payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/uploads/fetchAPI-multipart/processMultipart.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/processMultipart.ts"],"sourcesContent":["import type { Readable } from 'stream'\n\nimport Busboy from 'busboy'\nimport { status as httpStatus } from 'http-status'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\nimport type { FetchAPIFileUploadResponse } from './index.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { fileFactory } from './fileFactory.js'\nimport { memHandler, tempFileHandler } from './handlers.js'\nimport { processNested } from './processNested.js'\nimport { createUploadTimer } from './uploadTimer.js'\nimport { buildFields, debugLog, isFunc, parseFileName } from './utilities.js'\n\nconst waitFlushProperty = Symbol('wait flush property symbol')\n\ndeclare global {\n  interface Request {\n    [waitFlushProperty]?: Promise<any>[]\n  }\n}\n\ntype ProcessMultipart = (args: {\n  options: FetchAPIFileUploadOptions\n  request: Request\n}) => Promise<FetchAPIFileUploadResponse>\nexport const processMultipart: ProcessMultipart = async ({ options, request }) => {\n  let parsingRequest = true\n\n  let shouldAbortProccessing = false\n  let fileCount = 0\n  let filesCompleted = 0\n  let allFilesHaveResolved: (value?: unknown) => void\n  let failedResolvingFiles: (err: Error) => void\n  let busboyFinishedResolve: () => void\n  let busboyFinishedReject: (err: Error) => void\n\n  const allFilesComplete = new Promise((res, rej) => {\n    allFilesHaveResolved = res\n    failedResolvingFiles = rej\n  })\n  // Attach a no-op catch handler immediately to prevent Node.js from treating this as\n  // an unhandled rejection if failedResolvingFiles() is called while the read loop is\n  // still suspended at `await reader.read()`. The real error is rethrown below.\n  allFilesComplete.catch(() => {})\n\n  const busboyFinished = new Promise<void>((resolve, reject) => {\n    busboyFinishedResolve = resolve\n    busboyFinishedReject = reject\n  })\n  // Prevent unhandled rejection when abortOnLimit rejects allFilesComplete\n  // (which throws at line ~241) before execution reaches `await busboyFinished`.\n  busboyFinished.catch(() => {})\n\n  const result: FetchAPIFileUploadResponse = {\n    fields: undefined!,\n    files: undefined!,\n  }\n\n  const headersObject: Record<string, string> = {}\n  request.headers.forEach((value, name) => {\n    headersObject[name] = value\n  })\n\n  const reader = request.body?.getReader()\n\n  const busboy = Busboy({ ...options, headers: headersObject })\n\n  function abortAndDestroyFile(file: Readable, err: APIError) {\n    file.destroy()\n    shouldAbortProccessing = true\n    failedResolvingFiles(err)\n    // Cancel the reader so the while loop exits immediately rather than draining\n    // the rest of the request body after an abort.\n    void reader?.cancel()\n  }\n\n  // Build multipart req.body fields\n  busboy.on('field', (field, val) => {\n    result.fields = buildFields(result.fields, field, val)\n  })\n\n  // Build req.files fields\n  busboy.on('file', (field, file, info) => {\n    fileCount += 1\n    // Parse file name(cutting huge names, decoding, etc..).\n    const { encoding, filename: name, mimeType: mime } = info\n    const filename = parseFileName(options, name)\n\n    const inferredMimeType =\n      (filename && filename.endsWith('.glb') && 'model/gltf-binary') ||\n      (filename && filename.endsWith('.gltf') && 'model/gltf+json') ||\n      mime\n\n    // Define methods and handlers for upload process.\n    const { cleanup, complete, dataHandler, getFilePath, getFileSize, getHash, getWritePromise } =\n      options.useTempFiles\n        ? tempFileHandler(options, field, filename) // Upload into temporary file.\n        : memHandler(options, field, filename) // Upload into RAM.\n\n    const writePromise = options.useTempFiles\n      ? getWritePromise().catch(() => {\n          busboy.end()\n          cleanup()\n        })\n      : getWritePromise()\n\n    const uploadTimer = createUploadTimer(options.uploadTimeout, () => {\n      return abortAndDestroyFile(\n        file,\n        new APIError(`Upload timeout for ${field}->${filename}, bytes:${getFileSize()}`),\n      )\n    })\n\n    file.on('limit', () => {\n      debugLog(options, `Size limit reached for ${field}->${filename}, bytes:${getFileSize()}`)\n      uploadTimer.clear()\n\n      if (isFunc(options.limitHandler)) {\n        options.limitHandler({ request, size: getFileSize() })\n      }\n\n      // Return error and cleanup files if abortOnLimit set.\n      if (options.abortOnLimit) {\n        debugLog(options, `Upload file size limit reached ${field}->${filename}.`)\n        cleanup()\n        abortAndDestroyFile(\n          file,\n          new APIError(options.responseOnLimit!, httpStatus.REQUEST_ENTITY_TOO_LARGE, {\n            size: getFileSize(),\n          }),\n        )\n      }\n    })\n\n    file.on('data', (data) => {\n      uploadTimer.set()\n      dataHandler(data)\n    })\n\n    file.on('end', () => {\n      const size = getFileSize()\n      debugLog(options, `Upload finished ${field}->${filename}, bytes:${size}`)\n      uploadTimer.clear()\n\n      if (!name && size === 0) {\n        fileCount -= 1\n        if (options.useTempFiles) {\n          cleanup()\n          debugLog(options, `Removing the empty file ${field}->${filename}`)\n        }\n        return debugLog(options, `Don't add file instance if original name and size are empty`)\n      }\n\n      filesCompleted += 1\n\n      result.files = buildFields(\n        result.files,\n        field,\n        fileFactory(\n          {\n            name: filename,\n            buffer: complete(),\n            encoding,\n            hash: getHash(),\n            mimetype: inferredMimeType,\n            size,\n            tempFilePath: getFilePath(),\n            truncated: Boolean('truncated' in file && file.truncated) || false,\n          },\n          options,\n        ),\n      )\n\n      if (!request[waitFlushProperty]) {\n        request[waitFlushProperty] = []\n      }\n      request[waitFlushProperty].push(writePromise)\n\n      if (filesCompleted === fileCount) {\n        allFilesHaveResolved()\n      }\n    })\n\n    file.on('error', (err) => {\n      uploadTimer.clear()\n      debugLog(options, `File Error: ${err.message}`)\n      cleanup()\n      failedResolvingFiles(err)\n    })\n\n    // Start upload process.\n    debugLog(options, `New upload started ${field}->${filename}, bytes:${getFileSize()}`)\n    uploadTimer.set()\n  })\n\n  busboy.on('finish', async () => {\n    debugLog(options, `Busboy finished parsing request.`)\n    if (options.parseNested) {\n      result.fields = processNested(result.fields)\n      result.files = processNested(result.files)\n    }\n\n    if (request[waitFlushProperty]) {\n      try {\n        await Promise.all(request[waitFlushProperty]).then(() => {\n          delete request[waitFlushProperty]\n        })\n      } catch (err) {\n        debugLog(options, `Error waiting for file write promises: ${err}`)\n      }\n    }\n\n    busboyFinishedResolve()\n  })\n\n  busboy.on('error', (err?: Error) => {\n    debugLog(options, `Busboy error`)\n    shouldAbortProccessing = true\n    const busboyError =\n      err instanceof Error\n        ? err\n        : new APIError('Busboy error parsing multipart request', httpStatus.BAD_REQUEST)\n    // Reject both promises so neither hangs regardless of whether files were in-flight.\n    failedResolvingFiles(busboyError)\n    busboyFinishedReject(busboyError)\n  })\n\n  while (parsingRequest) {\n    const { done, value } = await reader!.read()\n\n    if (done) {\n      parsingRequest = false\n      busboy.end()\n    }\n\n    if (value && !shouldAbortProccessing) {\n      busboy.write(value)\n    }\n  }\n\n  if (fileCount !== 0) {\n    await allFilesComplete.catch((e) => {\n      throw e\n    })\n  }\n\n  await busboyFinished\n\n  return result\n}\n"],"names":["Busboy","status","httpStatus","APIError","fileFactory","memHandler","tempFileHandler","processNested","createUploadTimer","buildFields","debugLog","isFunc","parseFileName","waitFlushProperty","Symbol","processMultipart","options","request","parsingRequest","shouldAbortProccessing","fileCount","filesCompleted","allFilesHaveResolved","failedResolvingFiles","busboyFinishedResolve","busboyFinishedReject","allFilesComplete","Promise","res","rej","catch","busboyFinished","resolve","reject","result","fields","undefined","files","headersObject","headers","forEach","value","name","reader","body","getReader","busboy","abortAndDestroyFile","file","err","destroy","cancel","on","field","val","info","encoding","filename","mimeType","mime","inferredMimeType","endsWith","cleanup","complete","dataHandler","getFilePath","getFileSize","getHash","getWritePromise","useTempFiles","writePromise","end","uploadTimer","uploadTimeout","clear","limitHandler","size","abortOnLimit","responseOnLimit","REQUEST_ENTITY_TOO_LARGE","data","set","buffer","hash","mimetype","tempFilePath","truncated","Boolean","push","message","parseNested","all","then","busboyError","Error","BAD_REQUEST","done","read","write","e"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAKlD,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,UAAU,EAAEC,eAAe,QAAQ,gBAAe;AAC3D,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,iBAAiB,QAAQ,mBAAkB;AACpD,SAASC,WAAW,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,aAAa,QAAQ,iBAAgB;AAE7E,MAAMC,oBAAoBC,OAAO;AAYjC,OAAO,MAAMC,mBAAqC,OAAO,EAAEC,OAAO,EAAEC,OAAO,EAAE;IAC3E,IAAIC,iBAAiB;IAErB,IAAIC,yBAAyB;IAC7B,IAAIC,YAAY;IAChB,IAAIC,iBAAiB;IACrB,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJ,MAAMC,mBAAmB,IAAIC,QAAQ,CAACC,KAAKC;QACzCP,uBAAuBM;QACvBL,uBAAuBM;IACzB;IACA,oFAAoF;IACpF,oFAAoF;IACpF,8EAA8E;IAC9EH,iBAAiBI,KAAK,CAAC,KAAO;IAE9B,MAAMC,iBAAiB,IAAIJ,QAAc,CAACK,SAASC;QACjDT,wBAAwBQ;QACxBP,uBAAuBQ;IACzB;IACA,yEAAyE;IACzE,+EAA+E;IAC/EF,eAAeD,KAAK,CAAC,KAAO;IAE5B,MAAMI,SAAqC;QACzCC,QAAQC;QACRC,OAAOD;IACT;IAEA,MAAME,gBAAwC,CAAC;IAC/CrB,QAAQsB,OAAO,CAACC,OAAO,CAAC,CAACC,OAAOC;QAC9BJ,aAAa,CAACI,KAAK,GAAGD;IACxB;IAEA,MAAME,SAAS1B,QAAQ2B,IAAI,EAAEC;IAE7B,MAAMC,SAAS9C,OAAO;QAAE,GAAGgB,OAAO;QAAEuB,SAASD;IAAc;IAE3D,SAASS,oBAAoBC,IAAc,EAAEC,GAAa;QACxDD,KAAKE,OAAO;QACZ/B,yBAAyB;QACzBI,qBAAqB0B;QACrB,6EAA6E;QAC7E,+CAA+C;QAC/C,KAAKN,QAAQQ;IACf;IAEA,kCAAkC;IAClCL,OAAOM,EAAE,CAAC,SAAS,CAACC,OAAOC;QACzBpB,OAAOC,MAAM,GAAG1B,YAAYyB,OAAOC,MAAM,EAAEkB,OAAOC;IACpD;IAEA,yBAAyB;IACzBR,OAAOM,EAAE,CAAC,QAAQ,CAACC,OAAOL,MAAMO;QAC9BnC,aAAa;QACb,wDAAwD;QACxD,MAAM,EAAEoC,QAAQ,EAAEC,UAAUf,IAAI,EAAEgB,UAAUC,IAAI,EAAE,GAAGJ;QACrD,MAAME,WAAW7C,cAAcI,SAAS0B;QAExC,MAAMkB,mBACJ,AAACH,YAAYA,SAASI,QAAQ,CAAC,WAAW,uBACzCJ,YAAYA,SAASI,QAAQ,CAAC,YAAY,qBAC3CF;QAEF,kDAAkD;QAClD,MAAM,EAAEG,OAAO,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,EAAEC,WAAW,EAAEC,OAAO,EAAEC,eAAe,EAAE,GAC1FpD,QAAQqD,YAAY,GAChB/D,gBAAgBU,SAASqC,OAAOI,UAAU,8BAA8B;WACxEpD,WAAWW,SAASqC,OAAOI,UAAU,mBAAmB;;QAE9D,MAAMa,eAAetD,QAAQqD,YAAY,GACrCD,kBAAkBtC,KAAK,CAAC;YACtBgB,OAAOyB,GAAG;YACVT;QACF,KACAM;QAEJ,MAAMI,cAAchE,kBAAkBQ,QAAQyD,aAAa,EAAE;YAC3D,OAAO1B,oBACLC,MACA,IAAI7C,SAAS,CAAC,mBAAmB,EAAEkD,MAAM,EAAE,EAAEI,SAAS,QAAQ,EAAES,eAAe;QAEnF;QAEAlB,KAAKI,EAAE,CAAC,SAAS;YACf1C,SAASM,SAAS,CAAC,uBAAuB,EAAEqC,MAAM,EAAE,EAAEI,SAAS,QAAQ,EAAES,eAAe;YACxFM,YAAYE,KAAK;YAEjB,IAAI/D,OAAOK,QAAQ2D,YAAY,GAAG;gBAChC3D,QAAQ2D,YAAY,CAAC;oBAAE1D;oBAAS2D,MAAMV;gBAAc;YACtD;YAEA,sDAAsD;YACtD,IAAIlD,QAAQ6D,YAAY,EAAE;gBACxBnE,SAASM,SAAS,CAAC,+BAA+B,EAAEqC,MAAM,EAAE,EAAEI,SAAS,CAAC,CAAC;gBACzEK;gBACAf,oBACEC,MACA,IAAI7C,SAASa,QAAQ8D,eAAe,EAAG5E,WAAW6E,wBAAwB,EAAE;oBAC1EH,MAAMV;gBACR;YAEJ;QACF;QAEAlB,KAAKI,EAAE,CAAC,QAAQ,CAAC4B;YACfR,YAAYS,GAAG;YACfjB,YAAYgB;QACd;QAEAhC,KAAKI,EAAE,CAAC,OAAO;YACb,MAAMwB,OAAOV;YACbxD,SAASM,SAAS,CAAC,gBAAgB,EAAEqC,MAAM,EAAE,EAAEI,SAAS,QAAQ,EAAEmB,MAAM;YACxEJ,YAAYE,KAAK;YAEjB,IAAI,CAAChC,QAAQkC,SAAS,GAAG;gBACvBxD,aAAa;gBACb,IAAIJ,QAAQqD,YAAY,EAAE;oBACxBP;oBACApD,SAASM,SAAS,CAAC,wBAAwB,EAAEqC,MAAM,EAAE,EAAEI,UAAU;gBACnE;gBACA,OAAO/C,SAASM,SAAS,CAAC,2DAA2D,CAAC;YACxF;YAEAK,kBAAkB;YAElBa,OAAOG,KAAK,GAAG5B,YACbyB,OAAOG,KAAK,EACZgB,OACAjD,YACE;gBACEsC,MAAMe;gBACNyB,QAAQnB;gBACRP;gBACA2B,MAAMhB;gBACNiB,UAAUxB;gBACVgB;gBACAS,cAAcpB;gBACdqB,WAAWC,QAAQ,eAAevC,QAAQA,KAAKsC,SAAS,KAAK;YAC/D,GACAtE;YAIJ,IAAI,CAACC,OAAO,CAACJ,kBAAkB,EAAE;gBAC/BI,OAAO,CAACJ,kBAAkB,GAAG,EAAE;YACjC;YACAI,OAAO,CAACJ,kBAAkB,CAAC2E,IAAI,CAAClB;YAEhC,IAAIjD,mBAAmBD,WAAW;gBAChCE;YACF;QACF;QAEA0B,KAAKI,EAAE,CAAC,SAAS,CAACH;YAChBuB,YAAYE,KAAK;YACjBhE,SAASM,SAAS,CAAC,YAAY,EAAEiC,IAAIwC,OAAO,EAAE;YAC9C3B;YACAvC,qBAAqB0B;QACvB;QAEA,wBAAwB;QACxBvC,SAASM,SAAS,CAAC,mBAAmB,EAAEqC,MAAM,EAAE,EAAEI,SAAS,QAAQ,EAAES,eAAe;QACpFM,YAAYS,GAAG;IACjB;IAEAnC,OAAOM,EAAE,CAAC,UAAU;QAClB1C,SAASM,SAAS,CAAC,gCAAgC,CAAC;QACpD,IAAIA,QAAQ0E,WAAW,EAAE;YACvBxD,OAAOC,MAAM,GAAG5B,cAAc2B,OAAOC,MAAM;YAC3CD,OAAOG,KAAK,GAAG9B,cAAc2B,OAAOG,KAAK;QAC3C;QAEA,IAAIpB,OAAO,CAACJ,kBAAkB,EAAE;YAC9B,IAAI;gBACF,MAAMc,QAAQgE,GAAG,CAAC1E,OAAO,CAACJ,kBAAkB,EAAE+E,IAAI,CAAC;oBACjD,OAAO3E,OAAO,CAACJ,kBAAkB;gBACnC;YACF,EAAE,OAAOoC,KAAK;gBACZvC,SAASM,SAAS,CAAC,uCAAuC,EAAEiC,KAAK;YACnE;QACF;QAEAzB;IACF;IAEAsB,OAAOM,EAAE,CAAC,SAAS,CAACH;QAClBvC,SAASM,SAAS,CAAC,YAAY,CAAC;QAChCG,yBAAyB;QACzB,MAAM0E,cACJ5C,eAAe6C,QACX7C,MACA,IAAI9C,SAAS,0CAA0CD,WAAW6F,WAAW;QACnF,oFAAoF;QACpFxE,qBAAqBsE;QACrBpE,qBAAqBoE;IACvB;IAEA,MAAO3E,eAAgB;QACrB,MAAM,EAAE8E,IAAI,EAAEvD,KAAK,EAAE,GAAG,MAAME,OAAQsD,IAAI;QAE1C,IAAID,MAAM;YACR9E,iBAAiB;YACjB4B,OAAOyB,GAAG;QACZ;QAEA,IAAI9B,SAAS,CAACtB,wBAAwB;YACpC2B,OAAOoD,KAAK,CAACzD;QACf;IACF;IAEA,IAAIrB,cAAc,GAAG;QACnB,MAAMM,iBAAiBI,KAAK,CAAC,CAACqE;YAC5B,MAAMA;QACR;IACF;IAEA,MAAMpE;IAEN,OAAOG;AACT,EAAC"}
+{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/processMultipart.ts"],"sourcesContent":["import type { Readable } from 'stream'\n\nimport Busboy from 'busboy'\nimport { status as httpStatus } from 'http-status'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\nimport type { FetchAPIFileUploadResponse } from './index.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { fileFactory } from './fileFactory.js'\nimport { memHandler, tempFileHandler } from './handlers.js'\nimport { processNested } from './processNested.js'\nimport { createUploadTimer } from './uploadTimer.js'\nimport { buildFields, isFunc, parseFileName } from './utilities.js'\n\ntype ProcessMultipart = (args: {\n  options: FetchAPIFileUploadOptions\n  request: Request\n}) => Promise<FetchAPIFileUploadResponse>\n\nexport const processMultipart: ProcessMultipart = async ({ options, request }) => {\n  const { requestSizeLimit = Infinity, ...busboyOptions } = options\n  const result: FetchAPIFileUploadResponse = { fields: undefined!, files: undefined! }\n  const headers: Record<string, string> = {}\n  request.headers.forEach((value, name) => {\n    headers[name] = value\n  })\n  const busboy = Busboy({ ...busboyOptions, headers })\n  const reader = request.body!.getReader()\n  const uploads: { cleanup: () => Promise<void> | void; clear: () => void; file: Readable }[] = []\n  const writes: Promise<boolean>[] = []\n  let failure: Error | undefined\n  let requestSize = 0\n  let rejectFinished: (err: Error) => void\n  let resolveFinished: () => void\n  const finished = new Promise<void>((resolve, reject) => {\n    resolveFinished = resolve\n    rejectFinished = reject\n  })\n\n  const fail = (err: Error) => {\n    if (failure) {\n      return\n    }\n    failure = err\n    rejectFinished(err)\n    // Busboy may still be updating its current file after emitting a limit event.\n    queueMicrotask(() => {\n      for (const upload of uploads) {\n        upload.clear()\n        upload.file.destroy()\n      }\n      busboy.destroy()\n      void reader.cancel(err).catch(() => {})\n    })\n  }\n  const limitError = () =>\n    new APIError('Multipart limit has been reached', httpStatus.REQUEST_ENTITY_TOO_LARGE)\n  const requestSizeLimitError = () =>\n    new APIError(\n      'Multipart request size limit has been reached',\n      httpStatus.REQUEST_ENTITY_TOO_LARGE,\n    )\n\n  busboy.on('filesLimit', () => fail(limitError()))\n  busboy.on('fieldsLimit', () => fail(limitError()))\n  busboy.on('partsLimit', () => fail(limitError()))\n  busboy.on('error', fail)\n  busboy.on('field', (field, value, info) => {\n    if (info.valueTruncated || info.nameTruncated) {\n      fail(limitError())\n    } else if (!failure) {\n      result.fields = buildFields(result.fields, field, value)\n    }\n  })\n\n  busboy.on('file', (field, file, info) => {\n    if (failure) {\n      file.resume()\n      return\n    }\n    const { encoding, filename: name, mimeType: mime } = info\n    const filename = parseFileName(options, name)\n    const mimetype =\n      (filename.endsWith('.glb') && 'model/gltf-binary') ||\n      (filename.endsWith('.gltf') && 'model/gltf+json') ||\n      mime\n    const handler = options.useTempFiles\n      ? tempFileHandler(options, field, filename)\n      : memHandler(options, field, filename)\n    const timer = createUploadTimer(options.uploadTimeout, () => {\n      fail(new APIError(`Upload timeout for ${field}->${filename}, bytes:${handler.getFileSize()}`))\n    })\n    uploads.push({ cleanup: handler.cleanup, clear: timer.clear, file })\n    // Observe write failures immediately, including failures before file end.\n    const write = handler.getWritePromise()\n    void write.catch(fail)\n    writes.push(write)\n\n    file.on('limit', () => {\n      timer.clear()\n      try {\n        if (isFunc(options.limitHandler)) {\n          options.limitHandler({ request, size: handler.getFileSize() })\n        }\n        if (options.abortOnLimit) {\n          fail(\n            new APIError(options.responseOnLimit!, httpStatus.REQUEST_ENTITY_TOO_LARGE, {\n              size: handler.getFileSize(),\n            }),\n          )\n        }\n      } catch (err) {\n        fail(err as Error)\n      }\n    })\n    file.on('data', (data: Buffer) => {\n      if (failure) {\n        return\n      }\n      timer.set()\n      const pending = handler.dataHandler(data)\n      if (pending) {\n        file.pause()\n        void pending.then(() => {\n          if (!failure) {\n            file.resume()\n          }\n        }, fail)\n      }\n    })\n    file.on('error', fail)\n    file.on('end', () => {\n      timer.clear()\n      if (failure) {\n        return\n      }\n      const size = handler.getFileSize()\n      const buffer = handler.complete()\n      if (!name && size === 0) {\n        const cleanup = Promise.resolve(handler.cleanup()).then(() => true)\n        void cleanup.catch(fail)\n        writes.push(cleanup)\n        return\n      }\n      result.files = buildFields(\n        result.files,\n        field,\n        fileFactory(\n          {\n            name: filename,\n            buffer,\n            encoding,\n            hash: handler.getHash(),\n            mimetype,\n            size,\n            tempFilePath: handler.getFilePath(),\n            truncated: Boolean(file.truncated),\n          },\n          options,\n        ),\n      )\n    })\n    timer.set()\n  })\n  busboy.on('finish', () => {\n    void Promise.all(writes).then(() => resolveFinished(), fail)\n  })\n\n  // Waiting for each write callback bounds the parser queue and respects its backpressure.\n  const pump = async () => {\n    try {\n      while (!failure) {\n        const { done, value } = await reader.read()\n        if (failure) {\n          break\n        }\n        if (done) {\n          busboy.end()\n          break\n        }\n        requestSize += value.byteLength\n        if (requestSize > requestSizeLimit) {\n          const err = requestSizeLimitError()\n          fail(err)\n          await reader.cancel(err).catch(() => {})\n          break\n        }\n        await new Promise<void>((resolve, reject) => {\n          busboy.write(value, (err?: Error | null) => (err ? reject(err) : resolve()))\n        })\n      }\n    } finally {\n      reader.releaseLock()\n    }\n  }\n  void pump().catch(fail)\n\n  try {\n    await finished\n    if (options.parseNested) {\n      result.fields = processNested(result.fields)\n      result.files = processNested(result.files)\n    }\n    return result\n  } catch (err) {\n    for (const upload of uploads) {\n      upload.clear()\n    }\n    await Promise.all(uploads.map(async ({ cleanup }) => cleanup()))\n    throw err\n  }\n}\n"],"names":["Busboy","status","httpStatus","APIError","fileFactory","memHandler","tempFileHandler","processNested","createUploadTimer","buildFields","isFunc","parseFileName","processMultipart","options","request","requestSizeLimit","Infinity","busboyOptions","result","fields","undefined","files","headers","forEach","value","name","busboy","reader","body","getReader","uploads","writes","failure","requestSize","rejectFinished","resolveFinished","finished","Promise","resolve","reject","fail","err","queueMicrotask","upload","clear","file","destroy","cancel","catch","limitError","REQUEST_ENTITY_TOO_LARGE","requestSizeLimitError","on","field","info","valueTruncated","nameTruncated","resume","encoding","filename","mimeType","mime","mimetype","endsWith","handler","useTempFiles","timer","uploadTimeout","getFileSize","push","cleanup","write","getWritePromise","limitHandler","size","abortOnLimit","responseOnLimit","data","set","pending","dataHandler","pause","then","buffer","complete","hash","getHash","tempFilePath","getFilePath","truncated","Boolean","all","pump","done","read","end","byteLength","releaseLock","parseNested","map"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAKlD,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,WAAW,QAAQ,mBAAkB;AAC9C,SAASC,UAAU,EAAEC,eAAe,QAAQ,gBAAe;AAC3D,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,iBAAiB,QAAQ,mBAAkB;AACpD,SAASC,WAAW,EAAEC,MAAM,EAAEC,aAAa,QAAQ,iBAAgB;AAOnE,OAAO,MAAMC,mBAAqC,OAAO,EAAEC,OAAO,EAAEC,OAAO,EAAE;IAC3E,MAAM,EAAEC,mBAAmBC,QAAQ,EAAE,GAAGC,eAAe,GAAGJ;IAC1D,MAAMK,SAAqC;QAAEC,QAAQC;QAAYC,OAAOD;IAAW;IACnF,MAAME,UAAkC,CAAC;IACzCR,QAAQQ,OAAO,CAACC,OAAO,CAAC,CAACC,OAAOC;QAC9BH,OAAO,CAACG,KAAK,GAAGD;IAClB;IACA,MAAME,SAAS1B,OAAO;QAAE,GAAGiB,aAAa;QAAEK;IAAQ;IAClD,MAAMK,SAASb,QAAQc,IAAI,CAAEC,SAAS;IACtC,MAAMC,UAAwF,EAAE;IAChG,MAAMC,SAA6B,EAAE;IACrC,IAAIC;IACJ,IAAIC,cAAc;IAClB,IAAIC;IACJ,IAAIC;IACJ,MAAMC,WAAW,IAAIC,QAAc,CAACC,SAASC;QAC3CJ,kBAAkBG;QAClBJ,iBAAiBK;IACnB;IAEA,MAAMC,OAAO,CAACC;QACZ,IAAIT,SAAS;YACX;QACF;QACAA,UAAUS;QACVP,eAAeO;QACf,8EAA8E;QAC9EC,eAAe;YACb,KAAK,MAAMC,UAAUb,QAAS;gBAC5Ba,OAAOC,KAAK;gBACZD,OAAOE,IAAI,CAACC,OAAO;YACrB;YACApB,OAAOoB,OAAO;YACd,KAAKnB,OAAOoB,MAAM,CAACN,KAAKO,KAAK,CAAC,KAAO;QACvC;IACF;IACA,MAAMC,aAAa,IACjB,IAAI9C,SAAS,oCAAoCD,WAAWgD,wBAAwB;IACtF,MAAMC,wBAAwB,IAC5B,IAAIhD,SACF,iDACAD,WAAWgD,wBAAwB;IAGvCxB,OAAO0B,EAAE,CAAC,cAAc,IAAMZ,KAAKS;IACnCvB,OAAO0B,EAAE,CAAC,eAAe,IAAMZ,KAAKS;IACpCvB,OAAO0B,EAAE,CAAC,cAAc,IAAMZ,KAAKS;IACnCvB,OAAO0B,EAAE,CAAC,SAASZ;IACnBd,OAAO0B,EAAE,CAAC,SAAS,CAACC,OAAO7B,OAAO8B;QAChC,IAAIA,KAAKC,cAAc,IAAID,KAAKE,aAAa,EAAE;YAC7ChB,KAAKS;QACP,OAAO,IAAI,CAACjB,SAAS;YACnBd,OAAOC,MAAM,GAAGV,YAAYS,OAAOC,MAAM,EAAEkC,OAAO7B;QACpD;IACF;IAEAE,OAAO0B,EAAE,CAAC,QAAQ,CAACC,OAAOR,MAAMS;QAC9B,IAAItB,SAAS;YACXa,KAAKY,MAAM;YACX;QACF;QACA,MAAM,EAAEC,QAAQ,EAAEC,UAAUlC,IAAI,EAAEmC,UAAUC,IAAI,EAAE,GAAGP;QACrD,MAAMK,WAAWhD,cAAcE,SAASY;QACxC,MAAMqC,WACJ,AAACH,SAASI,QAAQ,CAAC,WAAW,uBAC7BJ,SAASI,QAAQ,CAAC,YAAY,qBAC/BF;QACF,MAAMG,UAAUnD,QAAQoD,YAAY,GAChC3D,gBAAgBO,SAASwC,OAAOM,YAChCtD,WAAWQ,SAASwC,OAAOM;QAC/B,MAAMO,QAAQ1D,kBAAkBK,QAAQsD,aAAa,EAAE;YACrD3B,KAAK,IAAIrC,SAAS,CAAC,mBAAmB,EAAEkD,MAAM,EAAE,EAAEM,SAAS,QAAQ,EAAEK,QAAQI,WAAW,IAAI;QAC9F;QACAtC,QAAQuC,IAAI,CAAC;YAAEC,SAASN,QAAQM,OAAO;YAAE1B,OAAOsB,MAAMtB,KAAK;YAAEC;QAAK;QAClE,0EAA0E;QAC1E,MAAM0B,QAAQP,QAAQQ,eAAe;QACrC,KAAKD,MAAMvB,KAAK,CAACR;QACjBT,OAAOsC,IAAI,CAACE;QAEZ1B,KAAKO,EAAE,CAAC,SAAS;YACfc,MAAMtB,KAAK;YACX,IAAI;gBACF,IAAIlC,OAAOG,QAAQ4D,YAAY,GAAG;oBAChC5D,QAAQ4D,YAAY,CAAC;wBAAE3D;wBAAS4D,MAAMV,QAAQI,WAAW;oBAAG;gBAC9D;gBACA,IAAIvD,QAAQ8D,YAAY,EAAE;oBACxBnC,KACE,IAAIrC,SAASU,QAAQ+D,eAAe,EAAG1E,WAAWgD,wBAAwB,EAAE;wBAC1EwB,MAAMV,QAAQI,WAAW;oBAC3B;gBAEJ;YACF,EAAE,OAAO3B,KAAK;gBACZD,KAAKC;YACP;QACF;QACAI,KAAKO,EAAE,CAAC,QAAQ,CAACyB;YACf,IAAI7C,SAAS;gBACX;YACF;YACAkC,MAAMY,GAAG;YACT,MAAMC,UAAUf,QAAQgB,WAAW,CAACH;YACpC,IAAIE,SAAS;gBACXlC,KAAKoC,KAAK;gBACV,KAAKF,QAAQG,IAAI,CAAC;oBAChB,IAAI,CAAClD,SAAS;wBACZa,KAAKY,MAAM;oBACb;gBACF,GAAGjB;YACL;QACF;QACAK,KAAKO,EAAE,CAAC,SAASZ;QACjBK,KAAKO,EAAE,CAAC,OAAO;YACbc,MAAMtB,KAAK;YACX,IAAIZ,SAAS;gBACX;YACF;YACA,MAAM0C,OAAOV,QAAQI,WAAW;YAChC,MAAMe,SAASnB,QAAQoB,QAAQ;YAC/B,IAAI,CAAC3D,QAAQiD,SAAS,GAAG;gBACvB,MAAMJ,UAAUjC,QAAQC,OAAO,CAAC0B,QAAQM,OAAO,IAAIY,IAAI,CAAC,IAAM;gBAC9D,KAAKZ,QAAQtB,KAAK,CAACR;gBACnBT,OAAOsC,IAAI,CAACC;gBACZ;YACF;YACApD,OAAOG,KAAK,GAAGZ,YACbS,OAAOG,KAAK,EACZgC,OACAjD,YACE;gBACEqB,MAAMkC;gBACNwB;gBACAzB;gBACA2B,MAAMrB,QAAQsB,OAAO;gBACrBxB;gBACAY;gBACAa,cAAcvB,QAAQwB,WAAW;gBACjCC,WAAWC,QAAQ7C,KAAK4C,SAAS;YACnC,GACA5E;QAGN;QACAqD,MAAMY,GAAG;IACX;IACApD,OAAO0B,EAAE,CAAC,UAAU;QAClB,KAAKf,QAAQsD,GAAG,CAAC5D,QAAQmD,IAAI,CAAC,IAAM/C,mBAAmBK;IACzD;IAEA,yFAAyF;IACzF,MAAMoD,OAAO;QACX,IAAI;YACF,MAAO,CAAC5D,QAAS;gBACf,MAAM,EAAE6D,IAAI,EAAErE,KAAK,EAAE,GAAG,MAAMG,OAAOmE,IAAI;gBACzC,IAAI9D,SAAS;oBACX;gBACF;gBACA,IAAI6D,MAAM;oBACRnE,OAAOqE,GAAG;oBACV;gBACF;gBACA9D,eAAeT,MAAMwE,UAAU;gBAC/B,IAAI/D,cAAclB,kBAAkB;oBAClC,MAAM0B,MAAMU;oBACZX,KAAKC;oBACL,MAAMd,OAAOoB,MAAM,CAACN,KAAKO,KAAK,CAAC,KAAO;oBACtC;gBACF;gBACA,MAAM,IAAIX,QAAc,CAACC,SAASC;oBAChCb,OAAO6C,KAAK,CAAC/C,OAAO,CAACiB,MAAwBA,MAAMF,OAAOE,OAAOH;gBACnE;YACF;QACF,SAAU;YACRX,OAAOsE,WAAW;QACpB;IACF;IACA,KAAKL,OAAO5C,KAAK,CAACR;IAElB,IAAI;QACF,MAAMJ;QACN,IAAIvB,QAAQqF,WAAW,EAAE;YACvBhF,OAAOC,MAAM,GAAGZ,cAAcW,OAAOC,MAAM;YAC3CD,OAAOG,KAAK,GAAGd,cAAcW,OAAOG,KAAK;QAC3C;QACA,OAAOH;IACT,EAAE,OAAOuB,KAAK;QACZ,KAAK,MAAME,UAAUb,QAAS;YAC5Ba,OAAOC,KAAK;QACd;QACA,MAAMP,QAAQsD,GAAG,CAAC7D,QAAQqE,GAAG,CAAC,OAAO,EAAE7B,OAAO,EAAE,GAAKA;QACrD,MAAM7B;IACR;AACF,EAAC"}

package/dist/uploads/fetchAPI-multipart/processNested.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processNested.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/processNested.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,GAAa,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAiC/D,CAAA"}
+{"version":3,"file":"processNested.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/processNested.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,SAAmB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAiC/D,CAAA"}

package/dist/uploads/fetchAPI-multipart/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/utilities.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAWtE;;GAEG;AACH,eAAO,MAAM,QAAQ,GAAI,SAAS,yBAAyB,EAAE,KAAK,MAAM,YAOvE,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,GAAI,SAAQ,MAAoB,WAG3D,CAAA;AAED,KAAK,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AACvC,eAAO,MAAM,MAAM,GAAI,OAAO,GAAG,KAAG,KAAK,IAAI,QAE5C,CAAA;AAQD;;;GAGG;AACH,KAAK,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAA;AAClG,eAAO,MAAM,eAAe,EAAE,eAU7B,CAAA;AAOD;;GAEG;AACH,KAAK,mBAAmB,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;AAC9D,eAAO,MAAM,mBAAmB,EAAE,mBAQjC,CAAA;AAED;;GAEG;AACH,KAAK,WAAW,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAA;AACpE,eAAO,MAAM,WAAW,EAAE,WAsBzB,CAAA;AAED;;;GAGG;AACH,KAAK,eAAe,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;AAClG,eAAO,MAAM,eAAe,EAAE,eAY7B,CAAA;AAED;;GAEG;AACH,KAAK,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,CAAA;AAC3E,eAAO,MAAM,UAAU,EAAE,UAAkE,CAAA;AA8B3F;;;GAGG;AACH,KAAK,QAAQ,GAAG,CACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,KAC9C,IAAI,CAAA;AACT,eAAO,MAAM,QAAQ,EAAE,QASnB,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,UAAU,MAAM,EAChB,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,SAyBhC,CAAA;AA+BD;;GAEG;AACH,KAAK,sBAAsB,GAAG,CAC5B,iBAAiB,EAAE,OAAO,GAAG,MAAM,EACnC,QAAQ,EAAE,MAAM,KACb;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AACD,eAAO,MAAM,sBAAsB,EAAE,sBA4BpC,CAAA;AAED;;GAEG;AACH,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;AAClF,eAAO,MAAM,aAAa,EAAE,aAyB3B,CAAA"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/utilities.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAWtE;;GAEG;AACH,eAAO,MAAM,QAAQ,YAAa,yBAAyB,OAAO,MAAM,YAOvE,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,YAAY,MAAM,WAG7C,CAAA;AAED,KAAK,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AACvC,eAAO,MAAM,MAAM,UAAW,GAAG,KAAG,KAAK,IAAI,QAE5C,CAAA;AAQD;;;GAGG;AACH,KAAK,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAA;AAClG,eAAO,MAAM,eAAe,EAAE,eAU7B,CAAA;AAOD;;GAEG;AACH,KAAK,mBAAmB,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;AAC9D,eAAO,MAAM,mBAAmB,EAAE,mBAQjC,CAAA;AAED;;GAEG;AACH,KAAK,WAAW,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAA;AACpE,eAAO,MAAM,WAAW,EAAE,WAsBzB,CAAA;AAED;;;GAGG;AACH,KAAK,eAAe,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;AAClG,eAAO,MAAM,eAAe,EAAE,eAY7B,CAAA;AAED;;GAEG;AACH,KAAK,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,CAAA;AAC3E,eAAO,MAAM,UAAU,EAAE,UAAkE,CAAA;AA8B3F;;;GAGG;AACH,KAAK,QAAQ,GAAG,CACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,KAC9C,IAAI,CAAA;AACT,eAAO,MAAM,QAAQ,EAAE,QASnB,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,WACnB,MAAM,YACJ,MAAM,YACN,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,SAyBhC,CAAA;AA+BD;;GAEG;AACH,KAAK,sBAAsB,GAAG,CAC5B,iBAAiB,EAAE,OAAO,GAAG,MAAM,EACnC,QAAQ,EAAE,MAAM,KACb;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AACD,eAAO,MAAM,sBAAsB,EAAE,sBA4BpC,CAAA;AAED;;GAEG;AACH,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;AAClF,eAAO,MAAM,aAAa,EAAE,aAyB3B,CAAA"}

package/dist/uploads/fetchWithRedirects.d.ts

@@ -0,0 +1,19 @@
+import type { AllowList, UploadConfig } from './types.js';
+export declare const parseFileURL: (url: string, base?: URL) => URL;
+/**
+ * Fetches a file, checking each redirect against the allow list and SSRF restrictions.
+ * Returns the unread response so callers can either stream it or buffer it into a Payload File.
+ * Callers enforce any initial URL restrictions; existing uploads may also use same-origin URLs.
+ */
+export declare const fetchWithRedirects: ({ allowList, getHeaders, headers, skipSafeFetch, timeout, url, }: {
+    allowList?: AllowList;
+    getHeaders?: (url: string) => Record<string, string>;
+    headers?: Record<string, string>;
+    skipSafeFetch?: UploadConfig['skipSafeFetch'];
+    timeout?: number;
+    url: string;
+}) => Promise<{
+    response: Response;
+    url: string;
+}>;
+//# sourceMappingURL=fetchWithRedirects.d.ts.map

package/dist/uploads/fetchWithRedirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchWithRedirects.d.ts","sourceRoot":"","sources":["../../src/uploads/fetchWithRedirects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAMzD,eAAO,MAAM,YAAY,QAAS,MAAM,SAAS,GAAG,KAAG,GAgBtD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,qEAO5B;IACD,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAA;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;CACZ,KAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAqC9C,CAAA"}

package/dist/uploads/fetchWithRedirects.js

@@ -0,0 +1,53 @@
+import { APIError } from '../errors/APIError.js';
+import { isURLAllowed } from '../utilities/isURLAllowed.js';
+import { safeFetch } from './safeFetch.js';
+export const parseFileURL = (url, base)=>{
+    try {
+        const parsedURL = new URL(url, base);
+        if (parsedURL.protocol !== 'http:' && parsedURL.protocol !== 'https:') {
+            throw new APIError('External file URLs must use HTTP or HTTPS.', 400);
+        }
+        return parsedURL;
+    } catch (error) {
+        if (error instanceof APIError) {
+            throw error;
+        }
+        throw new APIError('Invalid external file URL.', 400);
+    }
+};
+/**
+ * Fetches a file, checking each redirect against the allow list and SSRF restrictions.
+ * Returns the unread response so callers can either stream it or buffer it into a Payload File.
+ * Callers enforce any initial URL restrictions; existing uploads may also use same-origin URLs.
+ */ export const fetchWithRedirects = async ({ allowList, getHeaders, headers, skipSafeFetch, timeout, url })=>{
+    const maxRedirects = 3;
+    for(let redirectCount = 0;; redirectCount++){
+        // Explicitly allowed URLs may point to private hosts, such as an internal CDN.
+        const shouldSkipSafeFetch = skipSafeFetch === true || Array.isArray(skipSafeFetch) && isURLAllowed(url, skipSafeFetch) || allowList && isURLAllowed(url, allowList);
+        const response = await (shouldSkipSafeFetch ? fetch : safeFetch)(url, {
+            credentials: 'include',
+            headers: getHeaders ? getHeaders(url) : headers,
+            redirect: 'manual',
+            signal: timeout ? AbortSignal.timeout(timeout) : undefined
+        });
+        if (response.status >= 300 && response.status < 400) {
+            if (redirectCount >= maxRedirects) {
+                throw new APIError(`Too many redirects (max ${maxRedirects})`, 403);
+            }
+            const location = response.headers.get('location');
+            if (location) {
+                url = parseFileURL(location, parseFileURL(url)).href;
+                if (allowList && !isURLAllowed(url, allowList)) {
+                    throw new APIError('Redirect target is not allowed.', 400);
+                }
+                continue;
+            }
+        }
+        return {
+            response,
+            url
+        };
+    }
+};
+
+//# sourceMappingURL=fetchWithRedirects.js.map

package/dist/uploads/fetchWithRedirects.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/fetchWithRedirects.ts"],"sourcesContent":["import type { AllowList, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\nexport const parseFileURL = (url: string, base?: URL): URL => {\n  try {\n    const parsedURL = new URL(url, base)\n\n    if (parsedURL.protocol !== 'http:' && parsedURL.protocol !== 'https:') {\n      throw new APIError('External file URLs must use HTTP or HTTPS.', 400)\n    }\n\n    return parsedURL\n  } catch (error) {\n    if (error instanceof APIError) {\n      throw error\n    }\n\n    throw new APIError('Invalid external file URL.', 400)\n  }\n}\n\n/**\n * Fetches a file, checking each redirect against the allow list and SSRF restrictions.\n * Returns the unread response so callers can either stream it or buffer it into a Payload File.\n * Callers enforce any initial URL restrictions; existing uploads may also use same-origin URLs.\n */\nexport const fetchWithRedirects = async ({\n  allowList,\n  getHeaders,\n  headers,\n  skipSafeFetch,\n  timeout,\n  url,\n}: {\n  allowList?: AllowList\n  getHeaders?: (url: string) => Record<string, string>\n  headers?: Record<string, string>\n  skipSafeFetch?: UploadConfig['skipSafeFetch']\n  timeout?: number\n  url: string\n}): Promise<{ response: Response; url: string }> => {\n  const maxRedirects = 3\n\n  for (let redirectCount = 0; ; redirectCount++) {\n    // Explicitly allowed URLs may point to private hosts, such as an internal CDN.\n    const shouldSkipSafeFetch =\n      skipSafeFetch === true ||\n      (Array.isArray(skipSafeFetch) && isURLAllowed(url, skipSafeFetch)) ||\n      (allowList && isURLAllowed(url, allowList))\n\n    const response = await (shouldSkipSafeFetch ? fetch : safeFetch)(url, {\n      credentials: 'include',\n      headers: getHeaders ? getHeaders(url) : headers,\n      redirect: 'manual',\n      signal: timeout ? AbortSignal.timeout(timeout) : undefined,\n    })\n\n    if (response.status >= 300 && response.status < 400) {\n      if (redirectCount >= maxRedirects) {\n        throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n      }\n\n      const location = response.headers.get('location')\n\n      if (location) {\n        url = parseFileURL(location, parseFileURL(url)).href\n\n        if (allowList && !isURLAllowed(url, allowList)) {\n          throw new APIError('Redirect target is not allowed.', 400)\n        }\n\n        continue\n      }\n    }\n\n    return { response, url }\n  }\n}\n"],"names":["APIError","isURLAllowed","safeFetch","parseFileURL","url","base","parsedURL","URL","protocol","error","fetchWithRedirects","allowList","getHeaders","headers","skipSafeFetch","timeout","maxRedirects","redirectCount","shouldSkipSafeFetch","Array","isArray","response","fetch","credentials","redirect","signal","AbortSignal","undefined","status","location","get","href"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAE1C,OAAO,MAAMC,eAAe,CAACC,KAAaC;IACxC,IAAI;QACF,MAAMC,YAAY,IAAIC,IAAIH,KAAKC;QAE/B,IAAIC,UAAUE,QAAQ,KAAK,WAAWF,UAAUE,QAAQ,KAAK,UAAU;YACrE,MAAM,IAAIR,SAAS,8CAA8C;QACnE;QAEA,OAAOM;IACT,EAAE,OAAOG,OAAO;QACd,IAAIA,iBAAiBT,UAAU;YAC7B,MAAMS;QACR;QAEA,MAAM,IAAIT,SAAS,8BAA8B;IACnD;AACF,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMU,qBAAqB,OAAO,EACvCC,SAAS,EACTC,UAAU,EACVC,OAAO,EACPC,aAAa,EACbC,OAAO,EACPX,GAAG,EAQJ;IACC,MAAMY,eAAe;IAErB,IAAK,IAAIC,gBAAgB,IAAKA,gBAAiB;QAC7C,+EAA+E;QAC/E,MAAMC,sBACJJ,kBAAkB,QACjBK,MAAMC,OAAO,CAACN,kBAAkBb,aAAaG,KAAKU,kBAClDH,aAAaV,aAAaG,KAAKO;QAElC,MAAMU,WAAW,MAAM,AAACH,CAAAA,sBAAsBI,QAAQpB,SAAQ,EAAGE,KAAK;YACpEmB,aAAa;YACbV,SAASD,aAAaA,WAAWR,OAAOS;YACxCW,UAAU;YACVC,QAAQV,UAAUW,YAAYX,OAAO,CAACA,WAAWY;QACnD;QAEA,IAAIN,SAASO,MAAM,IAAI,OAAOP,SAASO,MAAM,GAAG,KAAK;YACnD,IAAIX,iBAAiBD,cAAc;gBACjC,MAAM,IAAIhB,SAAS,CAAC,wBAAwB,EAAEgB,aAAa,CAAC,CAAC,EAAE;YACjE;YAEA,MAAMa,WAAWR,SAASR,OAAO,CAACiB,GAAG,CAAC;YAEtC,IAAID,UAAU;gBACZzB,MAAMD,aAAa0B,UAAU1B,aAAaC,MAAM2B,IAAI;gBAEpD,IAAIpB,aAAa,CAACV,aAAaG,KAAKO,YAAY;oBAC9C,MAAM,IAAIX,SAAS,mCAAmC;gBACxD;gBAEA;YACF;QACF;QAEA,OAAO;YAAEqB;YAAUjB;QAAI;IACzB;AACF,EAAC"}

package/dist/uploads/fileExists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileExists.d.ts","sourceRoot":"","sources":["../../src/uploads/fileExists.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAQlE,CAAA"}
+{"version":3,"file":"fileExists.d.ts","sourceRoot":"","sources":["../../src/uploads/fileExists.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,aAAoB,MAAM,KAAG,OAAO,CAAC,OAAO,CAQlE,CAAA"}

package/dist/uploads/generateFileData.d.ts

@@ -1,12 +1,14 @@
 import type { Collection } from '../collections/config/types.js';
 import type { SanitizedConfig } from '../config/types.js';
 import type { PayloadRequest } from '../types/index.js';
+import type { ExternalUploadSource } from './sanitizeUploadData.js';
 import type { FileToSave } from './types.js';
 type Args<T> = {
     collection: Collection;
     config: SanitizedConfig;
     data: T;
     draft?: boolean;
+    externalUploadSource?: ExternalUploadSource;
     isDuplicating?: boolean;
     operation: 'create' | 'update';
     originalDoc?: T;
@@ -18,6 +20,34 @@ type Result<T> = Promise<{
     data: T;
     files: FileToSave[];
 }>;
-export declare const generateFileData: <T>({ collection: { config: collectionConfig }, data, draft, isDuplicating, operation, originalDoc, overwriteExistingFiles, req, throwOnMissingFile, }: Args<T>) => Result<T>;
+export type TempFileHandling = {
+    sourcePath: string;
+    type: 'copyFromTempFile';
+} | {
+    type: 'skip';
+} | {
+    type: 'useBuffer';
+};
+/**
+ * Decides how to get a file's bytes onto disk when sharp did not need to process it (a processed
+ * file is already an in-memory buffer, so it always takes the `useBuffer` path). Copies straight
+ * from the temp file when possible, rather than reading a potentially large temp file into memory
+ * just to write it back out - see the `generateFileData` function doc for why.
+ */
+export declare const resolveTempFileHandling: ({ disableLocalStorage, hasProcessedBuffer, tempFilePath, }: {
+    disableLocalStorage: boolean;
+    hasProcessedBuffer: boolean;
+    tempFilePath: string | undefined;
+}) => TempFileHandling;
+/**
+ * Builds the document's file metadata and the list of files to write to disk.
+ *
+ * A large client upload may arrive as a temp file instead of an in-memory buffer (see
+ * getFileFromUploadInstructions.ts), and `file.data` can hold only a partial probe rather than
+ * the full file. To avoid loading such files into memory unnecessarily, this skips reading a
+ * temp file entirely when local storage is disabled, and copies it straight to its destination
+ * when local storage is enabled.
+ */
+export declare const generateFileData: <T>({ collection: { config: collectionConfig }, data, draft, externalUploadSource, isDuplicating, operation, originalDoc, overwriteExistingFiles, req, throwOnMissingFile, }: Args<T>) => Result<T>;
 export {};
 //# sourceMappingURL=generateFileData.d.ts.map

package/dist/uploads/generateFileData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateFileData.d.ts","sourceRoot":"","sources":["../../src/uploads/generateFileData.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,KAAK,EAAY,UAAU,EAAgC,MAAM,YAAY,CAAA;AAcpF,KAAK,IAAI,CAAC,CAAC,IAAI;IACb,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,IAAI,EAAE,CAAC,CAAA;IACP,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,WAAW,CAAC,EAAE,CAAC,CAAA;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,GAAG,EAAE,cAAc,CAAA;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC;IACvB,IAAI,EAAE,CAAC,CAAA;IACP,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB,CAAC,CAAA;AA6BF,eAAO,MAAM,gBAAgB,GAAU,CAAC,EAAE,oJAUvC,IAAI,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,CAAC,CAmWpB,CAAA"}
+{"version":3,"file":"generateFileData.d.ts","sourceRoot":"","sources":["../../src/uploads/generateFileData.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,KAAK,EAAY,UAAU,EAAgC,MAAM,YAAY,CAAA;AAmBpF,KAAK,IAAI,CAAC,CAAC,IAAI;IACb,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,IAAI,EAAE,CAAC,CAAA;IACP,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,WAAW,CAAC,EAAE,CAAC,CAAA;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,GAAG,EAAE,cAAc,CAAA;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC;IACvB,IAAI,EAAE,CAAC,CAAA;IACP,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB,CAAC,CAAA;AA6BF,MAAM,MAAM,gBAAgB,GACxB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAA;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,+DAIjC;IACD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,OAAO,CAAA;IAC3B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC,KAAG,gBAQH,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAU,CAAC,4KAWrC,IAAI,CAAC,CAAC,CAAC,KAAG,MAAM,CAAC,CAAC,CAwYpB,CAAA"}

package/dist/uploads/generateFileData.js

@@ -1,23 +1,27 @@
 import { fileTypeFromBuffer } from 'file-type';
 import fs from 'fs/promises';
-import sanitize from 'sanitize-filename';
 import { FileRetrievalError, FileUploadError, Forbidden, MissingFile } from '../errors/index.js';
 import { isNumber } from '../utilities/isNumber.js';
 import { canResizeImage } from './canResizeImage.js';
 import { checkFileRestrictions } from './checkFileRestrictions.js';
 import { cropImage } from './cropImage.js';
-import { getExternalFile } from './getExternalFile.js';
+import { downloadFileToBuffer } from './downloadFileToBuffer.js';
 import { getFileByPath } from './getFileByPath.js';
+import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js';
 import { getImageSize } from './getImageSize.js';
 import { getSafeFileName } from './getSafeFilename.js';
+import { hasCropOrResizeEdit } from './hasCropOrResizeEdit.js';
+import { hasFullFileContents } from './hasFullFileContents.js';
 import { createImageSizes } from './image-resizing/createImageSizes.js';
+import { isAnimatedImage } from './isAnimatedImage.js';
 import { isImage } from './isImage.js';
+import { isProcessableImage } from './isProcessableImage.js';
 import { optionallyAppendMetadata } from './optionallyAppendMetadata.js';
 const shouldReupload = (uploadEdits, fileData)=>{
-    if (!fileData) {
+    if (!fileData || !uploadEdits) {
         return false;
     }
-    if (uploadEdits.crop || uploadEdits.heightInPixels || uploadEdits.widthInPixels) {
+    if (hasCropOrResizeEdit(uploadEdits)) {
         return true;
     }
     // Since uploadEdits always has focalPoint, compare to the value in the data if it was changed
@@ -31,7 +35,33 @@ const shouldReupload = (uploadEdits, fileData)=>{
     }
     return false;
 };
-export const generateFileData = async ({ collection: { config: collectionConfig }, data, draft, isDuplicating, operation, originalDoc, overwriteExistingFiles, req, throwOnMissingFile })=>{
+/**
+ * Decides how to get a file's bytes onto disk when sharp did not need to process it (a processed
+ * file is already an in-memory buffer, so it always takes the `useBuffer` path). Copies straight
+ * from the temp file when possible, rather than reading a potentially large temp file into memory
+ * just to write it back out - see the `generateFileData` function doc for why.
+ */ export const resolveTempFileHandling = ({ disableLocalStorage, hasProcessedBuffer, tempFilePath })=>{
+    if (hasProcessedBuffer || !tempFilePath) {
+        return {
+            type: 'useBuffer'
+        };
+    }
+    return disableLocalStorage ? {
+        type: 'skip'
+    } : {
+        type: 'copyFromTempFile',
+        sourcePath: tempFilePath
+    };
+};
+/**
+ * Builds the document's file metadata and the list of files to write to disk.
+ *
+ * A large client upload may arrive as a temp file instead of an in-memory buffer (see
+ * getFileFromUploadInstructions.ts), and `file.data` can hold only a partial probe rather than
+ * the full file. To avoid loading such files into memory unnecessarily, this skips reading a
+ * temp file entirely when local storage is disabled, and copies it straight to its destination
+ * when local storage is enabled.
+ */ export const generateFileData = async ({ collection: { config: collectionConfig }, data, draft, externalUploadSource, isDuplicating, operation, originalDoc, overwriteExistingFiles, req, throwOnMissingFile })=>{
     if (!collectionConfig.upload) {
         return {
             data,
@@ -44,15 +74,19 @@ export const generateFileData = async ({ collection: { config: collectionConfig
         data,
         isDuplicating,
         operation,
-        originalDoc,
+        // Only a duplication source informs edit parsing. Updates now also pass `originalDoc` so the
+        // stored file can be reprocessed, and that must not change which edits are applied.
+        originalDoc: isDuplicating ? originalDoc : undefined,
         req
     });
     const { constructorOptions, disableLocalStorage, focalPoint: focalPointEnabled = true, formatOptions, imageSizes, resizeOptions, staticDir, trimOptions, withMetadata } = collectionConfig.upload;
     const staticPath = staticDir;
     const incomingFileData = isDuplicating ? originalDoc : data;
+    const fileDataToReupload = operation === 'update' ? originalDoc : incomingFileData;
+    const fileSourceData = externalUploadSource ?? fileDataToReupload;
     let isLocalFile = false;
-    if (!file && (isDuplicating || shouldReupload(uploadEdits, incomingFileData))) {
-        const { filename, url } = incomingFileData;
+    if (!file && fileSourceData && (externalUploadSource || isDuplicating || shouldReupload(uploadEdits, incomingFileData))) {
+        const { filename, url } = fileSourceData;
         if (filename && (filename.includes('../') || filename.includes('..\\'))) {
             throw new Forbidden(req.t);
         }
@@ -60,20 +94,18 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             isLocalFile = true;
         }
         try {
-            if (!disableLocalStorage && isLocalFile) {
-                // File is stored locally
+            if (!externalUploadSource && !disableLocalStorage && isLocalFile) {
                 const filePath = `${staticPath}/${filename}`;
                 const response = await getFileByPath(filePath);
                 file = response;
                 overwriteExistingFiles = true;
             } else if (filename && url) {
-                // File is remote
-                file = await getExternalFile({
-                    data: incomingFileData,
+                file = await downloadFileToBuffer({
+                    data: fileSourceData,
                     req,
                     uploadConfig: collectionConfig.upload
                 });
-                overwriteExistingFiles = true;
+                overwriteExistingFiles = !externalUploadSource;
             }
         } catch (err) {
             throw new FileRetrievalError(req.t, err instanceof Error ? err.message : undefined);
@@ -91,11 +123,18 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             files: []
         };
     }
-    await checkFileRestrictions({
+    const detectedFileType = await checkFileRestrictions({
         collection: collectionConfig,
         file,
         req
     });
+    const shouldUseDetectedFileType = detectedFileType && (isProcessableImage(file.mimetype) || isProcessableImage(detectedFileType.mime));
+    if (shouldUseDetectedFileType && detectedFileType.mime !== file.mimetype) {
+        file = {
+            ...file,
+            mimetype: detectedFileType.mime
+        };
+    }
     if (!disableLocalStorage) {
         await fs.mkdir(staticPath, {
             recursive: true
@@ -104,33 +143,29 @@ export const generateFileData = async ({ collection: { config: collectionConfig
     let newData = incomingFileData;
     const filesToSave = [];
     const fileData = {};
-    const fileIsAnimatedType = [
-        'image/avif',
-        'image/gif',
-        'image/webp'
-    ].includes(file.mimetype);
+    const fileIsAnimatedType = isAnimatedImage(file.mimetype);
     const cropData = typeof uploadEdits === 'object' && 'crop' in uploadEdits ? uploadEdits.crop : undefined;
     try {
         const fileSupportsResize = canResizeImage(file.mimetype);
+        const fileHasCompleteContents = hasFullFileContents(file);
         let fsSafeName;
         let sharpFile;
         let dimensions;
         let fileBuffer;
         let ext;
         let mime;
-        const fileHasAdjustments = fileSupportsResize && Boolean(resizeOptions || formatOptions || trimOptions || constructorOptions || file.tempFilePath);
+        // Depends only on configured resize/format/trim options, not on whether the bytes are on
+        // disk or in memory.
+        const fileHasAdjustments = fileSupportsResize && Boolean(resizeOptions || formatOptions || trimOptions || constructorOptions);
         const sharpOptions = {
             ...constructorOptions
         };
         if (fileIsAnimatedType) {
             sharpOptions.animated = true;
         }
-        if (sharp && (fileIsAnimatedType || fileHasAdjustments)) {
-            if (file.tempFilePath) {
-                sharpFile = sharp(file.tempFilePath, sharpOptions).rotate(); // pass rotate() to auto-rotate based on EXIF data. https://github.com/payloadcms/payload/pull/3081
-            } else {
-                sharpFile = sharp(file.data, sharpOptions).rotate(); // pass rotate() to auto-rotate based on EXIF data. https://github.com/payloadcms/payload/pull/3081
-            }
+        if (sharp && fileHasCompleteContents && (fileIsAnimatedType || fileHasAdjustments)) {
+            // rotate() auto-rotates based on EXIF data - see #3081
+            sharpFile = file.tempFilePath ? sharp(file.tempFilePath, sharpOptions).rotate() : sharp(file.data, sharpOptions).rotate();
             if (fileHasAdjustments) {
                 if (resizeOptions) {
                     sharpFile = sharpFile.resize(resizeOptions);
@@ -144,7 +179,10 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             }
         }
         if (fileSupportsResize || isImage(file.mimetype)) {
-            dimensions = await getImageSize(file);
+            dimensions = await getImageSize({
+                file,
+                sharp: fileSupportsResize && fileHasCompleteContents ? sharp : undefined
+            });
             fileData.width = dimensions.width;
             fileData.height = dimensions.height;
         }
@@ -158,12 +196,12 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             fileBuffer = await sharpFile.toBuffer({
                 resolveWithObject: true
             });
-            ({ ext, mime } = await fileTypeFromBuffer(fileBuffer.data) // This is getting an incorrect gif height back.
-            );
+            delete file.uploadReference;
+            ({ ext, mime } = await fileTypeFromBuffer(fileBuffer.data));
             fileData.width = fileBuffer.info.width;
             fileData.height = fileBuffer.info.height;
             fileData.filesize = fileBuffer.info.size;
-            // Animated GIFs + WebP aggregate the height from every frame, so we need to use divide by number of pages
+            // Animated GIFs/WebP report height summed across all frames - divide by page count.
             if (metadata.pages) {
                 fileData.height = fileBuffer.info.height / metadata.pages;
                 fileData.filesize = fileBuffer.data.length;
@@ -172,7 +210,7 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             mime = file.mimetype;
             fileData.filesize = file.size;
             if (file.name.includes('.')) {
-                ext = file.name.split('.').pop()?.split('?')[0];
+                ext = getFileExtension(getSanitizedUploadFilename(file.name));
             } else {
                 ext = '';
             }
@@ -182,8 +220,7 @@ export const generateFileData = async ({ collection: { config: collectionConfig
             mime = 'image/svg+xml';
         }
         fileData.mimeType = mime;
-        const baseFilename = sanitize(file.name.substring(0, file.name.lastIndexOf('.')) || file.name);
-        fsSafeName = `${baseFilename}${ext ? `.${ext}` : ''}`;
+        fsSafeName = getSanitizedUploadFilename(file.name, ext);
         if (!overwriteExistingFiles) {
             // Extract prefix if present (added by plugin-cloud-storage)
             const prefix = data?.prefix;
@@ -197,7 +234,7 @@ export const generateFileData = async ({ collection: { config: collectionConfig
         }
         fileData.filename = fsSafeName;
         let fileForResize = file;
-        if (cropData && sharp) {
+        if (cropData && fileSupportsResize && sharp && fileHasCompleteContents) {
             const { data: croppedImage, info } = await cropImage({
                 cropData,
                 dimensions: dimensions,
@@ -235,7 +272,6 @@ export const generateFileData = async ({ collection: { config: collectionConfig
                 }
                 fileData.filesize = resizedAfterCrop.info.size;
             } else {
-                // If resizeOptions is not present, just save the cropped image
                 filesToSave.push({
                     buffer: croppedImage,
                     path: `${staticPath}/${fsSafeName}`
@@ -253,43 +289,60 @@ export const generateFileData = async ({ collection: { config: collectionConfig
                 }
                 fileData.filesize = info.size;
             }
+            delete file.uploadReference;
+            delete fileForResize.uploadReference;
             if (file.tempFilePath) {
-                await fs.writeFile(file.tempFilePath, croppedImage); // write fileBuffer to the temp path
+                await fs.writeFile(file.tempFilePath, croppedImage);
             } else {
                 req.file = fileForResize;
             }
         } else {
-            // For non-image files with useTempFiles, read the buffer from the temp file
-            // since file.data is empty when using temp files
-            let bufferToSave;
-            if (fileBuffer?.data) {
-                bufferToSave = fileBuffer.data;
-            } else if (file.tempFilePath) {
-                bufferToSave = await fs.readFile(file.tempFilePath);
-            } else {
-                bufferToSave = file.data;
-            }
-            filesToSave.push({
-                buffer: bufferToSave,
-                path: `${staticPath}/${fsSafeName}`
+            // file.data is empty when useTempFiles is on, so the real content lives at
+            // file.tempFilePath instead (see the function doc for why we avoid buffering it).
+            const tempFileHandling = resolveTempFileHandling({
+                disableLocalStorage: Boolean(disableLocalStorage),
+                hasProcessedBuffer: Boolean(fileBuffer?.data),
+                tempFilePath: file.tempFilePath
             });
-            // If using temp files and the image is being resized, write the file to the temp path
-            if (fileBuffer?.data || bufferToSave.length > 0) {
-                if (file.tempFilePath) {
-                    await fs.writeFile(file.tempFilePath, fileBuffer?.data || bufferToSave); // write fileBuffer to the temp path
+            if (tempFileHandling.type === 'copyFromTempFile') {
+                filesToSave.push({
+                    path: `${staticPath}/${fsSafeName}`,
+                    sourcePath: tempFileHandling.sourcePath
+                });
+            } else if (tempFileHandling.type === 'useBuffer') {
+                let bufferToSave;
+                if (fileBuffer?.data) {
+                    bufferToSave = fileBuffer.data;
+                } else if (file.tempFilePath) {
+                    bufferToSave = await fs.readFile(file.tempFilePath);
                 } else {
-                    // Assign the _possibly modified_ file to the request object
-                    req.file = {
-                        ...file,
-                        data: fileBuffer?.data || bufferToSave,
-                        size: fileBuffer?.info.size
-                    };
+                    bufferToSave = file.data;
+                }
+                // A 'header'/'none' content requirement (see getFileContentRequirement.ts) means
+                // file.data is only a partial probe, not the real content - never save it as-is.
+                const fileDataIsPartialView = !fileBuffer?.data && !file.tempFilePath && bufferToSave.length !== file.size;
+                if (!fileDataIsPartialView) {
+                    filesToSave.push({
+                        buffer: bufferToSave,
+                        path: `${staticPath}/${fsSafeName}`
+                    });
+                    if (fileBuffer?.data || bufferToSave.length > 0) {
+                        if (file.tempFilePath) {
+                            await fs.writeFile(file.tempFilePath, fileBuffer?.data || bufferToSave);
+                        } else {
+                            // Keep req.file in sync, since downstream hooks/plugins may read it.
+                            req.file = {
+                                ...file,
+                                data: fileBuffer?.data || bufferToSave,
+                                size: fileBuffer?.info.size
+                            };
+                        }
+                    }
                 }
             }
         }
         if (fileSupportsResize && (Array.isArray(imageSizes) || focalPointEnabled !== false)) {
             req.payloadUploadSizes = {};
-            // Focal point adjustments
             const focalPoint = focalPointEnabled && uploadEdits?.focalPoint ? {
                 x: isNumber(uploadEdits.focalPoint.x) ? Math.round(uploadEdits.focalPoint.x) : 50,
                 y: isNumber(uploadEdits.focalPoint.y) ? Math.round(uploadEdits.focalPoint.y) : 50
@@ -306,7 +359,7 @@ export const generateFileData = async ({ collection: { config: collectionConfig
                 mimeType: fileData.mimeType,
                 req,
                 savedFilename: fsSafeName || file.name,
-                sharp,
+                sharp: fileHasCompleteContents ? sharp : undefined,
                 staticPath: staticPath,
                 withMetadata
             });
@@ -343,9 +396,8 @@ export const generateFileData = async ({ collection: { config: collectionConfig
     const incomingData = data;
     const origDoc = originalDoc;
     if (origDoc && 'focalX' in origDoc && 'focalY' in origDoc) {
-        // If no change in focal point, return undefined.
-        // This prevents a refocal operation triggered from admin, because it always sends the focal point.
-        if (incomingData.focalX === origDoc.focalX && incomingData.focalY === origDoc.focalY) {
+        // Admin always resends the current focal point, so treat an unchanged value as no edit.
+        if (incomingData?.focalX === origDoc.focalX && incomingData?.focalY === origDoc.focalY) {
             return undefined;
         }
         if (isDuplicating) {