUpload, isXmlUpload } from './getFileTypeIdentity.js';
+import { isProcessableImage } from './isProcessableImage.js';
+import { isISOBaseMediaMimeType, validateISOBaseMediaBuffer, validateISOBaseMediaFile } from './validateISOBaseMediaFile.js';
+import { inspectSvg, inspectSvgFile } from './validateSvg.js';
 /**
  * Restricted file types and their extensions.
  */ export const RESTRICTED_FILE_EXT_AND_TYPES = [
@@ -111,6 +113,10 @@ import { validateSvg } from './validateSvg.js';
         ],
         mimeType: 'text/html'
     },
+    {
+        extensions: [],
+        mimeType: 'application/xhtml+xml'
+    },
     {
         extensions: [
             'php',
@@ -236,16 +242,12 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
         }
         return mimeType.startsWith('image/') || mimeType.startsWith('video/') || mimeType.startsWith('audio/') || mimeType === 'application/pdf';
     };
-    // Skip validation if `allowRestrictedFileTypes` is true
-    if (allowRestrictedFileTypes) {
-        return;
-    }
     // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory
-    // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is
-    // loaded lazily and only when the file type actually requires it.
+    // just for detection. Content validation streams SVG/XML temp files and only loads a full
+    // temp-file buffer for PDF integrity checks.
     const { tempFilePath } = file;
     const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0);
-    // Lazily reads the full file — only reached for small text-based types (SVG, PDF).
+    // Lazily reads the full file — only reached for PDF validation.
     let _fileBuffer;
     const getFileBuffer = async ()=>{
         if (_fileBuffer) {
@@ -268,12 +270,21 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             });
         }
     };
-    // Secondary mimetype check to assess file type from buffer
-    if (configMimeTypes.length > 0) {
-        let detected;
-        try {
-            detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
-        } catch  {
+    const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name));
+    let isSvg = isSvgUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    });
+    let svgInspection;
+    const getSvgInspection = async ()=>{
+        svgInspection ??= isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data);
+        return svgInspection;
+    };
+    let detected;
+    try {
+        detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
+    } catch  {
+        if (configMimeTypes.length > 0) {
             throw new ValidationError({
                 errors: [
                     {
@@ -283,10 +294,38 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
                 ]
             });
         }
-        const typeFromExtension = file.name.split('.').pop() || '';
+    }
+    if (isSvg || isXmlUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    }) || detected?.mime === 'application/xml' || !detected && isProcessableImage(file.mimetype)) {
+        const inspection = await getSvgInspection();
+        isSvg = inspection.isSvg;
+        if (inspection.isSvg) {
+            detected = {
+                ext: 'svg',
+                mime: 'image/svg+xml'
+            };
+        } else if (inspection.isValid && !detected) {
+            detected = {
+                ext: 'xml',
+                mime: 'application/xml'
+            };
+        }
+    }
+    if (detected && isISOBaseMediaMimeType(detected.mime)) {
+        const isValidISOBaseMedia = isTempFile && tempFilePath ? await validateISOBaseMediaFile(tempFilePath) : await validateISOBaseMediaBuffer(file.data);
+        if (!isValidISOBaseMedia) {
+            errors.push('Invalid or corrupted ISO base media file.');
+        }
+    }
+    if (allowRestrictedFileTypes && errors.length === 0) {
+        return detected;
+    }
+    // Secondary mimetype check to assess file type from buffer
+    if (configMimeTypes.length > 0) {
         // Handle SVG files that are detected as XML due to <?xml declarations
         if (detected?.mime === 'application/xml' && configMimeTypes.some((type)=>type.includes('image/') && (type.includes('svg') || type === 'image/*'))) {
-            const isSvg = detectSvgFromXml(await getFileBuffer());
             if (isSvg) {
                 detected = {
                     ext: 'svg',
@@ -300,13 +339,6 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             if (!extIsValid) {
                 errors.push(`File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`);
             } else {
-                // SVG security check (text-based files not detectable by buffer)
-                if (typeFromExtension.toLowerCase() === 'svg') {
-                    const isSafeSvg = validateSvg(await getFileBuffer());
-                    if (!isSafeSvg) {
-                        errors.push('SVG file contains potentially harmful content.');
-                    }
-                }
                 // PDF validation
                 if (mimeTypeFromExtension === 'application/pdf') {
                     const isValidPDF = validatePDF(await getFileBuffer());
@@ -330,15 +362,22 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             errors.push(`Invalid MIME type: ${detected.mime}.`);
         }
     } else {
+        const mimeTypeEssence = getMimeTypeEssence(file.mimetype);
         const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type)=>{
-            const hasRestrictedExt = type.extensions.some((ext)=>file.name.toLowerCase().endsWith(ext));
-            const hasRestrictedMime = type.mimeType === file.mimetype;
+            const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase());
+            const hasRestrictedMime = type.mimeType === mimeTypeEssence;
             return hasRestrictedExt || hasRestrictedMime;
         });
         if (isRestricted) {
             errors.push(`File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`);
         }
     }
+    if (isSvg) {
+        const isSafeSvg = (await getSvgInspection()).isSafe;
+        if (!isSafeSvg) {
+            errors.push('SVG file contains potentially harmful content.');
+        }
+    }
     if (errors.length > 0) {
         req.payload.logger.error(errors.join(', '));
         throw new ValidationError({
@@ -350,6 +389,7 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             ]
         });
     }
+    return detected;
 };
 
 //# sourceMappingURL=checkFileRestrictions.js.map

package/dist/uploads/checkFileRestrictions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","tempFilePath","isTempFile","data","length","_fileBuffer","getFileBuffer","readFile","message","path","detected","typeFromExtension","name","split","pop","mime","some","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","toLowerCase","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","endsWith","hasRestrictedMime","mimetype","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACb;QAC7B,MAAMc,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAACf,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIY,0BAA0B;QAC5B;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEK,YAAY,EAAE,GAAGd;IACzB,MAAMe,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACd,KAAKgB,IAAI,IAAIhB,KAAKgB,IAAI,CAACC,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIC;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACH,cAAc,CAACD,cAAc;YAChC,OAAQI,cAAclB,KAAKgB,IAAI;QACjC;QACA,IAAI;YACFE,cAAc,MAAM9B,GAAGgC,QAAQ,CAACN;YAChC,OAAOI;QACT,EAAE,OAAM;YACN,MAAM,IAAI7B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIjB,gBAAgBY,MAAM,GAAG,GAAG;QAC9B,IAAIM;QACJ,IAAI;YACFA,WACER,cAAcD,eACV,MAAM3B,iBAAiB2B,gBACvB,MAAM5B,mBAAmBc,KAAKgB,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAI3B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAME,oBAAoBxB,KAAKyB,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEJ,UAAUK,SAAS,qBACnBvB,gBAAgBwB,IAAI,CAClB,CAACC,OAASA,KAAKlB,QAAQ,CAAC,aAAckB,CAAAA,KAAKlB,QAAQ,CAAC,UAAUkB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQvC,iBAAiB,MAAM2B;YACrC,IAAIY,OAAO;gBACTR,WAAW;oBAAES,KAAK;oBAAOJ,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACL,UAAU;YACb,MAAMU,wBAAwBxC,oBAAoBO,KAAKyB,IAAI,EAAEG,IAAI;YACjE,MAAMM,aAAa5C,iBAAiB2C,uBAAuB5B;YAE3D,IAAI,CAAC6B,YAAY;gBACfhC,OAAOiC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAET,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBY,WAAW,OAAO,OAAO;oBAC7C,MAAMC,YAAY3C,YAAY,MAAMyB;oBACpC,IAAI,CAACkB,WAAW;wBACdnC,OAAOiC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMK,aAAa/C,YAAY,MAAM4B;oBACrC,IAAI,CAACmB,YAAY;wBACfpC,OAAOiC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAIzB,sBAAsBuB,wBAAwB;gBAChDhC,IAAIsC,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAEzC,KAAKyB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiB,sBAAsBnB,UAAUK,QAAQtC,iBAAiBiC,SAASK,IAAI,EAAEvB;QAE9E,IAAIqC,uBAAuBnB,UAAUK,SAAS,mBAAmB;YAC/D,MAAMU,aAAa/C,YAAY,MAAM4B;YACrC,IAAI,CAACmB,YAAY;gBACfpC,OAAOiC,IAAI,CAAC;YACd;QACF;QAEA,IAAIZ,YAAY,CAACmB,qBAAqB;YACpCxC,OAAOiC,IAAI,CAAC,CAAC,mBAAmB,EAAEZ,SAASK,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMe,eAAehD,8BAA8BkC,IAAI,CAAC,CAACC;YACvD,MAAMc,mBAAmBd,KAAKlC,UAAU,CAACiC,IAAI,CAAC,CAACG,MAAQhC,KAAKyB,IAAI,CAACW,WAAW,GAAGS,QAAQ,CAACb;YACxF,MAAMc,oBAAoBhB,KAAKjC,QAAQ,KAAKG,KAAK+C,QAAQ;YACzD,OAAOH,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChBzC,OAAOiC,IAAI,CACT,CAAC,WAAW,EAAEnC,KAAK+C,QAAQ,CAAC,cAAc,EAAE/C,KAAKyB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIvB,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIsC,OAAO,CAACC,MAAM,CAACQ,KAAK,CAAC9C,OAAO+C,IAAI,CAAC;QACrC,MAAM,IAAI5D,gBAAgB;YACxBa,QAAQ;gBAAC;oBAAEmB,SAASnB,OAAO+C,IAAI,CAAC;oBAAO3B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport {\n  getFileExtension,\n  getMimeTypeEssence,\n  getSanitizedUploadFilename,\n  isSvgUpload,\n  isXmlUpload,\n} from './getFileTypeIdentity.js'\nimport { isProcessableImage } from './isProcessableImage.js'\nimport {\n  isISOBaseMediaMimeType,\n  validateISOBaseMediaBuffer,\n  validateISOBaseMediaFile,\n} from './validateISOBaseMediaFile.js'\nimport { inspectSvg, inspectSvgFile } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: [], mimeType: 'application/xhtml+xml' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<{ ext: string; mime: string } | undefined> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. Content validation streams SVG/XML temp files and only loads a full\n  // temp-file buffer for PDF integrity checks.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for PDF validation.\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name))\n  let isSvg = isSvgUpload({ filename: file.name, mimeType: file.mimetype })\n  let svgInspection: Awaited<ReturnType<typeof inspectSvgFile>> | undefined\n\n  const getSvgInspection = async () => {\n    svgInspection ??=\n      isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data)\n    return svgInspection\n  }\n\n  let detected\n  try {\n    detected =\n      isTempFile && tempFilePath\n        ? await fileTypeFromFile(tempFilePath)\n        : await fileTypeFromBuffer(file.data)\n  } catch {\n    if (configMimeTypes.length > 0) {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n  }\n\n  if (\n    isSvg ||\n    isXmlUpload({ filename: file.name, mimeType: file.mimetype }) ||\n    detected?.mime === 'application/xml' ||\n    (!detected && isProcessableImage(file.mimetype))\n  ) {\n    const inspection = await getSvgInspection()\n    isSvg = inspection.isSvg\n    if (inspection.isSvg) {\n      detected = { ext: 'svg', mime: 'image/svg+xml' }\n    } else if (inspection.isValid && !detected) {\n      detected = { ext: 'xml', mime: 'application/xml' }\n    }\n  }\n\n  if (detected && isISOBaseMediaMimeType(detected.mime)) {\n    const isValidISOBaseMedia =\n      isTempFile && tempFilePath\n        ? await validateISOBaseMediaFile(tempFilePath)\n        : await validateISOBaseMediaBuffer(file.data)\n\n    if (!isValidISOBaseMedia) {\n      errors.push('Invalid or corrupted ISO base media file.')\n    }\n  }\n\n  if (allowRestrictedFileTypes && errors.length === 0) {\n    return detected\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const mimeTypeEssence = getMimeTypeEssence(file.mimetype)\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase())\n      const hasRestrictedMime = type.mimeType === mimeTypeEssence\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (isSvg) {\n    const isSafeSvg = (await getSvgInspection()).isSafe\n    if (!isSafeSvg) {\n      errors.push('SVG file contains potentially harmful content.')\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n\n  return detected\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","getFileTypeFallback","getFileExtension","getMimeTypeEssence","getSanitizedUploadFilename","isSvgUpload","isXmlUpload","isProcessableImage","isISOBaseMediaMimeType","validateISOBaseMediaBuffer","validateISOBaseMediaFile","inspectSvg","inspectSvgFile","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","tempFilePath","isTempFile","data","length","_fileBuffer","getFileBuffer","readFile","message","path","typeFromExtension","name","isSvg","filename","mimetype","svgInspection","getSvgInspection","detected","mime","inspection","ext","isValid","isValidISOBaseMedia","push","some","type","mimeTypeFromExtension","extIsValid","isValidPDF","payload","logger","warn","passesMimeTypeCheck","mimeTypeEssence","isRestricted","hasRestrictedExt","toLowerCase","hasRestrictedMime","isSafeSvg","isSafe","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SACEC,gBAAgB,EAChBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,WAAW,EACXC,WAAW,QACN,2BAA0B;AACjC,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,wBAAwB,QACnB,gCAA+B;AACtC,SAASC,UAAU,EAAEC,cAAc,QAAQ,mBAAkB;AAE7D;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY,EAAE;QAAEC,UAAU;IAAwB;IACpD;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACb;QAC7B,MAAMc,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAACf,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,aAAa;IAEjB;IAEA,gGAAgG;IAChG,0FAA0F;IAC1F,6CAA6C;IAC7C,MAAM,EAAEiB,YAAY,EAAE,GAAGd;IACzB,MAAMe,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACd,KAAKgB,IAAI,IAAIhB,KAAKgB,IAAI,CAACC,MAAM,KAAK,CAAA;IAEzE,gEAAgE;IAChE,IAAIC;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACH,cAAc,CAACD,cAAc;YAChC,OAAQI,cAAclB,KAAKgB,IAAI;QACjC;QACA,IAAI;YACFE,cAAc,MAAMvC,GAAGyC,QAAQ,CAACN;YAChC,OAAOI;QACT,EAAE,OAAM;YACN,MAAM,IAAItC,gBAAgB;gBACxBsB,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,MAAMC,oBAAoBvC,iBAAiBE,2BAA2Bc,KAAKwB,IAAI;IAC/E,IAAIC,QAAQtC,YAAY;QAAEuC,UAAU1B,KAAKwB,IAAI;QAAE3B,UAAUG,KAAK2B,QAAQ;IAAC;IACvE,IAAIC;IAEJ,MAAMC,mBAAmB;QACvBD,kBACEb,cAAcD,eAAe,MAAMpB,eAAeoB,gBAAgBrB,WAAWO,KAAKgB,IAAI;QACxF,OAAOY;IACT;IAEA,IAAIE;IACJ,IAAI;QACFA,WACEf,cAAcD,eACV,MAAMpC,iBAAiBoC,gBACvB,MAAMrC,mBAAmBuB,KAAKgB,IAAI;IAC1C,EAAE,OAAM;QACN,IAAIX,gBAAgBY,MAAM,GAAG,GAAG;YAC9B,MAAM,IAAIrC,gBAAgB;gBACxBsB,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;IACF;IAEA,IACEG,SACArC,YAAY;QAAEsC,UAAU1B,KAAKwB,IAAI;QAAE3B,UAAUG,KAAK2B,QAAQ;IAAC,MAC3DG,UAAUC,SAAS,qBAClB,CAACD,YAAYzC,mBAAmBW,KAAK2B,QAAQ,GAC9C;QACA,MAAMK,aAAa,MAAMH;QACzBJ,QAAQO,WAAWP,KAAK;QACxB,IAAIO,WAAWP,KAAK,EAAE;YACpBK,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAgB;QACjD,OAAO,IAAIC,WAAWE,OAAO,IAAI,CAACJ,UAAU;YAC1CA,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAkB;QACnD;IACF;IAEA,IAAID,YAAYxC,uBAAuBwC,SAASC,IAAI,GAAG;QACrD,MAAMI,sBACJpB,cAAcD,eACV,MAAMtB,yBAAyBsB,gBAC/B,MAAMvB,2BAA2BS,KAAKgB,IAAI;QAEhD,IAAI,CAACmB,qBAAqB;YACxBjC,OAAOkC,IAAI,CAAC;QACd;IACF;IAEA,IAAI3B,4BAA4BP,OAAOe,MAAM,KAAK,GAAG;QACnD,OAAOa;IACT;IAEA,2DAA2D;IAC3D,IAAIzB,gBAAgBY,MAAM,GAAG,GAAG;QAC9B,sEAAsE;QACtE,IACEa,UAAUC,SAAS,qBACnB1B,gBAAgBgC,IAAI,CAClB,CAACC,OAASA,KAAK1B,QAAQ,CAAC,aAAc0B,CAAAA,KAAK1B,QAAQ,CAAC,UAAU0B,SAAS,SAAQ,IAEjF;YACA,IAAIb,OAAO;gBACTK,WAAW;oBAAEG,KAAK;oBAAOF,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACD,UAAU;YACb,MAAMS,wBAAwBxD,oBAAoBiB,KAAKwB,IAAI,EAAEO,IAAI;YACjE,MAAMS,aAAa3D,iBAAiB0D,uBAAuBlC;YAE3D,IAAI,CAACmC,YAAY;gBACftC,OAAOkC,IAAI,CACT,CAAC,UAAU,EAAEG,sBAAsB,iBAAiB,EAAEhB,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iBAAiB;gBACjB,IAAIgB,0BAA0B,mBAAmB;oBAC/C,MAAME,aAAa3D,YAAY,MAAMqC;oBACrC,IAAI,CAACsB,YAAY;wBACfvC,OAAOkC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI1B,sBAAsB6B,wBAAwB;gBAChDtC,IAAIyC,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE5C,KAAKwB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMqB,sBAAsBf,UAAUC,QAAQlD,iBAAiBiD,SAASC,IAAI,EAAE1B;QAE9E,IAAIwC,uBAAuBf,UAAUC,SAAS,mBAAmB;YAC/D,MAAMU,aAAa3D,YAAY,MAAMqC;YACrC,IAAI,CAACsB,YAAY;gBACfvC,OAAOkC,IAAI,CAAC;YACd;QACF;QAEA,IAAIN,YAAY,CAACe,qBAAqB;YACpC3C,OAAOkC,IAAI,CAAC,CAAC,mBAAmB,EAAEN,SAASC,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMe,kBAAkB7D,mBAAmBe,KAAK2B,QAAQ;QACxD,MAAMoB,eAAepD,8BAA8B0C,IAAI,CAAC,CAACC;YACvD,MAAMU,mBAAmBV,KAAK1C,UAAU,CAACgB,QAAQ,CAACW,kBAAkB0B,WAAW;YAC/E,MAAMC,oBAAoBZ,KAAKzC,QAAQ,KAAKiD;YAC5C,OAAOE,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChB7C,OAAOkC,IAAI,CACT,CAAC,WAAW,EAAEpC,KAAK2B,QAAQ,CAAC,cAAc,EAAE3B,KAAKwB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIC,OAAO;QACT,MAAM0B,YAAY,AAAC,CAAA,MAAMtB,kBAAiB,EAAGuB,MAAM;QACnD,IAAI,CAACD,WAAW;YACdjD,OAAOkC,IAAI,CAAC;QACd;IACF;IAEA,IAAIlC,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIyC,OAAO,CAACC,MAAM,CAACU,KAAK,CAACnD,OAAOoD,IAAI,CAAC;QACrC,MAAM,IAAI1E,gBAAgB;YACxBsB,QAAQ;gBAAC;oBAAEmB,SAASnB,OAAOoD,IAAI,CAAC;oBAAOhC,MAAM;gBAAO;aAAE;QACxD;IACF;IAEA,OAAOQ;AACT,EAAC"}

package/dist/uploads/clientUploadReceipt.d.ts

@@ -0,0 +1,23 @@
+import type { PayloadRequest } from '../types/index.js';
+export type ClientUploadReceipt = {
+    collectionSlug: string;
+    context: Record<string, unknown>;
+    expiresAt: number;
+    filename: string;
+    userCollection: null | string;
+    userID: null | number | string;
+};
+export type SignedClientUploadReceipt = `${string}.${string}`;
+export declare const createClientUploadReceipt: ({ collectionSlug, context, filename, req, user, }: {
+    collectionSlug: string;
+    context: Record<string, unknown>;
+    filename: string;
+    req: PayloadRequest;
+    user?: Pick<ClientUploadReceipt, "userCollection" | "userID">;
+}) => SignedClientUploadReceipt;
+export declare const verifyClientUploadReceipt: ({ collectionSlug, req, signedReceipt, }: {
+    collectionSlug: string;
+    req: PayloadRequest;
+    signedReceipt: string;
+}) => ClientUploadReceipt;
+//# sourceMappingURL=clientUploadReceipt.d.ts.map

package/dist/uploads/clientUploadReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientUploadReceipt.d.ts","sourceRoot":"","sources":["../../src/uploads/clientUploadReceipt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,IAAI,GAAG,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B,CAAA;AAGD,MAAM,MAAM,yBAAyB,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAK7D,eAAO,MAAM,yBAAyB,sDAMnC;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CAAA;CAC9D,KAAG,yBAWH,CAAA;AAED,eAAO,MAAM,yBAAyB,4CAInC;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB,KAAG,mBA2BH,CAAA"}