payload 4.0.0-internal.bc5cf8c → 4.0.0-internal.bf4bcce

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts

@@ -0,0 +1,18 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+/**
+ * Orchestrates a dynamic file request end to end: resolve the document, plan the
+ * request-capable transformer pipeline from the requested file's authoritative
+ * MIME type (the primary file or the matched image size), enforce
+ * transform-aware read access, then run every eligible transformer in declaration
+ * order against a lazily-fetched source. Called from `getFileHandler` only when at
+ * least one transformer is configured — the zero-transformer path never reaches
+ * this function.
+ */
+export declare function handleDynamicFileRequest({ collection, filename, prefix, req, }: {
+    collection: Collection;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
+//# sourceMappingURL=handleDynamicFileRequest.d.ts.map

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleDynamicFileRequest.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/handleDynamicFileRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAgB1D;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyHpB"}

package/dist/uploads/transformers/handleDynamicFileRequest.js

@@ -0,0 +1,296 @@
+import { Forbidden } from '../../errors/Forbidden.js';
+import { NotFound } from '../../errors/NotFound.js';
+import { TransformerContractError } from '../../errors/TransformerContractError.js';
+import { checkFileAccess } from '../checkFileAccess.js';
+import { retrieveFileResponse } from '../endpoints/getFile.js';
+import { createLazySourceGetter } from './createLazySourceGetter.js';
+import { finalizeFileResponse } from './finalizeFileResponse.js';
+import { getSourceFileResponse } from './getSourceFileResponse.js';
+import { getCandidateTransformers, planTransformerPipeline } from './planTransformerPipeline.js';
+import { getRequestedFile, resolveUploadDocument } from './resolveUploadDocument.js';
+import { withFileTransformAccessContext } from './withFileTransformAccessContext.js';
+/**
+ * Orchestrates a dynamic file request end to end: resolve the document, plan the
+ * request-capable transformer pipeline from the requested file's authoritative
+ * MIME type (the primary file or the matched image size), enforce
+ * transform-aware read access, then run every eligible transformer in declaration
+ * order against a lazily-fetched source. Called from `getFileHandler` only when at
+ * least one transformer is configured — the zero-transformer path never reaches
+ * this function.
+ */ export async function handleDynamicFileRequest({ collection, filename, prefix, req }) {
+    const resolvedDocument = await resolveUploadDocument({
+        collection,
+        filename,
+        prefix,
+        req
+    });
+    if (!resolvedDocument) {
+        // There's no mimeType to plan a pipeline from, so both access modes must pass
+        // before admitting the file doesn't exist — otherwise the status code would leak
+        // file existence to an access function keyed on req.fileTransform.
+        for (const isTransform of [
+            true,
+            false
+        ]){
+            await withFileTransformAccessContext({
+                callback: ()=>checkFileAccess({
+                        collection,
+                        filename,
+                        prefix,
+                        req
+                    }),
+                isTransform,
+                req
+            });
+        }
+        throw new NotFound(req.t);
+    }
+    if (resolvedDocument.original?.filename === filename && (resolvedDocument.filename !== filename || req.searchParams.size === 0)) {
+        const permittedDocument = await withFileTransformAccessContext({
+            callback: ()=>checkFileAccess({
+                    collection,
+                    filename,
+                    prefix,
+                    req
+                }),
+            isTransform: false,
+            req
+        });
+        return retrieveFileResponse({
+            collection,
+            doc: permittedDocument ?? resolvedDocument,
+            filename,
+            prefix,
+            req
+        });
+    }
+    const { document, pipeline } = await authorizeDocument({
+        collection,
+        filename,
+        prefix,
+        req,
+        resolvedDocument
+    });
+    const requestedFile = getRequestedFile({
+        document,
+        filename
+    });
+    const source = createLazySourceGetter({
+        retrieve: ()=>getSourceFileResponse({
+                collection,
+                document,
+                filename,
+                prefix,
+                req
+            })
+    });
+    let currentResponse;
+    // Each stage has its own controller so a discarded body can be closed even when the
+    // transformer locked it with a reader. Every remaining controller is aborted on failure.
+    const handedOutBodyControllers = new Map();
+    const discardResponse = async (response)=>{
+        await cancelUnusedBody(response);
+        handedOutBodyControllers.get(response)?.abort();
+        handedOutBodyControllers.delete(response);
+    };
+    try {
+        for (const transformer of pipeline){
+            const previousResponse = currentResponse;
+            let handedOutResponse;
+            const handedOutBodyController = new AbortController();
+            const stageSource = createLazySourceGetter({
+                retrieve: async ()=>{
+                    handedOutResponse = withAbortableBody({
+                        response: currentResponse ?? await source.get(),
+                        signal: handedOutBodyController.signal
+                    });
+                    handedOutBodyControllers.set(handedOutResponse, handedOutBodyController);
+                    return handedOutResponse;
+                }
+            });
+            const result = await transformer.handleRequest({
+                collectionSlug: collection.config.slug,
+                documentID: document.id,
+                filename: requestedFile.filename,
+                getSourceFile: stageSource.get,
+                mimeType: requestedFile.mimeType,
+                req
+            });
+            if (result.response) {
+                if (handedOutResponse && result.response !== handedOutResponse) {
+                    await discardResponse(handedOutResponse);
+                } else if (previousResponse && result.response !== previousResponse) {
+                    await discardResponse(previousResponse);
+                }
+                currentResponse = result.response;
+            } else if (stageSource.wasCalled()) {
+                throw new TransformerContractError('A transformer that consumes its source must return a response.');
+            }
+            if (result.status === 'complete') {
+                return finalizeFileResponse({
+                    collection,
+                    req,
+                    response: currentResponse
+                });
+            }
+        }
+    } catch (err) {
+        req.payload.logger.error({
+            err,
+            msg: 'Error running the file transformer pipeline'
+        });
+        for (const handedOutBodyController of handedOutBodyControllers.values()){
+            handedOutBodyController.abort(err);
+        }
+        await cancelUnusedBody(currentResponse);
+        throw err;
+    }
+    if (currentResponse) {
+        return finalizeFileResponse({
+            collection,
+            req,
+            response: currentResponse
+        });
+    }
+    // No transformer produced a response — serve the original file through the
+    // normal path (Range/ETag/redirect support, existing `modifyResponseHeaders` order).
+    return retrieveFileResponse({
+        collection,
+        doc: document,
+        filename,
+        prefix,
+        req
+    });
+}
+/**
+ * Re-wraps `response` so its body can be cancelled through `signal`, closing the underlying
+ * source stream (file handle, storage connection) regardless of who holds a reader on it.
+ */ function withAbortableBody({ response, signal }) {
+    if (!response.body) {
+        return response;
+    }
+    return new Response(response.body.pipeThrough(new TransformStream(), {
+        signal
+    }), {
+        headers: response.headers,
+        status: response.status,
+        statusText: response.statusText
+    });
+}
+/**
+ * Cancels a response body nothing has started reading. A locked body was handed to a transformer
+ * through `withAbortableBody`, and is closed by aborting its signal instead.
+ */ async function cancelUnusedBody(response) {
+    if (!response?.body || response.body.locked) {
+        return;
+    }
+    try {
+        await response.body.cancel();
+    } catch  {
+    // A clean-up failure must not replace the pipeline result or error.
+    }
+}
+function planRequestPipeline({ collection, document, filename, req }) {
+    return planTransformerPipeline({
+        args: {
+            collectionSlug: collection.config.slug,
+            documentID: document.id,
+            mimeType: getRequestedFile({
+                document,
+                filename
+            }).mimeType,
+            operation: 'request',
+            req
+        },
+        capability: 'handleRequest',
+        transformers: req.payload.config.upload.transformers
+    });
+}
+/**
+ * Decides which document is served and which pipeline runs, checking read access
+ * before any application-defined transformer code (`canTransform`) executes.
+ *
+ * 1. The first access mode comes from MIME matching alone: a transform-aware check
+ *    when any transformer could handle the file, otherwise an ordinary read.
+ * 2. If the transform-aware check is denied, an ordinary read may still be allowed
+ *    (e.g. public originals, signed-in-only variants), so that mode is tried next.
+ * 3. Only once a check has passed does `canTransform` plan the real pipeline.
+ * 4. The access mode the final pipeline requires must itself have passed — a
+ *    "variants only" policy must not leak the original when no transformer applies.
+ *
+ * `resolveUploadDocument` is unfiltered, so without a `prefix` it can match a
+ * document the user can't read that shares the filename (filenames are only
+ * unique per prefix). Whenever `checkFileAccess` returns a document, that
+ * authorized document is the one served — storage adapters trust `doc` to
+ * resolve the object key.
+ */ async function authorizeDocument({ collection, filename, prefix, req, resolvedDocument }) {
+    const accessResults = new Map();
+    const checkAccess = ({ isTransform })=>{
+        if (!accessResults.has(isTransform)) {
+            accessResults.set(isTransform, withFileTransformAccessContext({
+                callback: ()=>checkFileAccess({
+                        collection,
+                        filename,
+                        prefix,
+                        req
+                    }),
+                isTransform,
+                req
+            }).then((document)=>({
+                    document: document,
+                    isAllowed: true
+                }), (err)=>{
+                if (err instanceof Forbidden) {
+                    return {
+                        isAllowed: false
+                    };
+                }
+                throw err;
+            }));
+        }
+        return accessResults.get(isTransform);
+    };
+    const hasCandidateTransformers = getCandidateTransformers({
+        capability: 'handleRequest',
+        mimeType: getRequestedFile({
+            document: resolvedDocument,
+            filename
+        }).mimeType,
+        transformers: req.payload.config.upload.transformers
+    }).length > 0;
+    let isTransformAccess = hasCandidateTransformers;
+    let access = await checkAccess({
+        isTransform: isTransformAccess
+    });
+    if (!access.isAllowed && isTransformAccess) {
+        isTransformAccess = false;
+        access = await checkAccess({
+            isTransform: isTransformAccess
+        });
+    }
+    if (!access.isAllowed) {
+        throw new Forbidden(req.t);
+    }
+    const document = access.document && access.document.id !== resolvedDocument.id ? access.document : resolvedDocument;
+    const pipeline = await planRequestPipeline({
+        collection,
+        document,
+        filename,
+        req
+    });
+    const isTransform = pipeline.length > 0;
+    if (isTransform !== isTransformAccess) {
+        const requiredAccess = await checkAccess({
+            isTransform
+        });
+        if (!requiredAccess.isAllowed || requiredAccess.document && requiredAccess.document.id !== document.id) {
+            throw new Forbidden(req.t);
+        }
+    }
+    return {
+        document,
+        pipeline
+    };
+}
+
+//# sourceMappingURL=handleDynamicFileRequest.js.map

package/dist/uploads/transformers/handleDynamicFileRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/handleDynamicFileRequest.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { ResolvedUploadDocument } from './resolveUploadDocument.js'\nimport type { UploadTransformer } from './types.js'\n\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { NotFound } from '../../errors/NotFound.js'\nimport { TransformerContractError } from '../../errors/TransformerContractError.js'\nimport { checkFileAccess } from '../checkFileAccess.js'\nimport { retrieveFileResponse } from '../endpoints/getFile.js'\nimport { createLazySourceGetter } from './createLazySourceGetter.js'\nimport { finalizeFileResponse } from './finalizeFileResponse.js'\nimport { getSourceFileResponse } from './getSourceFileResponse.js'\nimport { getCandidateTransformers, planTransformerPipeline } from './planTransformerPipeline.js'\nimport { getRequestedFile, resolveUploadDocument } from './resolveUploadDocument.js'\nimport { withFileTransformAccessContext } from './withFileTransformAccessContext.js'\n\n/**\n * Orchestrates a dynamic file request end to end: resolve the document, plan the\n * request-capable transformer pipeline from the requested file's authoritative\n * MIME type (the primary file or the matched image size), enforce\n * transform-aware read access, then run every eligible transformer in declaration\n * order against a lazily-fetched source. Called from `getFileHandler` only when at\n * least one transformer is configured — the zero-transformer path never reaches\n * this function.\n */\nexport async function handleDynamicFileRequest({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<Response> {\n  const resolvedDocument = await resolveUploadDocument({ collection, filename, prefix, req })\n\n  if (!resolvedDocument) {\n    // There's no mimeType to plan a pipeline from, so both access modes must pass\n    // before admitting the file doesn't exist — otherwise the status code would leak\n    // file existence to an access function keyed on req.fileTransform.\n    for (const isTransform of [true, false]) {\n      await withFileTransformAccessContext({\n        callback: () => checkFileAccess({ collection, filename, prefix, req }),\n        isTransform,\n        req,\n      })\n    }\n    throw new NotFound(req.t)\n  }\n\n  if (\n    resolvedDocument.original?.filename === filename &&\n    (resolvedDocument.filename !== filename || req.searchParams.size === 0)\n  ) {\n    const permittedDocument = await withFileTransformAccessContext({\n      callback: () => checkFileAccess({ collection, filename, prefix, req }),\n      isTransform: false,\n      req,\n    })\n\n    return retrieveFileResponse({\n      collection,\n      doc: (permittedDocument ?? resolvedDocument) as ResolvedUploadDocument,\n      filename,\n      prefix,\n      req,\n    })\n  }\n\n  const { document, pipeline } = await authorizeDocument({\n    collection,\n    filename,\n    prefix,\n    req,\n    resolvedDocument,\n  })\n\n  const requestedFile = getRequestedFile({ document, filename })\n\n  const source = createLazySourceGetter({\n    retrieve: () => getSourceFileResponse({ collection, document, filename, prefix, req }),\n  })\n\n  let currentResponse: Response | undefined\n  // Each stage has its own controller so a discarded body can be closed even when the\n  // transformer locked it with a reader. Every remaining controller is aborted on failure.\n  const handedOutBodyControllers = new Map<Response, AbortController>()\n\n  const discardResponse = async (response: Response): Promise<void> => {\n    await cancelUnusedBody(response)\n    handedOutBodyControllers.get(response)?.abort()\n    handedOutBodyControllers.delete(response)\n  }\n\n  try {\n    for (const transformer of pipeline) {\n      const previousResponse = currentResponse\n      let handedOutResponse: Response | undefined\n      const handedOutBodyController = new AbortController()\n      const stageSource = createLazySourceGetter({\n        retrieve: async () => {\n          handedOutResponse = withAbortableBody({\n            response: currentResponse ?? (await source.get()),\n            signal: handedOutBodyController.signal,\n          })\n          handedOutBodyControllers.set(handedOutResponse, handedOutBodyController)\n\n          return handedOutResponse\n        },\n      })\n\n      const result = await transformer.handleRequest!({\n        collectionSlug: collection.config.slug,\n        documentID: document.id,\n        filename: requestedFile.filename,\n        getSourceFile: stageSource.get,\n        mimeType: requestedFile.mimeType,\n        req,\n      })\n\n      if (result.response) {\n        if (handedOutResponse && result.response !== handedOutResponse) {\n          await discardResponse(handedOutResponse)\n        } else if (previousResponse && result.response !== previousResponse) {\n          await discardResponse(previousResponse)\n        }\n\n        currentResponse = result.response\n      } else if (stageSource.wasCalled()) {\n        throw new TransformerContractError(\n          'A transformer that consumes its source must return a response.',\n        )\n      }\n\n      if (result.status === 'complete') {\n        return finalizeFileResponse({ collection, req, response: currentResponse! })\n      }\n    }\n  } catch (err) {\n    req.payload.logger.error({ err, msg: 'Error running the file transformer pipeline' })\n    for (const handedOutBodyController of handedOutBodyControllers.values()) {\n      handedOutBodyController.abort(err)\n    }\n    await cancelUnusedBody(currentResponse)\n    throw err\n  }\n\n  if (currentResponse) {\n    return finalizeFileResponse({ collection, req, response: currentResponse })\n  }\n\n  // No transformer produced a response — serve the original file through the\n  // normal path (Range/ETag/redirect support, existing `modifyResponseHeaders` order).\n  return retrieveFileResponse({ collection, doc: document, filename, prefix, req })\n}\n\n/**\n * Re-wraps `response` so its body can be cancelled through `signal`, closing the underlying\n * source stream (file handle, storage connection) regardless of who holds a reader on it.\n */\nfunction withAbortableBody({\n  response,\n  signal,\n}: {\n  response: Response\n  signal: AbortSignal\n}): Response {\n  if (!response.body) {\n    return response\n  }\n\n  return new Response(response.body.pipeThrough(new TransformStream(), { signal }), {\n    headers: response.headers,\n    status: response.status,\n    statusText: response.statusText,\n  })\n}\n\n/**\n * Cancels a response body nothing has started reading. A locked body was handed to a transformer\n * through `withAbortableBody`, and is closed by aborting its signal instead.\n */\nasync function cancelUnusedBody(response: Response | undefined): Promise<void> {\n  if (!response?.body || response.body.locked) {\n    return\n  }\n\n  try {\n    await response.body.cancel()\n  } catch {\n    // A clean-up failure must not replace the pipeline result or error.\n  }\n}\n\nfunction planRequestPipeline({\n  collection,\n  document,\n  filename,\n  req,\n}: {\n  collection: Collection\n  document: ResolvedUploadDocument\n  filename: string\n  req: PayloadRequest\n}): Promise<UploadTransformer[]> {\n  return planTransformerPipeline({\n    args: {\n      collectionSlug: collection.config.slug,\n      documentID: document.id,\n      mimeType: getRequestedFile({ document, filename }).mimeType,\n      operation: 'request',\n      req,\n    },\n    capability: 'handleRequest',\n    transformers: req.payload.config.upload.transformers,\n  })\n}\n\ntype AccessResult = { document?: ResolvedUploadDocument; isAllowed: true } | { isAllowed: false }\n\n/**\n * Decides which document is served and which pipeline runs, checking read access\n * before any application-defined transformer code (`canTransform`) executes.\n *\n * 1. The first access mode comes from MIME matching alone: a transform-aware check\n *    when any transformer could handle the file, otherwise an ordinary read.\n * 2. If the transform-aware check is denied, an ordinary read may still be allowed\n *    (e.g. public originals, signed-in-only variants), so that mode is tried next.\n * 3. Only once a check has passed does `canTransform` plan the real pipeline.\n * 4. The access mode the final pipeline requires must itself have passed — a\n *    \"variants only\" policy must not leak the original when no transformer applies.\n *\n * `resolveUploadDocument` is unfiltered, so without a `prefix` it can match a\n * document the user can't read that shares the filename (filenames are only\n * unique per prefix). Whenever `checkFileAccess` returns a document, that\n * authorized document is the one served — storage adapters trust `doc` to\n * resolve the object key.\n */\nasync function authorizeDocument({\n  collection,\n  filename,\n  prefix,\n  req,\n  resolvedDocument,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n  resolvedDocument: ResolvedUploadDocument\n}): Promise<{ document: ResolvedUploadDocument; pipeline: UploadTransformer[] }> {\n  const accessResults = new Map<boolean, Promise<AccessResult>>()\n\n  const checkAccess = ({ isTransform }: { isTransform: boolean }): Promise<AccessResult> => {\n    if (!accessResults.has(isTransform)) {\n      accessResults.set(\n        isTransform,\n        withFileTransformAccessContext({\n          callback: () => checkFileAccess({ collection, filename, prefix, req }),\n          isTransform,\n          req,\n        }).then(\n          (document) => ({\n            document: document as ResolvedUploadDocument | undefined,\n            isAllowed: true as const,\n          }),\n          (err: unknown) => {\n            if (err instanceof Forbidden) {\n              return { isAllowed: false as const }\n            }\n\n            throw err\n          },\n        ),\n      )\n    }\n\n    return accessResults.get(isTransform)!\n  }\n\n  const hasCandidateTransformers =\n    getCandidateTransformers({\n      capability: 'handleRequest',\n      mimeType: getRequestedFile({ document: resolvedDocument, filename }).mimeType,\n      transformers: req.payload.config.upload.transformers,\n    }).length > 0\n\n  let isTransformAccess = hasCandidateTransformers\n  let access = await checkAccess({ isTransform: isTransformAccess })\n\n  if (!access.isAllowed && isTransformAccess) {\n    isTransformAccess = false\n    access = await checkAccess({ isTransform: isTransformAccess })\n  }\n\n  if (!access.isAllowed) {\n    throw new Forbidden(req.t)\n  }\n\n  const document =\n    access.document && access.document.id !== resolvedDocument.id\n      ? access.document\n      : resolvedDocument\n\n  const pipeline = await planRequestPipeline({ collection, document, filename, req })\n  const isTransform = pipeline.length > 0\n\n  if (isTransform !== isTransformAccess) {\n    const requiredAccess = await checkAccess({ isTransform })\n\n    if (\n      !requiredAccess.isAllowed ||\n      (requiredAccess.document && requiredAccess.document.id !== document.id)\n    ) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  return { document, pipeline }\n}\n"],"names":["Forbidden","NotFound","TransformerContractError","checkFileAccess","retrieveFileResponse","createLazySourceGetter","finalizeFileResponse","getSourceFileResponse","getCandidateTransformers","planTransformerPipeline","getRequestedFile","resolveUploadDocument","withFileTransformAccessContext","handleDynamicFileRequest","collection","filename","prefix","req","resolvedDocument","isTransform","callback","t","original","searchParams","size","permittedDocument","doc","document","pipeline","authorizeDocument","requestedFile","source","retrieve","currentResponse","handedOutBodyControllers","Map","discardResponse","response","cancelUnusedBody","get","abort","delete","transformer","previousResponse","handedOutResponse","handedOutBodyController","AbortController","stageSource","withAbortableBody","signal","set","result","handleRequest","collectionSlug","config","slug","documentID","id","getSourceFile","mimeType","wasCalled","status","err","payload","logger","error","msg","values","body","Response","pipeThrough","TransformStream","headers","statusText","locked","cancel","planRequestPipeline","args","operation","capability","transformers","upload","accessResults","checkAccess","has","then","isAllowed","hasCandidateTransformers","length","isTransformAccess","access","requiredAccess"],"mappings":"AAKA,SAASA,SAAS,QAAQ,4BAA2B;AACrD,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,wBAAwB,QAAQ,2CAA0C;AACnF,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,oBAAoB,QAAQ,0BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,8BAA6B;AACpE,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,wBAAwB,EAAEC,uBAAuB,QAAQ,+BAA8B;AAChG,SAASC,gBAAgB,EAAEC,qBAAqB,QAAQ,6BAA4B;AACpF,SAASC,8BAA8B,QAAQ,sCAAqC;AAEpF;;;;;;;;CAQC,GACD,OAAO,eAAeC,yBAAyB,EAC7CC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,MAAMC,mBAAmB,MAAMP,sBAAsB;QAAEG;QAAYC;QAAUC;QAAQC;IAAI;IAEzF,IAAI,CAACC,kBAAkB;QACrB,8EAA8E;QAC9E,iFAAiF;QACjF,mEAAmE;QACnE,KAAK,MAAMC,eAAe;YAAC;YAAM;SAAM,CAAE;YACvC,MAAMP,+BAA+B;gBACnCQ,UAAU,IAAMjB,gBAAgB;wBAAEW;wBAAYC;wBAAUC;wBAAQC;oBAAI;gBACpEE;gBACAF;YACF;QACF;QACA,MAAM,IAAIhB,SAASgB,IAAII,CAAC;IAC1B;IAEA,IACEH,iBAAiBI,QAAQ,EAAEP,aAAaA,YACvCG,CAAAA,iBAAiBH,QAAQ,KAAKA,YAAYE,IAAIM,YAAY,CAACC,IAAI,KAAK,CAAA,GACrE;QACA,MAAMC,oBAAoB,MAAMb,+BAA+B;YAC7DQ,UAAU,IAAMjB,gBAAgB;oBAAEW;oBAAYC;oBAAUC;oBAAQC;gBAAI;YACpEE,aAAa;YACbF;QACF;QAEA,OAAOb,qBAAqB;YAC1BU;YACAY,KAAMD,qBAAqBP;YAC3BH;YACAC;YACAC;QACF;IACF;IAEA,MAAM,EAAEU,QAAQ,EAAEC,QAAQ,EAAE,GAAG,MAAMC,kBAAkB;QACrDf;QACAC;QACAC;QACAC;QACAC;IACF;IAEA,MAAMY,gBAAgBpB,iBAAiB;QAAEiB;QAAUZ;IAAS;IAE5D,MAAMgB,SAAS1B,uBAAuB;QACpC2B,UAAU,IAAMzB,sBAAsB;gBAAEO;gBAAYa;gBAAUZ;gBAAUC;gBAAQC;YAAI;IACtF;IAEA,IAAIgB;IACJ,oFAAoF;IACpF,yFAAyF;IACzF,MAAMC,2BAA2B,IAAIC;IAErC,MAAMC,kBAAkB,OAAOC;QAC7B,MAAMC,iBAAiBD;QACvBH,yBAAyBK,GAAG,CAACF,WAAWG;QACxCN,yBAAyBO,MAAM,CAACJ;IAClC;IAEA,IAAI;QACF,KAAK,MAAMK,eAAed,SAAU;YAClC,MAAMe,mBAAmBV;YACzB,IAAIW;YACJ,MAAMC,0BAA0B,IAAIC;YACpC,MAAMC,cAAc1C,uBAAuB;gBACzC2B,UAAU;oBACRY,oBAAoBI,kBAAkB;wBACpCX,UAAUJ,mBAAoB,MAAMF,OAAOQ,GAAG;wBAC9CU,QAAQJ,wBAAwBI,MAAM;oBACxC;oBACAf,yBAAyBgB,GAAG,CAACN,mBAAmBC;oBAEhD,OAAOD;gBACT;YACF;YAEA,MAAMO,SAAS,MAAMT,YAAYU,aAAa,CAAE;gBAC9CC,gBAAgBvC,WAAWwC,MAAM,CAACC,IAAI;gBACtCC,YAAY7B,SAAS8B,EAAE;gBACvB1C,UAAUe,cAAcf,QAAQ;gBAChC2C,eAAeX,YAAYR,GAAG;gBAC9BoB,UAAU7B,cAAc6B,QAAQ;gBAChC1C;YACF;YAEA,IAAIkC,OAAOd,QAAQ,EAAE;gBACnB,IAAIO,qBAAqBO,OAAOd,QAAQ,KAAKO,mBAAmB;oBAC9D,MAAMR,gBAAgBQ;gBACxB,OAAO,IAAID,oBAAoBQ,OAAOd,QAAQ,KAAKM,kBAAkB;oBACnE,MAAMP,gBAAgBO;gBACxB;gBAEAV,kBAAkBkB,OAAOd,QAAQ;YACnC,OAAO,IAAIU,YAAYa,SAAS,IAAI;gBAClC,MAAM,IAAI1D,yBACR;YAEJ;YAEA,IAAIiD,OAAOU,MAAM,KAAK,YAAY;gBAChC,OAAOvD,qBAAqB;oBAAEQ;oBAAYG;oBAAKoB,UAAUJ;gBAAiB;YAC5E;QACF;IACF,EAAE,OAAO6B,KAAK;QACZ7C,IAAI8C,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;YAAEH;YAAKI,KAAK;QAA8C;QACnF,KAAK,MAAMrB,2BAA2BX,yBAAyBiC,MAAM,GAAI;YACvEtB,wBAAwBL,KAAK,CAACsB;QAChC;QACA,MAAMxB,iBAAiBL;QACvB,MAAM6B;IACR;IAEA,IAAI7B,iBAAiB;QACnB,OAAO3B,qBAAqB;YAAEQ;YAAYG;YAAKoB,UAAUJ;QAAgB;IAC3E;IAEA,2EAA2E;IAC3E,qFAAqF;IACrF,OAAO7B,qBAAqB;QAAEU;QAAYY,KAAKC;QAAUZ;QAAUC;QAAQC;IAAI;AACjF;AAEA;;;CAGC,GACD,SAAS+B,kBAAkB,EACzBX,QAAQ,EACRY,MAAM,EAIP;IACC,IAAI,CAACZ,SAAS+B,IAAI,EAAE;QAClB,OAAO/B;IACT;IAEA,OAAO,IAAIgC,SAAShC,SAAS+B,IAAI,CAACE,WAAW,CAAC,IAAIC,mBAAmB;QAAEtB;IAAO,IAAI;QAChFuB,SAASnC,SAASmC,OAAO;QACzBX,QAAQxB,SAASwB,MAAM;QACvBY,YAAYpC,SAASoC,UAAU;IACjC;AACF;AAEA;;;CAGC,GACD,eAAenC,iBAAiBD,QAA8B;IAC5D,IAAI,CAACA,UAAU+B,QAAQ/B,SAAS+B,IAAI,CAACM,MAAM,EAAE;QAC3C;IACF;IAEA,IAAI;QACF,MAAMrC,SAAS+B,IAAI,CAACO,MAAM;IAC5B,EAAE,OAAM;IACN,oEAAoE;IACtE;AACF;AAEA,SAASC,oBAAoB,EAC3B9D,UAAU,EACVa,QAAQ,EACRZ,QAAQ,EACRE,GAAG,EAMJ;IACC,OAAOR,wBAAwB;QAC7BoE,MAAM;YACJxB,gBAAgBvC,WAAWwC,MAAM,CAACC,IAAI;YACtCC,YAAY7B,SAAS8B,EAAE;YACvBE,UAAUjD,iBAAiB;gBAAEiB;gBAAUZ;YAAS,GAAG4C,QAAQ;YAC3DmB,WAAW;YACX7D;QACF;QACA8D,YAAY;QACZC,cAAc/D,IAAI8C,OAAO,CAACT,MAAM,CAAC2B,MAAM,CAACD,YAAY;IACtD;AACF;AAIA;;;;;;;;;;;;;;;;;CAiBC,GACD,eAAenD,kBAAkB,EAC/Bf,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EACHC,gBAAgB,EAOjB;IACC,MAAMgE,gBAAgB,IAAI/C;IAE1B,MAAMgD,cAAc,CAAC,EAAEhE,WAAW,EAA4B;QAC5D,IAAI,CAAC+D,cAAcE,GAAG,CAACjE,cAAc;YACnC+D,cAAchC,GAAG,CACf/B,aACAP,+BAA+B;gBAC7BQ,UAAU,IAAMjB,gBAAgB;wBAAEW;wBAAYC;wBAAUC;wBAAQC;oBAAI;gBACpEE;gBACAF;YACF,GAAGoE,IAAI,CACL,CAAC1D,WAAc,CAAA;oBACbA,UAAUA;oBACV2D,WAAW;gBACb,CAAA,GACA,CAACxB;gBACC,IAAIA,eAAe9D,WAAW;oBAC5B,OAAO;wBAAEsF,WAAW;oBAAe;gBACrC;gBAEA,MAAMxB;YACR;QAGN;QAEA,OAAOoB,cAAc3C,GAAG,CAACpB;IAC3B;IAEA,MAAMoE,2BACJ/E,yBAAyB;QACvBuE,YAAY;QACZpB,UAAUjD,iBAAiB;YAAEiB,UAAUT;YAAkBH;QAAS,GAAG4C,QAAQ;QAC7EqB,cAAc/D,IAAI8C,OAAO,CAACT,MAAM,CAAC2B,MAAM,CAACD,YAAY;IACtD,GAAGQ,MAAM,GAAG;IAEd,IAAIC,oBAAoBF;IACxB,IAAIG,SAAS,MAAMP,YAAY;QAAEhE,aAAasE;IAAkB;IAEhE,IAAI,CAACC,OAAOJ,SAAS,IAAIG,mBAAmB;QAC1CA,oBAAoB;QACpBC,SAAS,MAAMP,YAAY;YAAEhE,aAAasE;QAAkB;IAC9D;IAEA,IAAI,CAACC,OAAOJ,SAAS,EAAE;QACrB,MAAM,IAAItF,UAAUiB,IAAII,CAAC;IAC3B;IAEA,MAAMM,WACJ+D,OAAO/D,QAAQ,IAAI+D,OAAO/D,QAAQ,CAAC8B,EAAE,KAAKvC,iBAAiBuC,EAAE,GACzDiC,OAAO/D,QAAQ,GACfT;IAEN,MAAMU,WAAW,MAAMgD,oBAAoB;QAAE9D;QAAYa;QAAUZ;QAAUE;IAAI;IACjF,MAAME,cAAcS,SAAS4D,MAAM,GAAG;IAEtC,IAAIrE,gBAAgBsE,mBAAmB;QACrC,MAAME,iBAAiB,MAAMR,YAAY;YAAEhE;QAAY;QAEvD,IACE,CAACwE,eAAeL,SAAS,IACxBK,eAAehE,QAAQ,IAAIgE,eAAehE,QAAQ,CAAC8B,EAAE,KAAK9B,SAAS8B,EAAE,EACtE;YACA,MAAM,IAAIzD,UAAUiB,IAAII,CAAC;QAC3B;IACF;IAEA,OAAO;QAAEM;QAAUC;IAAS;AAC9B"}

package/dist/uploads/transformers/matchesMimeType.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Matches an authoritative MIME type against a transformer-declared MIME pattern:
+ * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching
+ * every type and subtype). Defensive by design — malformed input returns `false`
+ * rather than throwing; startup validation owns rejecting malformed configured patterns.
+ */
+export declare function matchesMimeType({ mimeType, pattern, }: {
+    mimeType: string;
+    pattern: string;
+}): boolean;
+//# sourceMappingURL=matchesMimeType.d.ts.map

package/dist/uploads/transformers/matchesMimeType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchesMimeType.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/matchesMimeType.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,OAAO,GACR,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAuCV"}

package/dist/uploads/transformers/matchesMimeType.js

@@ -0,0 +1,39 @@
+function normalize(value) {
+    return value.trim().toLowerCase();
+}
+/**
+ * Matches an authoritative MIME type against a transformer-declared MIME pattern:
+ * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching
+ * every type and subtype). Defensive by design — malformed input returns `false`
+ * rather than throwing; startup validation owns rejecting malformed configured patterns.
+ */ export function matchesMimeType({ mimeType, pattern }) {
+    if (typeof pattern !== 'string' || typeof mimeType !== 'string') {
+        return false;
+    }
+    const normalizedPattern = normalize(pattern);
+    const normalizedMimeType = normalize(mimeType);
+    if (normalizedPattern === '*/*') {
+        return true;
+    }
+    const patternParts = normalizedPattern.split('/');
+    if (patternParts.length !== 2 || patternParts.some((part)=>part.length === 0)) {
+        return false;
+    }
+    const [patternType, patternSubtype] = patternParts;
+    // "*/*" is the only valid full wildcard — a wildcard type with a concrete
+    // subtype (e.g. "*/png") is invalid.
+    if (patternType === '*') {
+        return false;
+    }
+    const mimeParts = normalizedMimeType.split('/');
+    if (mimeParts.length !== 2) {
+        return false;
+    }
+    const [mimeTypeSegment, mimeSubtypeSegment] = mimeParts;
+    if (patternType !== mimeTypeSegment) {
+        return false;
+    }
+    return patternSubtype === '*' || patternSubtype === mimeSubtypeSegment;
+}
+
+//# sourceMappingURL=matchesMimeType.js.map

package/dist/uploads/transformers/matchesMimeType.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/matchesMimeType.ts"],"sourcesContent":["function normalize(value: string): string {\n  return value.trim().toLowerCase()\n}\n\n/**\n * Matches an authoritative MIME type against a transformer-declared MIME pattern:\n * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching\n * every type and subtype). Defensive by design — malformed input returns `false`\n * rather than throwing; startup validation owns rejecting malformed configured patterns.\n */\nexport function matchesMimeType({\n  mimeType,\n  pattern,\n}: {\n  mimeType: string\n  pattern: string\n}): boolean {\n  if (typeof pattern !== 'string' || typeof mimeType !== 'string') {\n    return false\n  }\n\n  const normalizedPattern = normalize(pattern)\n  const normalizedMimeType = normalize(mimeType)\n\n  if (normalizedPattern === '*/*') {\n    return true\n  }\n\n  const patternParts = normalizedPattern.split('/')\n\n  if (patternParts.length !== 2 || patternParts.some((part) => part.length === 0)) {\n    return false\n  }\n\n  const [patternType, patternSubtype] = patternParts\n\n  // \"*/*\" is the only valid full wildcard — a wildcard type with a concrete\n  // subtype (e.g. \"*/png\") is invalid.\n  if (patternType === '*') {\n    return false\n  }\n\n  const mimeParts = normalizedMimeType.split('/')\n\n  if (mimeParts.length !== 2) {\n    return false\n  }\n\n  const [mimeTypeSegment, mimeSubtypeSegment] = mimeParts\n\n  if (patternType !== mimeTypeSegment) {\n    return false\n  }\n\n  return patternSubtype === '*' || patternSubtype === mimeSubtypeSegment\n}\n"],"names":["normalize","value","trim","toLowerCase","matchesMimeType","mimeType","pattern","normalizedPattern","normalizedMimeType","patternParts","split","length","some","part","patternType","patternSubtype","mimeParts","mimeTypeSegment","mimeSubtypeSegment"],"mappings":"AAAA,SAASA,UAAUC,KAAa;IAC9B,OAAOA,MAAMC,IAAI,GAAGC,WAAW;AACjC;AAEA;;;;;CAKC,GACD,OAAO,SAASC,gBAAgB,EAC9BC,QAAQ,EACRC,OAAO,EAIR;IACC,IAAI,OAAOA,YAAY,YAAY,OAAOD,aAAa,UAAU;QAC/D,OAAO;IACT;IAEA,MAAME,oBAAoBP,UAAUM;IACpC,MAAME,qBAAqBR,UAAUK;IAErC,IAAIE,sBAAsB,OAAO;QAC/B,OAAO;IACT;IAEA,MAAME,eAAeF,kBAAkBG,KAAK,CAAC;IAE7C,IAAID,aAAaE,MAAM,KAAK,KAAKF,aAAaG,IAAI,CAAC,CAACC,OAASA,KAAKF,MAAM,KAAK,IAAI;QAC/E,OAAO;IACT;IAEA,MAAM,CAACG,aAAaC,eAAe,GAAGN;IAEtC,0EAA0E;IAC1E,qCAAqC;IACrC,IAAIK,gBAAgB,KAAK;QACvB,OAAO;IACT;IAEA,MAAME,YAAYR,mBAAmBE,KAAK,CAAC;IAE3C,IAAIM,UAAUL,MAAM,KAAK,GAAG;QAC1B,OAAO;IACT;IAEA,MAAM,CAACM,iBAAiBC,mBAAmB,GAAGF;IAE9C,IAAIF,gBAAgBG,iBAAiB;QACnC,OAAO;IACT;IAEA,OAAOF,mBAAmB,OAAOA,mBAAmBG;AACtD"}

package/dist/uploads/transformers/planTransformerPipeline.d.ts

@@ -0,0 +1,26 @@
+import type { CanTransformArgs, UploadTransformer } from './types.js';
+/**
+ * Builds the fixed, ordered list of transformers eligible for one upload or
+ * dynamic-request operation. Pure and side-effect-free beyond invoking each
+ * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`
+ * and performs no storage or access work. A thrown/rejected `canTransform` aborts
+ * planning immediately rather than being treated as `false`.
+ */
+export declare function planTransformerPipeline({ args, capability, transformers, }: {
+    args: CanTransformArgs;
+    capability: TransformerCapability;
+    transformers: UploadTransformer[];
+}): Promise<UploadTransformer[]>;
+/**
+ * The transformers that implement `capability` and declare a MIME pattern matching
+ * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,
+ * so it is safe to call before access control has been checked.
+ */
+export declare function getCandidateTransformers({ capability, mimeType, transformers, }: {
+    capability: TransformerCapability;
+    mimeType: string;
+    transformers: UploadTransformer[];
+}): UploadTransformer[];
+type TransformerCapability = 'handleRequest' | 'transformFile';
+export {};
+//# sourceMappingURL=planTransformerPipeline.d.ts.map

package/dist/uploads/transformers/planTransformerPipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planTransformerPipeline.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/planTransformerPipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAIrE;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,IAAI,EACJ,UAAU,EACV,YAAY,GACb,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAA;IACtB,UAAU,EAAE,qBAAqB,CAAA;IACjC,YAAY,EAAE,iBAAiB,EAAE,CAAA;CAClC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoB/B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,QAAQ,EACR,YAAY,GACb,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,iBAAiB,EAAE,CAAA;CAClC,GAAG,iBAAiB,EAAE,CAMtB;AAED,KAAK,qBAAqB,GAAG,eAAe,GAAG,eAAe,CAAA"}

package/dist/uploads/transformers/planTransformerPipeline.js

@@ -0,0 +1,36 @@
+import { matchesMimeType } from './matchesMimeType.js';
+/**
+ * Builds the fixed, ordered list of transformers eligible for one upload or
+ * dynamic-request operation. Pure and side-effect-free beyond invoking each
+ * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`
+ * and performs no storage or access work. A thrown/rejected `canTransform` aborts
+ * planning immediately rather than being treated as `false`.
+ */ export async function planTransformerPipeline({ args, capability, transformers }) {
+    const pipeline = [];
+    for (const transformer of getCandidateTransformers({
+        capability,
+        mimeType: args.mimeType,
+        transformers
+    })){
+        if (typeof transformer.canTransform === 'function') {
+            const isEligible = await transformer.canTransform(args);
+            if (!isEligible) {
+                continue;
+            }
+        }
+        pipeline.push(transformer);
+    }
+    return pipeline;
+}
+/**
+ * The transformers that implement `capability` and declare a MIME pattern matching
+ * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,
+ * so it is safe to call before access control has been checked.
+ */ export function getCandidateTransformers({ capability, mimeType, transformers }) {
+    return transformers.filter((transformer)=>typeof transformer[capability] === 'function' && transformer.mimeTypes.some((pattern)=>matchesMimeType({
+                mimeType,
+                pattern
+            })));
+}
+
+//# sourceMappingURL=planTransformerPipeline.js.map

package/dist/uploads/transformers/planTransformerPipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/planTransformerPipeline.ts"],"sourcesContent":["import type { CanTransformArgs, UploadTransformer } from './types.js'\n\nimport { matchesMimeType } from './matchesMimeType.js'\n\n/**\n * Builds the fixed, ordered list of transformers eligible for one upload or\n * dynamic-request operation. Pure and side-effect-free beyond invoking each\n * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`\n * and performs no storage or access work. A thrown/rejected `canTransform` aborts\n * planning immediately rather than being treated as `false`.\n */\nexport async function planTransformerPipeline({\n  args,\n  capability,\n  transformers,\n}: {\n  args: CanTransformArgs\n  capability: TransformerCapability\n  transformers: UploadTransformer[]\n}): Promise<UploadTransformer[]> {\n  const pipeline: UploadTransformer[] = []\n\n  for (const transformer of getCandidateTransformers({\n    capability,\n    mimeType: args.mimeType,\n    transformers,\n  })) {\n    if (typeof transformer.canTransform === 'function') {\n      const isEligible = await transformer.canTransform(args)\n\n      if (!isEligible) {\n        continue\n      }\n    }\n\n    pipeline.push(transformer)\n  }\n\n  return pipeline\n}\n\n/**\n * The transformers that implement `capability` and declare a MIME pattern matching\n * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,\n * so it is safe to call before access control has been checked.\n */\nexport function getCandidateTransformers({\n  capability,\n  mimeType,\n  transformers,\n}: {\n  capability: TransformerCapability\n  mimeType: string\n  transformers: UploadTransformer[]\n}): UploadTransformer[] {\n  return transformers.filter(\n    (transformer) =>\n      typeof transformer[capability] === 'function' &&\n      transformer.mimeTypes.some((pattern) => matchesMimeType({ mimeType, pattern })),\n  )\n}\n\ntype TransformerCapability = 'handleRequest' | 'transformFile'\n"],"names":["matchesMimeType","planTransformerPipeline","args","capability","transformers","pipeline","transformer","getCandidateTransformers","mimeType","canTransform","isEligible","push","filter","mimeTypes","some","pattern"],"mappings":"AAEA,SAASA,eAAe,QAAQ,uBAAsB;AAEtD;;;;;;CAMC,GACD,OAAO,eAAeC,wBAAwB,EAC5CC,IAAI,EACJC,UAAU,EACVC,YAAY,EAKb;IACC,MAAMC,WAAgC,EAAE;IAExC,KAAK,MAAMC,eAAeC,yBAAyB;QACjDJ;QACAK,UAAUN,KAAKM,QAAQ;QACvBJ;IACF,GAAI;QACF,IAAI,OAAOE,YAAYG,YAAY,KAAK,YAAY;YAClD,MAAMC,aAAa,MAAMJ,YAAYG,YAAY,CAACP;YAElD,IAAI,CAACQ,YAAY;gBACf;YACF;QACF;QAEAL,SAASM,IAAI,CAACL;IAChB;IAEA,OAAOD;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASE,yBAAyB,EACvCJ,UAAU,EACVK,QAAQ,EACRJ,YAAY,EAKb;IACC,OAAOA,aAAaQ,MAAM,CACxB,CAACN,cACC,OAAOA,WAAW,CAACH,WAAW,KAAK,cACnCG,YAAYO,SAAS,CAACC,IAAI,CAAC,CAACC,UAAYf,gBAAgB;gBAAEQ;gBAAUO;YAAQ;AAElF"}

package/dist/uploads/transformers/resolveUploadDocument.d.ts

@@ -0,0 +1,51 @@
+import type { Collection, TypeWithID } from '../../collections/config/types.js';
+import type { PayloadRequest, Where } from '../../types/index.js';
+export type ResolvedUploadDocument = {
+    filename: string;
+    mimeType: string;
+    original?: {
+        filename?: null | string;
+        mimeType?: null | string;
+    } | null;
+    variants?: Record<string, {
+        filename?: null | string;
+        mimeType?: null | string;
+    } | null>;
+} & TypeWithID;
+/**
+ * The primary filename, original filename, or a configured legacy image size's filename match.
+ * Shared with `checkFileAccess.ts` so the two lookups can't drift apart.
+ */
+export declare function buildFilenameWhere({ filename, variants, }: {
+    filename: string;
+    variants?: {
+        name: string;
+    }[];
+}): Where;
+/**
+ * The `filename` and `mimeType` of the file a request actually targets: the
+ * primary file, or the legacy image size whose filename matched (a size can be
+ * stored in a different format than the primary file via `formatOptions`).
+ */
+export declare function getRequestedFile({ document, filename, }: {
+    document: ResolvedUploadDocument;
+    filename: string;
+}): {
+    filename: string;
+    mimeType: string;
+};
+/**
+ * Finds a current upload or latest draft by filename and optional storage prefix.
+ * Always looks up the document when called: transformer planning needs its
+ * authoritative mimeType even when read access returns true. The transformer lookup
+ * is unfiltered; callers enforcing access can supply their read constraints.
+ * Older versions are resolved separately through an explicit version ID.
+ */
+export declare function resolveUploadDocument({ collection, filename, prefix, req, where, }: {
+    collection: Collection;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+    where?: Where;
+}): Promise<ResolvedUploadDocument | undefined>;
+//# sourceMappingURL=resolveUploadDocument.d.ts.map

package/dist/uploads/transformers/resolveUploadDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveUploadDocument.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/resolveUploadDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAKjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CACzF,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9B,GAAG,KAAK,CAYR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,sBAAsB,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAczC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,QAAQ,EACR,MAAM,EACN,GAAG,EACH,KAAK,GACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAsC9C"}

package/dist/uploads/transformers/resolveUploadDocument.js

@@ -0,0 +1,103 @@
+import { Forbidden } from '../../errors/Forbidden.js';
+import { appendVersionToQueryKey } from '../../versions/drafts/appendVersionToQueryKey.js';
+/**
+ * The primary filename, original filename, or a configured legacy image size's filename match.
+ * Shared with `checkFileAccess.ts` so the two lookups can't drift apart.
+ */ export function buildFilenameWhere({ filename, variants }) {
+    const filenameCondition = {
+        or: [
+            {
+                filename: {
+                    equals: filename
+                }
+            },
+            {
+                'original.filename': {
+                    equals: filename
+                }
+            }
+        ]
+    };
+    variants?.forEach(({ name })=>{
+        filenameCondition.or.push({
+            [`variants.${name}.filename`]: {
+                equals: filename
+            }
+        });
+    });
+    return filenameCondition;
+}
+/**
+ * The `filename` and `mimeType` of the file a request actually targets: the
+ * primary file, or the legacy image size whose filename matched (a size can be
+ * stored in a different format than the primary file via `formatOptions`).
+ */ export function getRequestedFile({ document, filename }) {
+    if (document.filename !== filename) {
+        if (document.original?.filename === filename && document.original.mimeType) {
+            return {
+                filename,
+                mimeType: document.original.mimeType
+            };
+        }
+        const size = Object.values(document.variants ?? {}).find((size)=>size?.filename === filename);
+        if (size?.filename && size.mimeType) {
+            return {
+                filename: size.filename,
+                mimeType: size.mimeType
+            };
+        }
+    }
+    return {
+        filename: document.filename,
+        mimeType: document.mimeType
+    };
+}
+/**
+ * Finds a current upload or latest draft by filename and optional storage prefix.
+ * Always looks up the document when called: transformer planning needs its
+ * authoritative mimeType even when read access returns true. The transformer lookup
+ * is unfiltered; callers enforcing access can supply their read constraints.
+ * Older versions are resolved separately through an explicit version ID.
+ */ export async function resolveUploadDocument({ collection, filename, prefix, req, where }) {
+    if (filename.includes('../') || filename.includes('..\\')) {
+        throw new Forbidden(req.t);
+    }
+    const { config } = collection;
+    const constraints = [
+        buildFilenameWhere({
+            filename,
+            variants: config.upload.variants
+        })
+    ];
+    if (typeof prefix === 'string') {
+        constraints.push({
+            prefix: {
+                equals: prefix
+            }
+        });
+    }
+    if (where) {
+        constraints.push(where);
+    }
+    const query = constraints.length > 1 ? {
+        and: constraints
+    } : constraints[0];
+    const doc = await req.payload.db.findOne({
+        collection: config.slug,
+        req,
+        where: query
+    });
+    if (!doc && config.versions && config.versions.drafts) {
+        const { docs } = await req.payload.db.queryDrafts({
+            collection: config.slug,
+            limit: 1,
+            pagination: true,
+            req,
+            where: appendVersionToQueryKey(query)
+        });
+        return docs[0];
+    }
+    return doc ?? undefined;
+}
+
+//# sourceMappingURL=resolveUploadDocument.js.map