payload 4.0.0-internal.bc5cf8c → 4.0.0-internal.bf4bcce

package/dist/uploads/getFileTypeIdentity.js

@@ -0,0 +1,34 @@
+import sanitize from 'sanitize-filename';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+export const getFileExtension = (filename)=>{
+    if (!filename.includes('.')) {
+        return '';
+    }
+    const extension = filename.split('.').pop() || '';
+    const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1);
+    return extensionWithoutSuffix;
+};
+export const getSanitizedUploadFilename = (filename, outputExtension)=>{
+    const basename = sanitizeFilename(filename);
+    const sourceExtension = getFileExtension(basename);
+    const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename);
+    const extension = outputExtension ?? sourceExtension;
+    return `${baseFilename}${extension ? `.${extension}` : ''}`;
+};
+export const getMimeTypeEssence = (mimeType)=>{
+    if (!mimeType) {
+        return '';
+    }
+    const [essence = ''] = mimeType.split(';', 1);
+    return essence.trim().toLowerCase();
+};
+export const isSvgMimeType = (mimeType)=>getMimeTypeEssence(mimeType) === 'image/svg+xml';
+export const isXmlMimeType = (mimeType)=>{
+    const mimeTypeEssence = getMimeTypeEssence(mimeType);
+    return mimeTypeEssence === 'application/xml' || mimeTypeEssence === 'text/xml' || mimeTypeEssence.endsWith('+xml');
+};
+export const isSvgUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' || isSvgMimeType(mimeType);
+export const isXmlUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' || isXmlMimeType(mimeType);
+export const uploadRequiresServerValidation = (upload)=>!upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload));
+
+//# sourceMappingURL=getFileTypeIdentity.js.map

package/dist/uploads/getFileTypeIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileTypeIdentity.ts"],"sourcesContent":["import sanitize from 'sanitize-filename'\n\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\n\nexport const getFileExtension = (filename: string): string => {\n  if (!filename.includes('.')) {\n    return ''\n  }\n\n  const extension = filename.split('.').pop() || ''\n  const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1)\n\n  return extensionWithoutSuffix\n}\n\nexport const getSanitizedUploadFilename = (filename: string, outputExtension?: string): string => {\n  const basename = sanitizeFilename(filename)\n  const sourceExtension = getFileExtension(basename)\n  const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename)\n  const extension = outputExtension ?? sourceExtension\n\n  return `${baseFilename}${extension ? `.${extension}` : ''}`\n}\n\nexport const getMimeTypeEssence = (mimeType?: null | string): string => {\n  if (!mimeType) {\n    return ''\n  }\n\n  const [essence = ''] = mimeType.split(';', 1)\n\n  return essence.trim().toLowerCase()\n}\n\nexport const isSvgMimeType = (mimeType?: null | string): boolean =>\n  getMimeTypeEssence(mimeType) === 'image/svg+xml'\n\nexport const isXmlMimeType = (mimeType?: null | string): boolean => {\n  const mimeTypeEssence = getMimeTypeEssence(mimeType)\n\n  return (\n    mimeTypeEssence === 'application/xml' ||\n    mimeTypeEssence === 'text/xml' ||\n    mimeTypeEssence.endsWith('+xml')\n  )\n}\n\nexport const isSvgUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' ||\n  isSvgMimeType(mimeType)\n\nexport const isXmlUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' ||\n  isXmlMimeType(mimeType)\n\nexport const uploadRequiresServerValidation = (upload: {\n  allowRestrictedFileTypes?: boolean\n  filename: string\n  mimeType?: null | string\n}): boolean => !upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload))\n"],"names":["sanitize","sanitizeFilename","getFileExtension","filename","includes","extension","split","pop","extensionWithoutSuffix","getSanitizedUploadFilename","outputExtension","basename","sourceExtension","baseFilename","substring","lastIndexOf","getMimeTypeEssence","mimeType","essence","trim","toLowerCase","isSvgMimeType","isXmlMimeType","mimeTypeEssence","endsWith","isSvgUpload","isXmlUpload","uploadRequiresServerValidation","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAOA,cAAc,oBAAmB;AAExC,SAASC,gBAAgB,QAAQ,mCAAkC;AAEnE,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,IAAI,CAACA,SAASC,QAAQ,CAAC,MAAM;QAC3B,OAAO;IACT;IAEA,MAAMC,YAAYF,SAASG,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC/C,MAAM,CAACC,yBAAyB,EAAE,CAAC,GAAGH,UAAUC,KAAK,CAAC,QAAQ;IAE9D,OAAOE;AACT,EAAC;AAED,OAAO,MAAMC,6BAA6B,CAACN,UAAkBO;IAC3D,MAAMC,WAAWV,iBAAiBE;IAClC,MAAMS,kBAAkBV,iBAAiBS;IACzC,MAAME,eAAeb,SAASW,SAASG,SAAS,CAAC,GAAGH,SAASI,WAAW,CAAC,SAASJ;IAClF,MAAMN,YAAYK,mBAAmBE;IAErC,OAAO,GAAGC,eAAeR,YAAY,CAAC,CAAC,EAAEA,WAAW,GAAG,IAAI;AAC7D,EAAC;AAED,OAAO,MAAMW,qBAAqB,CAACC;IACjC,IAAI,CAACA,UAAU;QACb,OAAO;IACT;IAEA,MAAM,CAACC,UAAU,EAAE,CAAC,GAAGD,SAASX,KAAK,CAAC,KAAK;IAE3C,OAAOY,QAAQC,IAAI,GAAGC,WAAW;AACnC,EAAC;AAED,OAAO,MAAMC,gBAAgB,CAACJ,WAC5BD,mBAAmBC,cAAc,gBAAe;AAElD,OAAO,MAAMK,gBAAgB,CAACL;IAC5B,MAAMM,kBAAkBP,mBAAmBC;IAE3C,OACEM,oBAAoB,qBACpBA,oBAAoB,cACpBA,gBAAgBC,QAAQ,CAAC;AAE7B,EAAC;AAED,OAAO,MAAMC,cAAc,CAAC,EAC1BtB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEC,cAAcJ,UAAS;AAEzB,OAAO,MAAMS,cAAc,CAAC,EAC1BvB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEE,cAAcL,UAAS;AAEzB,OAAO,MAAMU,iCAAiC,CAACC,SAIhC,CAACA,OAAOC,wBAAwB,IAAKJ,CAAAA,YAAYG,WAAWF,YAAYE,OAAM,EAAE"}

package/dist/uploads/getImageSize.d.ts

@@ -1,4 +1,11 @@
 import type { PayloadRequest } from '../types/index.js';
 import type { ProbedImageSize } from './types.js';
-export declare function getImageSize(file: PayloadRequest['file']): Promise<ProbedImageSize>;
+/**
+ * Reads an uploaded file's dimensions via the dependency-free probe. Throws
+ * if the buffer isn't a recognized/parseable image format — callers that
+ * don't already know the file is an image should catch and ignore.
+ */
+export declare function getImageSize({ file, }: {
+    file: PayloadRequest['file'];
+}): Promise<ProbedImageSize>;
 //# sourceMappingURL=getImageSize.d.ts.map

package/dist/uploads/getImageSize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getImageSize.d.ts","sourceRoot":"","sources":["../../src/uploads/getImageSize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAIjD,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAmBzF"}
+{"version":3,"file":"getImageSize.d.ts","sourceRoot":"","sources":["../../src/uploads/getImageSize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAIjD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,EACjC,IAAI,GACL,EAAE;IACD,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,GAAG,OAAO,CAAC,eAAe,CAAC,CAS3B"}

package/dist/uploads/getImageSize.js

@@ -1,23 +1,15 @@
-import fs from 'fs/promises';
-import { imageSize } from 'image-size';
-import { imageSizeFromFile } from 'image-size/fromFile';
-import { temporaryFileTask } from './tempFile.js';
-export async function getImageSize(file) {
-    if (file?.tempFilePath) {
-        return imageSizeFromFile(file.tempFilePath);
+import { probeImageSize, probeImageSizeFromPath } from './probeImageSize.js';
+/**
+ * Reads an uploaded file's dimensions via the dependency-free probe. Throws
+ * if the buffer isn't a recognized/parseable image format — callers that
+ * don't already know the file is an image should catch and ignore.
+ */ export async function getImageSize({ file }) {
+    // `tempFilePath` may be an empty string when the file is held in memory
+    const tempFilePath = file?.tempFilePath || undefined;
+    if (tempFilePath) {
+        return probeImageSizeFromPath(tempFilePath);
     }
-    // Tiff file do not support buffers or streams, so we must write to file first
-    // then retrieve dimensions. https://github.com/image-size/image-size/issues/103
-    if (file?.mimetype === 'image/tiff') {
-        const dimensions = await temporaryFileTask(async (filepath)=>{
-            await fs.writeFile(filepath, file.data);
-            return imageSizeFromFile(filepath);
-        }, {
-            extension: 'tiff'
-        });
-        return dimensions;
-    }
-    return imageSize(file.data);
+    return probeImageSize(file.data);
 }
 
 //# sourceMappingURL=getImageSize.js.map

package/dist/uploads/getImageSize.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getImageSize.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport { imageSize } from 'image-size'\nimport { imageSizeFromFile } from 'image-size/fromFile'\n\nimport type { PayloadRequest } from '../types/index.js'\nimport type { ProbedImageSize } from './types.js'\n\nimport { temporaryFileTask } from './tempFile.js'\n\nexport async function getImageSize(file: PayloadRequest['file']): Promise<ProbedImageSize> {\n  if (file?.tempFilePath) {\n    return imageSizeFromFile(file.tempFilePath)\n  }\n\n  // Tiff file do not support buffers or streams, so we must write to file first\n  // then retrieve dimensions. https://github.com/image-size/image-size/issues/103\n  if (file?.mimetype === 'image/tiff') {\n    const dimensions = await temporaryFileTask(\n      async (filepath: string) => {\n        await fs.writeFile(filepath, file.data)\n        return imageSizeFromFile(filepath)\n      },\n      { extension: 'tiff' },\n    )\n    return dimensions\n  }\n\n  return imageSize(file!.data)\n}\n"],"names":["fs","imageSize","imageSizeFromFile","temporaryFileTask","getImageSize","file","tempFilePath","mimetype","dimensions","filepath","writeFile","data","extension"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,SAAS,QAAQ,aAAY;AACtC,SAASC,iBAAiB,QAAQ,sBAAqB;AAKvD,SAASC,iBAAiB,QAAQ,gBAAe;AAEjD,OAAO,eAAeC,aAAaC,IAA4B;IAC7D,IAAIA,MAAMC,cAAc;QACtB,OAAOJ,kBAAkBG,KAAKC,YAAY;IAC5C;IAEA,8EAA8E;IAC9E,gFAAgF;IAChF,IAAID,MAAME,aAAa,cAAc;QACnC,MAAMC,aAAa,MAAML,kBACvB,OAAOM;YACL,MAAMT,GAAGU,SAAS,CAACD,UAAUJ,KAAKM,IAAI;YACtC,OAAOT,kBAAkBO;QAC3B,GACA;YAAEG,WAAW;QAAO;QAEtB,OAAOJ;IACT;IAEA,OAAOP,UAAUI,KAAMM,IAAI;AAC7B"}
+{"version":3,"sources":["../../src/uploads/getImageSize.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ProbedImageSize } from './types.js'\n\nimport { probeImageSize, probeImageSizeFromPath } from './probeImageSize.js'\n\n/**\n * Reads an uploaded file's dimensions via the dependency-free probe. Throws\n * if the buffer isn't a recognized/parseable image format — callers that\n * don't already know the file is an image should catch and ignore.\n */\nexport async function getImageSize({\n  file,\n}: {\n  file: PayloadRequest['file']\n}): Promise<ProbedImageSize> {\n  // `tempFilePath` may be an empty string when the file is held in memory\n  const tempFilePath = file?.tempFilePath || undefined\n\n  if (tempFilePath) {\n    return probeImageSizeFromPath(tempFilePath)\n  }\n\n  return probeImageSize(file!.data)\n}\n"],"names":["probeImageSize","probeImageSizeFromPath","getImageSize","file","tempFilePath","undefined","data"],"mappings":"AAGA,SAASA,cAAc,EAAEC,sBAAsB,QAAQ,sBAAqB;AAE5E;;;;CAIC,GACD,OAAO,eAAeC,aAAa,EACjCC,IAAI,EAGL;IACC,wEAAwE;IACxE,MAAMC,eAAeD,MAAMC,gBAAgBC;IAE3C,IAAID,cAAc;QAChB,OAAOH,uBAAuBG;IAChC;IAEA,OAAOJ,eAAeG,KAAMG,IAAI;AAClC"}

package/dist/uploads/getRangeRequestInfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRangeRequestInfo.d.ts","sourceRoot":"","sources":["../../src/uploads/getRangeRequestInfo.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,kBAAkB,GAC1B;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;CAChB,GACD;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAEL;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,WAAW,GACZ,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,GAAG,kBAAkB,CA6CrB"}
+{"version":3,"file":"getRangeRequestInfo.d.ts","sourceRoot":"","sources":["../../src/uploads/getRangeRequestInfo.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAC1B;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;CAChB,GACD;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,MAAM,EAAE,GAAG,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;CAChB,CAAA;AAEL;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,WAAW,GACZ,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,GAAG,kBAAkB,CA6CrB"}

package/dist/uploads/getRangeRequestInfo.js

@@ -1,4 +1,4 @@
-import { status as httpStatus } from 'http-status';
+import { httpStatus } from '../utilities/httpStatus.js';
 import { parseRangeHeader } from './parseRangeHeader.js';
 /**
  * Gets HTTP Range request information according to RFC 7233

package/dist/uploads/getRangeRequestInfo.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getRangeRequestInfo.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport { parseRangeHeader } from './parseRangeHeader.js'\n\nexport type RangeRequestResult =\n  | {\n      headers: {\n        'Accept-Ranges': string\n        'Content-Length': string\n        'Content-Range'?: string\n      }\n      rangeEnd: number\n      rangeStart: number\n      status: 206\n      type: 'partial'\n    }\n  | {\n      headers: {\n        'Accept-Ranges': string\n        'Content-Length': string\n      }\n      status: 200\n      type: 'full'\n    }\n  | {\n      headers: {\n        'Content-Range': string\n      }\n      status: 416\n      type: 'invalid'\n    }\n\n/**\n * Gets HTTP Range request information according to RFC 7233\n *\n * @param fileSize - The total size of the file in bytes\n * @param rangeHeader - The Range header value from the request (e.g., \"bytes=0-1023\")\n * @returns Result object with headers and status code for the response\n */\nexport function getRangeRequestInfo({\n  fileSize,\n  rangeHeader,\n}: {\n  fileSize: number\n  rangeHeader: null | string\n}): RangeRequestResult {\n  // Parse the Range header\n  const rangeResult = parseRangeHeader({\n    fileSize,\n    rangeHeader,\n  })\n\n  // Handle invalid range\n  if (rangeResult.type === 'invalid') {\n    return {\n      type: 'invalid',\n      headers: {\n        'Content-Range': `bytes */${fileSize}`,\n      },\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    }\n  }\n\n  // Handle partial range request\n  if (rangeResult.type === 'partial' && rangeResult.range) {\n    const { end, start } = rangeResult.range\n    const contentLength = end - start + 1\n\n    return {\n      type: 'partial',\n      headers: {\n        'Accept-Ranges': 'bytes',\n        'Content-Length': String(contentLength),\n        'Content-Range': `bytes ${start}-${end}/${fileSize}`,\n      },\n      rangeEnd: end,\n      rangeStart: start,\n      status: httpStatus.PARTIAL_CONTENT,\n    }\n  }\n\n  // Handle full file request (no range or invalid)\n  return {\n    type: 'full',\n    headers: {\n      'Accept-Ranges': 'bytes',\n      'Content-Length': String(fileSize),\n    },\n    status: httpStatus.OK,\n  }\n}\n"],"names":["status","httpStatus","parseRangeHeader","getRangeRequestInfo","fileSize","rangeHeader","rangeResult","type","headers","REQUESTED_RANGE_NOT_SATISFIABLE","range","end","start","contentLength","String","rangeEnd","rangeStart","PARTIAL_CONTENT","OK"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAElD,SAASC,gBAAgB,QAAQ,wBAAuB;AA8BxD;;;;;;CAMC,GACD,OAAO,SAASC,oBAAoB,EAClCC,QAAQ,EACRC,WAAW,EAIZ;IACC,yBAAyB;IACzB,MAAMC,cAAcJ,iBAAiB;QACnCE;QACAC;IACF;IAEA,uBAAuB;IACvB,IAAIC,YAAYC,IAAI,KAAK,WAAW;QAClC,OAAO;YACLA,MAAM;YACNC,SAAS;gBACP,iBAAiB,CAAC,QAAQ,EAAEJ,UAAU;YACxC;YACAJ,QAAQC,WAAWQ,+BAA+B;QACpD;IACF;IAEA,+BAA+B;IAC/B,IAAIH,YAAYC,IAAI,KAAK,aAAaD,YAAYI,KAAK,EAAE;QACvD,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGN,YAAYI,KAAK;QACxC,MAAMG,gBAAgBF,MAAMC,QAAQ;QAEpC,OAAO;YACLL,MAAM;YACNC,SAAS;gBACP,iBAAiB;gBACjB,kBAAkBM,OAAOD;gBACzB,iBAAiB,CAAC,MAAM,EAAED,MAAM,CAAC,EAAED,IAAI,CAAC,EAAEP,UAAU;YACtD;YACAW,UAAUJ;YACVK,YAAYJ;YACZZ,QAAQC,WAAWgB,eAAe;QACpC;IACF;IAEA,iDAAiD;IACjD,OAAO;QACLV,MAAM;QACNC,SAAS;YACP,iBAAiB;YACjB,kBAAkBM,OAAOV;QAC3B;QACAJ,QAAQC,WAAWiB,EAAE;IACvB;AACF"}
+{"version":3,"sources":["../../src/uploads/getRangeRequestInfo.ts"],"sourcesContent":["import { httpStatus } from '../utilities/httpStatus.js'\nimport { parseRangeHeader } from './parseRangeHeader.js'\n\nexport type RangeRequestResult =\n  | {\n      headers: {\n        'Accept-Ranges': string\n        'Content-Length': string\n        'Content-Range'?: string\n      }\n      rangeEnd: number\n      rangeStart: number\n      status: 206\n      type: 'partial'\n    }\n  | {\n      headers: {\n        'Accept-Ranges': string\n        'Content-Length': string\n      }\n      status: 200\n      type: 'full'\n    }\n  | {\n      headers: {\n        'Content-Range': string\n      }\n      status: 416\n      type: 'invalid'\n    }\n\n/**\n * Gets HTTP Range request information according to RFC 7233\n *\n * @param fileSize - The total size of the file in bytes\n * @param rangeHeader - The Range header value from the request (e.g., \"bytes=0-1023\")\n * @returns Result object with headers and status code for the response\n */\nexport function getRangeRequestInfo({\n  fileSize,\n  rangeHeader,\n}: {\n  fileSize: number\n  rangeHeader: null | string\n}): RangeRequestResult {\n  // Parse the Range header\n  const rangeResult = parseRangeHeader({\n    fileSize,\n    rangeHeader,\n  })\n\n  // Handle invalid range\n  if (rangeResult.type === 'invalid') {\n    return {\n      type: 'invalid',\n      headers: {\n        'Content-Range': `bytes */${fileSize}`,\n      },\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    }\n  }\n\n  // Handle partial range request\n  if (rangeResult.type === 'partial' && rangeResult.range) {\n    const { end, start } = rangeResult.range\n    const contentLength = end - start + 1\n\n    return {\n      type: 'partial',\n      headers: {\n        'Accept-Ranges': 'bytes',\n        'Content-Length': String(contentLength),\n        'Content-Range': `bytes ${start}-${end}/${fileSize}`,\n      },\n      rangeEnd: end,\n      rangeStart: start,\n      status: httpStatus.PARTIAL_CONTENT,\n    }\n  }\n\n  // Handle full file request (no range or invalid)\n  return {\n    type: 'full',\n    headers: {\n      'Accept-Ranges': 'bytes',\n      'Content-Length': String(fileSize),\n    },\n    status: httpStatus.OK,\n  }\n}\n"],"names":["httpStatus","parseRangeHeader","getRangeRequestInfo","fileSize","rangeHeader","rangeResult","type","headers","status","REQUESTED_RANGE_NOT_SATISFIABLE","range","end","start","contentLength","String","rangeEnd","rangeStart","PARTIAL_CONTENT","OK"],"mappings":"AAAA,SAASA,UAAU,QAAQ,6BAA4B;AACvD,SAASC,gBAAgB,QAAQ,wBAAuB;AA8BxD;;;;;;CAMC,GACD,OAAO,SAASC,oBAAoB,EAClCC,QAAQ,EACRC,WAAW,EAIZ;IACC,yBAAyB;IACzB,MAAMC,cAAcJ,iBAAiB;QACnCE;QACAC;IACF;IAEA,uBAAuB;IACvB,IAAIC,YAAYC,IAAI,KAAK,WAAW;QAClC,OAAO;YACLA,MAAM;YACNC,SAAS;gBACP,iBAAiB,CAAC,QAAQ,EAAEJ,UAAU;YACxC;YACAK,QAAQR,WAAWS,+BAA+B;QACpD;IACF;IAEA,+BAA+B;IAC/B,IAAIJ,YAAYC,IAAI,KAAK,aAAaD,YAAYK,KAAK,EAAE;QACvD,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGP,YAAYK,KAAK;QACxC,MAAMG,gBAAgBF,MAAMC,QAAQ;QAEpC,OAAO;YACLN,MAAM;YACNC,SAAS;gBACP,iBAAiB;gBACjB,kBAAkBO,OAAOD;gBACzB,iBAAiB,CAAC,MAAM,EAAED,MAAM,CAAC,EAAED,IAAI,CAAC,EAAER,UAAU;YACtD;YACAY,UAAUJ;YACVK,YAAYJ;YACZJ,QAAQR,WAAWiB,eAAe;QACpC;IACF;IAEA,iDAAiD;IACjD,OAAO;QACLX,MAAM;QACNC,SAAS;YACP,iBAAiB;YACjB,kBAAkBO,OAAOX;QAC3B;QACAK,QAAQR,WAAWkB,EAAE;IACvB;AACF"}

package/dist/uploads/getSafeFilename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSafeFilename.d.ts","sourceRoot":"","sources":["../../src/uploads/getSafeFilename.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAe5C,CAAA;AAED,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,eAAe,CAAC,EACpC,cAAc,EACd,eAAe,EACf,MAAM,EACN,GAAG,EACH,UAAU,GACX,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBxB"}
+{"version":3,"file":"getSafeFilename.d.ts","sourceRoot":"","sources":["../../src/uploads/getSafeFilename.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAe5C,CAAA;AAED,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,eAAe,CAAC,EACpC,cAAc,EACd,eAAe,EACf,MAAM,EACN,GAAG,EACH,UAAU,GACX,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBxB"}

package/dist/uploads/hasCropOrResizeEdit.d.ts

@@ -0,0 +1,7 @@
+import type { UploadEdits } from './types.js';
+/**
+ * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as
+ * opposed to `focalPoint`, which does not.
+ */
+export declare const hasCropOrResizeEdit: (uploadEdits: undefined | UploadEdits) => boolean;
+//# sourceMappingURL=hasCropOrResizeEdit.d.ts.map

package/dist/uploads/hasCropOrResizeEdit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasCropOrResizeEdit.d.ts","sourceRoot":"","sources":["../../src/uploads/hasCropOrResizeEdit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,gBAAiB,SAAS,GAAG,WAAW,KAAG,OACc,CAAA"}

package/dist/uploads/hasCropOrResizeEdit.js

@@ -0,0 +1,6 @@
+/**
+ * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as
+ * opposed to `focalPoint`, which does not.
+ */ export const hasCropOrResizeEdit = (uploadEdits)=>Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels);
+
+//# sourceMappingURL=hasCropOrResizeEdit.js.map

package/dist/uploads/hasCropOrResizeEdit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/hasCropOrResizeEdit.ts"],"sourcesContent":["import type { UploadEdits } from './types.js'\n\n/**\n * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as\n * opposed to `focalPoint`, which does not.\n */\nexport const hasCropOrResizeEdit = (uploadEdits: undefined | UploadEdits): boolean =>\n  Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels)\n"],"names":["hasCropOrResizeEdit","uploadEdits","Boolean","crop","heightInPixels","widthInPixels"],"mappings":"AAEA;;;CAGC,GACD,OAAO,MAAMA,sBAAsB,CAACC,cAClCC,QAAQD,aAAaE,QAAQF,aAAaG,kBAAkBH,aAAaI,eAAc"}

package/dist/uploads/hasFullFileContents.d.ts

@@ -0,0 +1,13 @@
+/**
+ * True when the upload's bytes are fully available for processing - either wholly in-memory
+ * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial
+ * in-memory probe alongside it. Bounded header-only probes returned by
+ * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on
+ * complete content.
+ */
+export declare function hasFullFileContents(file: {
+    data: Buffer;
+    size: number;
+    tempFilePath?: string;
+}): boolean;
+//# sourceMappingURL=hasFullFileContents.d.ts.map

package/dist/uploads/hasFullFileContents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasFullFileContents.d.ts","sourceRoot":"","sources":["../../src/uploads/hasFullFileContents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAGV"}

package/dist/uploads/hasFullFileContents.js

@@ -0,0 +1,12 @@
+/**
+ * True when the upload's bytes are fully available for processing - either wholly in-memory
+ * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial
+ * in-memory probe alongside it. Bounded header-only probes returned by
+ * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on
+ * complete content.
+ */ export function hasFullFileContents(file) {
+    const isCompleteTempFile = Boolean(file.tempFilePath) && (!file.data || file.data.length === 0);
+    return isCompleteTempFile || file.data.length === file.size;
+}
+
+//# sourceMappingURL=hasFullFileContents.js.map

package/dist/uploads/hasFullFileContents.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/hasFullFileContents.ts"],"sourcesContent":["/**\n * True when the upload's bytes are fully available for processing - either wholly in-memory\n * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial\n * in-memory probe alongside it. Bounded header-only probes returned by\n * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on\n * complete content.\n */\nexport function hasFullFileContents(file: {\n  data: Buffer\n  size: number\n  tempFilePath?: string\n}): boolean {\n  const isCompleteTempFile = Boolean(file.tempFilePath) && (!file.data || file.data.length === 0)\n  return isCompleteTempFile || file.data.length === file.size\n}\n"],"names":["hasFullFileContents","file","isCompleteTempFile","Boolean","tempFilePath","data","length","size"],"mappings":"AAAA;;;;;;CAMC,GACD,OAAO,SAASA,oBAAoBC,IAInC;IACC,MAAMC,qBAAqBC,QAAQF,KAAKG,YAAY,KAAM,CAAA,CAACH,KAAKI,IAAI,IAAIJ,KAAKI,IAAI,CAACC,MAAM,KAAK,CAAA;IAC7F,OAAOJ,sBAAsBD,KAAKI,IAAI,CAACC,MAAM,KAAKL,KAAKM,IAAI;AAC7D"}

package/dist/uploads/isAnimatedImage.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether sharp needs to read every frame/page of this mime type (rather than just the first) to
+ * process it correctly - used to decide whether a file needs its full bytes fetched/processed
+ * even without any resize/format/trim adjustments configured, and whether sharp should be asked
+ * to read all frames when it does run.
+ */
+export declare function isAnimatedImage(mimeType: string): boolean;
+//# sourceMappingURL=isAnimatedImage.d.ts.map

package/dist/uploads/isAnimatedImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isAnimatedImage.d.ts","sourceRoot":"","sources":["../../src/uploads/isAnimatedImage.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/uploads/isAnimatedImage.js

@@ -0,0 +1,22 @@
+// Matches the formats sharp's own `animated` input option documents as supported (reading every
+// frame/page instead of just the first): https://sharp.pixelplumbing.com/api-constructor - "Set to
+// true to read all frames/pages of an animated image (GIF, WebP, TIFF)". AVIF is deliberately
+// excluded even though the format itself supports animation: this sharp version's AVIF encoder
+// silently flattens `join({ animated: true })` frames into a single tall static image instead of
+// a multi-page sequence (verified directly - the output always comes back as `pages: 1`), so
+// there's no working animated-AVIF path to account for here.
+const ANIMATED_IMAGE_MIME_TYPES = [
+    'image/gif',
+    'image/tiff',
+    'image/webp'
+];
+/**
+ * Whether sharp needs to read every frame/page of this mime type (rather than just the first) to
+ * process it correctly - used to decide whether a file needs its full bytes fetched/processed
+ * even without any resize/format/trim adjustments configured, and whether sharp should be asked
+ * to read all frames when it does run.
+ */ export function isAnimatedImage(mimeType) {
+    return ANIMATED_IMAGE_MIME_TYPES.includes(mimeType);
+}
+
+//# sourceMappingURL=isAnimatedImage.js.map

package/dist/uploads/isAnimatedImage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/isAnimatedImage.ts"],"sourcesContent":["// Matches the formats sharp's own `animated` input option documents as supported (reading every\n// frame/page instead of just the first): https://sharp.pixelplumbing.com/api-constructor - \"Set to\n// true to read all frames/pages of an animated image (GIF, WebP, TIFF)\". AVIF is deliberately\n// excluded even though the format itself supports animation: this sharp version's AVIF encoder\n// silently flattens `join({ animated: true })` frames into a single tall static image instead of\n// a multi-page sequence (verified directly - the output always comes back as `pages: 1`), so\n// there's no working animated-AVIF path to account for here.\nconst ANIMATED_IMAGE_MIME_TYPES = ['image/gif', 'image/tiff', 'image/webp']\n\n/**\n * Whether sharp needs to read every frame/page of this mime type (rather than just the first) to\n * process it correctly - used to decide whether a file needs its full bytes fetched/processed\n * even without any resize/format/trim adjustments configured, and whether sharp should be asked\n * to read all frames when it does run.\n */\nexport function isAnimatedImage(mimeType: string): boolean {\n  return ANIMATED_IMAGE_MIME_TYPES.includes(mimeType)\n}\n"],"names":["ANIMATED_IMAGE_MIME_TYPES","isAnimatedImage","mimeType","includes"],"mappings":"AAAA,gGAAgG;AAChG,mGAAmG;AACnG,8FAA8F;AAC9F,+FAA+F;AAC/F,iGAAiG;AACjG,6FAA6F;AAC7F,6DAA6D;AAC7D,MAAMA,4BAA4B;IAAC;IAAa;IAAc;CAAa;AAE3E;;;;;CAKC,GACD,OAAO,SAASC,gBAAgBC,QAAgB;IAC9C,OAAOF,0BAA0BG,QAAQ,CAACD;AAC5C"}

package/dist/uploads/isProcessableImage.d.ts

@@ -0,0 +1,2 @@
+export declare function isProcessableImage(mimeType: string): boolean;
+//# sourceMappingURL=isProcessableImage.d.ts.map

package/dist/uploads/isProcessableImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isProcessableImage.d.ts","sourceRoot":"","sources":["../../src/uploads/isProcessableImage.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/uploads/isProcessableImage.js

@@ -0,0 +1,7 @@
+import { canResizeImage } from './canResizeImage.js';
+import { isImage } from './isImage.js';
+export function isProcessableImage(mimeType) {
+    return isImage(mimeType) || canResizeImage(mimeType);
+}
+
+//# sourceMappingURL=isProcessableImage.js.map

package/dist/uploads/isProcessableImage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/isProcessableImage.ts"],"sourcesContent":["import { canResizeImage } from './canResizeImage.js'\nimport { isImage } from './isImage.js'\n\nexport function isProcessableImage(mimeType: string): boolean {\n  return isImage(mimeType) || canResizeImage(mimeType)\n}\n"],"names":["canResizeImage","isImage","isProcessableImage","mimeType"],"mappings":"AAAA,SAASA,cAAc,QAAQ,sBAAqB;AACpD,SAASC,OAAO,QAAQ,eAAc;AAEtC,OAAO,SAASC,mBAAmBC,QAAgB;IACjD,OAAOF,QAAQE,aAAaH,eAAeG;AAC7C"}

package/dist/uploads/mimeTypeValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mimeTypeValidator.d.ts","sourceRoot":"","sources":["../../src/uploads/mimeTypeValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAIzD,eAAO,MAAM,iBAAiB,GAC3B,WAAW,MAAM,EAAE,KAAG,QAYtB,CAAA"}
+{"version":3,"file":"mimeTypeValidator.d.ts","sourceRoot":"","sources":["../../src/uploads/mimeTypeValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAIzD,eAAO,MAAM,iBAAiB,cAChB,MAAM,EAAE,KAAG,QAYtB,CAAA"}

package/dist/uploads/parseFilename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseFilename.d.ts","sourceRoot":"","sources":["../../src/uploads/parseFilename.ts"],"names":[],"mappings":"AAEA,KAAK,kBAAkB,GAAG;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,gBAAiB,MAAM,KAAG,kBAInD,CAAA"}

package/dist/uploads/parseFilename.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/parseFilename.ts"],"sourcesContent":["import sanitize from 'sanitize-filename'\n\ntype SanitizedImageData = {\n  ext: string\n  name: string\n}\n\n/**\n * Sanitize the image name and extract the extension from the source image\n *\n * @param sourceImage - the source image\n * @returns the sanitized name and extension\n */\nexport const parseFilename = (sourceImage: string): SanitizedImageData => {\n  const extension = sourceImage.split('.').pop()\n  const name = sanitize(sourceImage.substring(0, sourceImage.lastIndexOf('.')) || sourceImage)\n  return { name, ext: extension! }\n}\n"],"names":["sanitize","parseFilename","sourceImage","extension","split","pop","name","substring","lastIndexOf","ext"],"mappings":"AAAA,OAAOA,cAAc,oBAAmB;AAOxC;;;;;CAKC,GACD,OAAO,MAAMC,gBAAgB,CAACC;IAC5B,MAAMC,YAAYD,YAAYE,KAAK,CAAC,KAAKC,GAAG;IAC5C,MAAMC,OAAON,SAASE,YAAYK,SAAS,CAAC,GAAGL,YAAYM,WAAW,CAAC,SAASN;IAChF,OAAO;QAAEI;QAAMG,KAAKN;IAAW;AACjC,EAAC"}

package/dist/uploads/probeImageSize.d.ts

@@ -0,0 +1,39 @@
+import type { ProbedImageSize } from './types.js';
+/**
+ * Dependency-free image dimension probe. Reads only the header bytes needed
+ * to determine width and height.
+ *
+ * PNG, JPEG, GIF, WebP, AVIF and HEIF/HEIC are delegated to `image-dimensions`
+ * (actively maintained, zero dependencies). BMP, ICO/CUR, SVG, TIFF and JPEG
+ * XL have no such maintained equivalent, so they're read here directly; each
+ * of those parsers advances by a fixed amount or is bounded by an explicit
+ * guard, so malformed input can never block the event loop.
+ *
+ * Replaces the archived `image-size` package, whose ICNS/HEIF parsers shipped
+ * unpatched denial-of-service vulnerabilities (CVE-2025-71330, CVE-2025-71319).
+ *
+ * Two edge cases changed behavior compared to the previous hand-rolled parser:
+ * - JPEG files using arithmetic coding or hierarchical encoding (SOF markers
+ *   5-7, 9-11, 13-15) are no longer read; `image-dimensions` only recognizes
+ *   baseline and progressive JPEG (SOF0-3). These encodings are not produced
+ *   by browsers or cameras, so this is not expected to affect real uploads.
+ * - AVIF/HEIF detection now checks the container's brand list instead of
+ *   accepting any ISO base media file with a `ftyp` box, so non-image formats
+ *   that share the same container (for example MP4/MOV) are correctly no
+ *   longer misidentified as images.
+ *
+ * @throws if the buffer is not a recognized/parseable image format
+ */
+export declare function probeImageSize(data: Buffer): ProbedImageSize;
+/**
+ * Probe used when the file lives on disk via `tempFilePath`. PNG, JPEG, GIF,
+ * WebP, AVIF and HEIF/HEIC are read through `imageDimensionsFromStream`,
+ * which reads only as many bytes as are needed to find the header, so a
+ * large file's data is never pulled into memory. BMP, ICO/CUR, SVG, TIFF and
+ * JPEG XL are detected from a small header sniff and, only then, read in
+ * full for `probeImageSize` to parse.
+ *
+ * @throws if the file is not a recognized/parseable image format
+ */
+export declare function probeImageSizeFromPath(tempFilePath: string): Promise<ProbedImageSize>;
+//# sourceMappingURL=probeImageSize.d.ts.map

package/dist/uploads/probeImageSize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probeImageSize.d.ts","sourceRoot":"","sources":["../../src/uploads/probeImageSize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAW5D;AAQD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgB3F"}