payload 4.0.0-internal.ccea85d → 4.0.0-internal.cd47d20

package/dist/uploads/probeImageSize.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/probeImageSize.ts"],"sourcesContent":["import { createReadStream } from 'fs'\nimport fs from 'fs/promises'\nimport { imageDimensionsFromData, imageDimensionsFromStream } from 'image-dimensions'\n\nimport type { ProbedImageSize } from './types.js'\n\n/**\n * Image dimension probe used as a fallback when `sharp` is not configured.\n * Reads only the header bytes needed to determine width and height.\n *\n * PNG, JPEG, GIF, WebP, AVIF and HEIF/HEIC are delegated to `image-dimensions`\n * (actively maintained, zero dependencies). BMP, ICO/CUR, SVG, TIFF and JPEG\n * XL have no such maintained equivalent, so they're read here directly; each\n * of those parsers advances by a fixed amount or is bounded by an explicit\n * guard, so malformed input can never block the event loop.\n *\n * Replaces the archived `image-size` package, whose ICNS/HEIF parsers shipped\n * unpatched denial-of-service vulnerabilities (CVE-2025-71330, CVE-2025-71319).\n *\n * Two edge cases changed behavior compared to the previous hand-rolled parser:\n * - JPEG files using arithmetic coding or hierarchical encoding (SOF markers\n *   5-7, 9-11, 13-15) are no longer read; `image-dimensions` only recognizes\n *   baseline and progressive JPEG (SOF0-3). These encodings are not produced\n *   by browsers or cameras, so this is not expected to affect real uploads.\n * - AVIF/HEIF detection now checks the container's brand list instead of\n *   accepting any ISO base media file with a `ftyp` box, so non-image formats\n *   that share the same container (for example MP4/MOV) are correctly no\n *   longer misidentified as images.\n *\n * @throws if the buffer is not a recognized/parseable image format\n */\nexport function probeImageSize(data: Buffer): ProbedImageSize {\n  const modernDimensions = imageDimensionsFromData(data)\n  const dimensions = modernDimensions\n    ? { height: modernDimensions.height, width: modernDimensions.width }\n    : probeLegacyFormat(data)\n\n  if (!dimensions || !dimensions.width || !dimensions.height) {\n    throw new Error('Unsupported image type: unable to determine dimensions')\n  }\n\n  return dimensions\n}\n\n/**\n * Bytes read from the start of the file to detect a legacy/JXL format from\n * its header; comfortably covers every signature `detectLegacyType` checks.\n */\nconst HEADER_SNIFF_LENGTH = 4096\n\n/**\n * Probe used when the file lives on disk via `tempFilePath`. PNG, JPEG, GIF,\n * WebP, AVIF and HEIF/HEIC are read through `imageDimensionsFromStream`,\n * which reads only as many bytes as are needed to find the header, so a\n * large file's data is never pulled into memory. BMP, ICO/CUR, SVG, TIFF and\n * JPEG XL are detected from a small header sniff and, only then, read in\n * full for `probeImageSize` to parse.\n *\n * @throws if the file is not a recognized/parseable image format\n */\nexport async function probeImageSizeFromPath(tempFilePath: string): Promise<ProbedImageSize> {\n  const headerSniff = await readHeaderSniff(tempFilePath)\n\n  if (detectLegacyType(headerSniff)) {\n    return probeImageSize(await fs.readFile(tempFilePath))\n  }\n\n  const modernDimensions = await imageDimensionsFromStream(\n    ReadableStream.from(createReadStream(tempFilePath)),\n  )\n\n  if (modernDimensions) {\n    return { height: modernDimensions.height, width: modernDimensions.width }\n  }\n\n  return probeImageSize(await fs.readFile(tempFilePath))\n}\n\nasync function readHeaderSniff(tempFilePath: string): Promise<Buffer> {\n  const handle = await fs.open(tempFilePath, 'r')\n\n  try {\n    const buffer = Buffer.alloc(HEADER_SNIFF_LENGTH)\n    const { bytesRead } = await handle.read(buffer, 0, HEADER_SNIFF_LENGTH, 0)\n    return buffer.subarray(0, bytesRead)\n  } finally {\n    await handle.close()\n  }\n}\n\ntype Dimensions = null | ProbedImageSize\n\ntype LegacyImageType = 'bmp' | 'ico' | 'jxl' | 'svg' | 'tiff'\n\nfunction probeLegacyFormat(data: Buffer): Dimensions {\n  const type = detectLegacyType(data)\n  return type ? legacyParsers[type](data) : null\n}\n\nfunction detectLegacyType(data: Buffer): LegacyImageType | null {\n  if (data.length < 2) {\n    return null\n  }\n\n  if (data[0] === 0x42 && data[1] === 0x4d) {\n    return 'bmp'\n  }\n  if (\n    data.length >= 8 &&\n    ((data[0] === 0x49 && data[1] === 0x49 && data[2] === 0x2a) ||\n      (data[0] === 0x4d && data[1] === 0x4d && data[3] === 0x2a))\n  ) {\n    return 'tiff'\n  }\n  if (\n    data.length >= 6 &&\n    data[0] === 0 &&\n    data[1] === 0 &&\n    (data[2] === 1 || data[2] === 2) &&\n    data[3] === 0\n  ) {\n    return 'ico'\n  }\n  if ((data[0] === 0xff && data[1] === 0x0a) || isJXLContainerSignature(data)) {\n    return 'jxl'\n  }\n\n  const head = data.toString('utf8', 0, Math.min(data.length, 1000))\n  if (/<svg[\\s>]/i.test(head) || (head.trimStart().startsWith('<?xml') && /<svg/i.test(head))) {\n    return 'svg'\n  }\n\n  return null\n}\n\nconst legacyParsers: Record<LegacyImageType, (data: Buffer) => Dimensions> = {\n  bmp: (data) => ({ height: Math.abs(data.readInt32LE(22)), width: data.readInt32LE(18) }),\n  ico: (data) => {\n    const count = data.readUInt16LE(4)\n    let best: ProbedImageSize = { height: 0, width: 0 }\n\n    for (let i = 0; i < count && i < 1000; i++) {\n      const entry = 6 + i * 16\n      if (entry + 2 > data.length) {\n        break\n      }\n      // A zero byte means 256 px in the ICO format\n      const width = data[entry] === 0 ? 256 : data[entry]!\n      const height = data[entry + 1] === 0 ? 256 : data[entry + 1]!\n      if (width * height > best.width * best.height) {\n        best = { height, width }\n      }\n    }\n\n    return best.width ? best : null\n  },\n  jxl: (data) => parseJXL(data),\n  svg: (data) => parseSVG(data),\n  tiff: (data) => {\n    const isLittleEndian = data[0] === 0x49\n    const readU16 = (offset: number) =>\n      isLittleEndian ? data.readUInt16LE(offset) : data.readUInt16BE(offset)\n    const readU32 = (offset: number) =>\n      isLittleEndian ? data.readUInt32LE(offset) : data.readUInt32BE(offset)\n\n    const ifdOffset = readU32(4)\n    if (ifdOffset + 2 > data.length) {\n      return null\n    }\n\n    const entryCount = readU16(ifdOffset)\n    let width: number | undefined\n    let height: number | undefined\n\n    for (let i = 0; i < entryCount && i < 1000; i++) {\n      const entry = ifdOffset + 2 + i * 12\n      if (entry + 12 > data.length) {\n        break\n      }\n      const tag = readU16(entry)\n      const fieldType = readU16(entry + 2)\n      // SHORT (type 3) values are 16-bit, otherwise read as 32-bit LONG\n      const value = fieldType === 3 ? readU16(entry + 8) : readU32(entry + 8)\n      if (tag === 256) {\n        width = value\n      } else if (tag === 257) {\n        height = value\n      }\n    }\n\n    return width && height ? { height, width } : null\n  },\n}\n\nfunction parseSVG(data: Buffer): Dimensions {\n  const text = data.toString('utf8', 0, Math.min(data.length, 65536))\n  const tagMatch = text.match(/<svg[^>]*>/i)\n  if (!tagMatch) {\n    return null\n  }\n\n  const tag = tagMatch[0]\n  const readLength = (name: string): null | number => {\n    const match = tag.match(new RegExp(`${name}\\\\s*=\\\\s*[\"']?\\\\s*([^\"'\\\\s>]+)`, 'i'))\n    if (!match) {\n      return null\n    }\n    // Percentage units are relative and yield no concrete pixel size\n    if (/%\\s*$/.test(match[1]!)) {\n      return null\n    }\n    const value = parseFloat(match[1]!)\n    return Number.isFinite(value) ? value : null\n  }\n\n  const width = readLength('width')\n  const height = readLength('height')\n  if (width != null && height != null) {\n    return { height: Math.round(height), width: Math.round(width) }\n  }\n\n  const viewBoxMatch = tag.match(/viewbox\\s*=\\s*[\"']?\\s*([\\d.\\s,+-]+)/i)\n  if (viewBoxMatch) {\n    const parts = viewBoxMatch[1]!\n      .trim()\n      .split(/[\\s,]+/)\n      .map(Number)\n    if (parts.length === 4 && parts.every((n) => Number.isFinite(n))) {\n      const [, , viewWidth, viewHeight] = parts as [number, number, number, number]\n      if (width != null) {\n        return { height: Math.round((width / viewWidth) * viewHeight), width: Math.round(width) }\n      }\n      if (height != null) {\n        return { height: Math.round(height), width: Math.round((height / viewHeight) * viewWidth) }\n      }\n      return { height: Math.round(viewHeight), width: Math.round(viewWidth) }\n    }\n  }\n\n  return null\n}\n\n/**\n * JPEG XL isn't supported by `image-dimensions`, so its size header is read\n * directly. A JXL file is either a bare codestream starting `FF 0A`, or an\n * ISOBMFF container carrying the codestream in a single `jxlc` box or split\n * across several `jxlp` boxes; either way the dimensions live in the first\n * bits of the codestream (the `SizeHeader`). See https://www.w3.org/TR/jpeg-xl/\n * for the bitstream layout.\n */\nfunction parseJXL(data: Buffer): Dimensions {\n  if (data[0] === 0xff && data[1] === 0x0a) {\n    return parseJXLSizeHeader(data, 2)\n  }\n\n  // A boxed codestream still starts with the `FF 0A` signature, so it's\n  // skipped here too, same as the bare-codestream case above\n  const jxlcBox = findBox(data, 'jxlc', 0)\n  if (jxlcBox) {\n    return parseJXLSizeHeader(data, jxlcBox.bodyOffset + 2)\n  }\n\n  const jxlpBoxes = findAllBoxes(data, 'jxlp')\n  if (!jxlpBoxes.length) {\n    return null\n  }\n\n  // Each `jxlp` payload is prefixed with a 4-byte partial-codestream index\n  const codestream = Buffer.concat(\n    jxlpBoxes.map((box) => data.subarray(box.bodyOffset + 4, box.offset + box.size)),\n  )\n  return parseJXLSizeHeader(codestream, 2)\n}\n\nfunction isJXLContainerSignature(data: Buffer): boolean {\n  return (\n    data.length >= 12 &&\n    data.readUInt32BE(0) === 0x0000000c &&\n    data.toString('ascii', 4, 8) === 'JXL ' &&\n    data[8] === 0x0d &&\n    data[9] === 0x0a &&\n    data[10] === 0x87 &&\n    data[11] === 0x0a\n  )\n}\n\ntype Box = { bodyOffset: number; name: string; offset: number; size: number }\n\nfunction readBoxHeader(data: Buffer, offset: number): Box | null {\n  if (offset + 8 > data.length) {\n    return null\n  }\n\n  const name = data.toString('ascii', offset + 4, offset + 8)\n  let size = data.readUInt32BE(offset)\n  let bodyOffset = offset + 8\n\n  if (size === 1) {\n    // A size of 1 means a 64-bit size follows the 8-byte header\n    if (offset + 16 > data.length) {\n      return null\n    }\n    const largeSize = data.readBigUInt64BE(offset + 8)\n    if (largeSize > BigInt(Number.MAX_SAFE_INTEGER)) {\n      return null\n    }\n    size = Number(largeSize)\n    bodyOffset = offset + 16\n  } else if (size === 0) {\n    // A size of 0 means the box extends to the end of the buffer\n    size = data.length - offset\n  }\n\n  if (size < bodyOffset - offset || offset + size > data.length) {\n    return null\n  }\n\n  return { name, bodyOffset, offset, size }\n}\n\n// Bounded to the same 1000-entry cap used elsewhere in this file so a\n// malformed chain of boxes can never block the event loop\nfunction findBox(data: Buffer, name: string, startOffset: number): Box | null {\n  let offset = startOffset\n\n  for (let i = 0; i < 1000 && offset < data.length; i++) {\n    const box = readBoxHeader(data, offset)\n    if (!box) {\n      return null\n    }\n    if (box.name === name) {\n      return box\n    }\n    offset += box.size\n  }\n\n  return null\n}\n\nfunction findAllBoxes(data: Buffer, name: string): Box[] {\n  const boxes: Box[] = []\n  let offset = 0\n\n  for (let i = 0; i < 1000 && offset < data.length; i++) {\n    const box = readBoxHeader(data, offset)\n    if (!box) {\n      break\n    }\n    if (box.name === name) {\n      boxes.push(box)\n    }\n    offset += box.size\n  }\n\n  return boxes\n}\n\n/**\n * Reads the JXL `SizeHeader` bit-packed structure (little-endian, LSB\n * first) starting at `startOffset` in the codestream.\n */\nfunction parseJXLSizeHeader(data: Buffer, startOffset: number): Dimensions {\n  let byteOffset = startOffset\n  let bitOffset = 0\n\n  const readBits = (length: number): number => {\n    let result = 0\n    let bitsRead = 0\n\n    while (bitsRead < length) {\n      if (byteOffset >= data.length) {\n        throw new RangeError('Unexpected end of JXL codestream')\n      }\n      const currentByte = data[byteOffset]!\n      const bitsLeft = 8 - bitOffset\n      const bitsToRead = Math.min(length - bitsRead, bitsLeft)\n      const mask = (1 << bitsToRead) - 1\n      result |= ((currentByte >> bitOffset) & mask) << bitsRead\n\n      bitsRead += bitsToRead\n      bitOffset += bitsToRead\n      if (bitOffset === 8) {\n        byteOffset++\n        bitOffset = 0\n      }\n    }\n\n    return result\n  }\n\n  const readExplicitDimension = (): number => {\n    const sizeClass = readBits(2)\n    const extraBits = [9, 13, 18, 30][sizeClass]!\n    return 1 + readBits(extraBits)\n  }\n\n  try {\n    const isSmallImage = readBits(1) === 1\n    const height = isSmallImage ? 8 * (1 + readBits(5)) : readExplicitDimension()\n    const widthMode = readBits(3)\n\n    let width: number\n    if (isSmallImage && widthMode === 0) {\n      width = 8 * (1 + readBits(5))\n    } else if (widthMode === 0) {\n      width = readExplicitDimension()\n    } else {\n      const aspectRatios = [1, 1.2, 4 / 3, 1.5, 16 / 9, 5 / 4, 2]\n      width = Math.floor(height * aspectRatios[widthMode - 1]!)\n    }\n\n    return { height, width }\n  } catch {\n    return null\n  }\n}\n"],"names":["createReadStream","fs","imageDimensionsFromData","imageDimensionsFromStream","probeImageSize","data","modernDimensions","dimensions","height","width","probeLegacyFormat","Error","HEADER_SNIFF_LENGTH","probeImageSizeFromPath","tempFilePath","headerSniff","readHeaderSniff","detectLegacyType","readFile","ReadableStream","from","handle","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","type","legacyParsers","length","isJXLContainerSignature","head","toString","Math","min","test","trimStart","startsWith","bmp","abs","readInt32LE","ico","count","readUInt16LE","best","i","entry","jxl","parseJXL","svg","parseSVG","tiff","isLittleEndian","readU16","offset","readUInt16BE","readU32","readUInt32LE","readUInt32BE","ifdOffset","entryCount","tag","fieldType","value","text","tagMatch","match","readLength","name","RegExp","parseFloat","Number","isFinite","round","viewBoxMatch","parts","trim","split","map","every","n","viewWidth","viewHeight","parseJXLSizeHeader","jxlcBox","findBox","bodyOffset","jxlpBoxes","findAllBoxes","codestream","concat","box","size","readBoxHeader","largeSize","readBigUInt64BE","BigInt","MAX_SAFE_INTEGER","startOffset","boxes","push","byteOffset","bitOffset","readBits","result","bitsRead","RangeError","currentByte","bitsLeft","bitsToRead","mask","readExplicitDimension","sizeClass","extraBits","isSmallImage","widthMode","aspectRatios","floor"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,KAAI;AACrC,OAAOC,QAAQ,cAAa;AAC5B,SAASC,uBAAuB,EAAEC,yBAAyB,QAAQ,mBAAkB;AAIrF;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,SAASC,eAAeC,IAAY;IACzC,MAAMC,mBAAmBJ,wBAAwBG;IACjD,MAAME,aAAaD,mBACf;QAAEE,QAAQF,iBAAiBE,MAAM;QAAEC,OAAOH,iBAAiBG,KAAK;IAAC,IACjEC,kBAAkBL;IAEtB,IAAI,CAACE,cAAc,CAACA,WAAWE,KAAK,IAAI,CAACF,WAAWC,MAAM,EAAE;QAC1D,MAAM,IAAIG,MAAM;IAClB;IAEA,OAAOJ;AACT;AAEA;;;CAGC,GACD,MAAMK,sBAAsB;AAE5B;;;;;;;;;CASC,GACD,OAAO,eAAeC,uBAAuBC,YAAoB;IAC/D,MAAMC,cAAc,MAAMC,gBAAgBF;IAE1C,IAAIG,iBAAiBF,cAAc;QACjC,OAAOX,eAAe,MAAMH,GAAGiB,QAAQ,CAACJ;IAC1C;IAEA,MAAMR,mBAAmB,MAAMH,0BAC7BgB,eAAeC,IAAI,CAACpB,iBAAiBc;IAGvC,IAAIR,kBAAkB;QACpB,OAAO;YAAEE,QAAQF,iBAAiBE,MAAM;YAAEC,OAAOH,iBAAiBG,KAAK;QAAC;IAC1E;IAEA,OAAOL,eAAe,MAAMH,GAAGiB,QAAQ,CAACJ;AAC1C;AAEA,eAAeE,gBAAgBF,YAAoB;IACjD,MAAMO,SAAS,MAAMpB,GAAGqB,IAAI,CAACR,cAAc;IAE3C,IAAI;QACF,MAAMS,SAASC,OAAOC,KAAK,CAACb;QAC5B,MAAM,EAAEc,SAAS,EAAE,GAAG,MAAML,OAAOM,IAAI,CAACJ,QAAQ,GAAGX,qBAAqB;QACxE,OAAOW,OAAOK,QAAQ,CAAC,GAAGF;IAC5B,SAAU;QACR,MAAML,OAAOQ,KAAK;IACpB;AACF;AAMA,SAASnB,kBAAkBL,IAAY;IACrC,MAAMyB,OAAOb,iBAAiBZ;IAC9B,OAAOyB,OAAOC,aAAa,CAACD,KAAK,CAACzB,QAAQ;AAC5C;AAEA,SAASY,iBAAiBZ,IAAY;IACpC,IAAIA,KAAK2B,MAAM,GAAG,GAAG;QACnB,OAAO;IACT;IAEA,IAAI3B,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,MAAM;QACxC,OAAO;IACT;IACA,IACEA,KAAK2B,MAAM,IAAI,KACd,CAAA,AAAC3B,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,QACnDA,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,IAAI,GAC3D;QACA,OAAO;IACT;IACA,IACEA,KAAK2B,MAAM,IAAI,KACf3B,IAAI,CAAC,EAAE,KAAK,KACZA,IAAI,CAAC,EAAE,KAAK,KACXA,CAAAA,IAAI,CAAC,EAAE,KAAK,KAAKA,IAAI,CAAC,EAAE,KAAK,CAAA,KAC9BA,IAAI,CAAC,EAAE,KAAK,GACZ;QACA,OAAO;IACT;IACA,IAAI,AAACA,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,QAAS4B,wBAAwB5B,OAAO;QAC3E,OAAO;IACT;IAEA,MAAM6B,OAAO7B,KAAK8B,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAAChC,KAAK2B,MAAM,EAAE;IAC5D,IAAI,aAAaM,IAAI,CAACJ,SAAUA,KAAKK,SAAS,GAAGC,UAAU,CAAC,YAAY,QAAQF,IAAI,CAACJ,OAAQ;QAC3F,OAAO;IACT;IAEA,OAAO;AACT;AAEA,MAAMH,gBAAuE;IAC3EU,KAAK,CAACpC,OAAU,CAAA;YAAEG,QAAQ4B,KAAKM,GAAG,CAACrC,KAAKsC,WAAW,CAAC;YAAMlC,OAAOJ,KAAKsC,WAAW,CAAC;QAAI,CAAA;IACtFC,KAAK,CAACvC;QACJ,MAAMwC,QAAQxC,KAAKyC,YAAY,CAAC;QAChC,IAAIC,OAAwB;YAAEvC,QAAQ;YAAGC,OAAO;QAAE;QAElD,IAAK,IAAIuC,IAAI,GAAGA,IAAIH,SAASG,IAAI,MAAMA,IAAK;YAC1C,MAAMC,QAAQ,IAAID,IAAI;YACtB,IAAIC,QAAQ,IAAI5C,KAAK2B,MAAM,EAAE;gBAC3B;YACF;YACA,6CAA6C;YAC7C,MAAMvB,QAAQJ,IAAI,CAAC4C,MAAM,KAAK,IAAI,MAAM5C,IAAI,CAAC4C,MAAM;YACnD,MAAMzC,SAASH,IAAI,CAAC4C,QAAQ,EAAE,KAAK,IAAI,MAAM5C,IAAI,CAAC4C,QAAQ,EAAE;YAC5D,IAAIxC,QAAQD,SAASuC,KAAKtC,KAAK,GAAGsC,KAAKvC,MAAM,EAAE;gBAC7CuC,OAAO;oBAAEvC;oBAAQC;gBAAM;YACzB;QACF;QAEA,OAAOsC,KAAKtC,KAAK,GAAGsC,OAAO;IAC7B;IACAG,KAAK,CAAC7C,OAAS8C,SAAS9C;IACxB+C,KAAK,CAAC/C,OAASgD,SAAShD;IACxBiD,MAAM,CAACjD;QACL,MAAMkD,iBAAiBlD,IAAI,CAAC,EAAE,KAAK;QACnC,MAAMmD,UAAU,CAACC,SACfF,iBAAiBlD,KAAKyC,YAAY,CAACW,UAAUpD,KAAKqD,YAAY,CAACD;QACjE,MAAME,UAAU,CAACF,SACfF,iBAAiBlD,KAAKuD,YAAY,CAACH,UAAUpD,KAAKwD,YAAY,CAACJ;QAEjE,MAAMK,YAAYH,QAAQ;QAC1B,IAAIG,YAAY,IAAIzD,KAAK2B,MAAM,EAAE;YAC/B,OAAO;QACT;QAEA,MAAM+B,aAAaP,QAAQM;QAC3B,IAAIrD;QACJ,IAAID;QAEJ,IAAK,IAAIwC,IAAI,GAAGA,IAAIe,cAAcf,IAAI,MAAMA,IAAK;YAC/C,MAAMC,QAAQa,YAAY,IAAId,IAAI;YAClC,IAAIC,QAAQ,KAAK5C,KAAK2B,MAAM,EAAE;gBAC5B;YACF;YACA,MAAMgC,MAAMR,QAAQP;YACpB,MAAMgB,YAAYT,QAAQP,QAAQ;YAClC,kEAAkE;YAClE,MAAMiB,QAAQD,cAAc,IAAIT,QAAQP,QAAQ,KAAKU,QAAQV,QAAQ;YACrE,IAAIe,QAAQ,KAAK;gBACfvD,QAAQyD;YACV,OAAO,IAAIF,QAAQ,KAAK;gBACtBxD,SAAS0D;YACX;QACF;QAEA,OAAOzD,SAASD,SAAS;YAAEA;YAAQC;QAAM,IAAI;IAC/C;AACF;AAEA,SAAS4C,SAAShD,IAAY;IAC5B,MAAM8D,OAAO9D,KAAK8B,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAAChC,KAAK2B,MAAM,EAAE;IAC5D,MAAMoC,WAAWD,KAAKE,KAAK,CAAC;IAC5B,IAAI,CAACD,UAAU;QACb,OAAO;IACT;IAEA,MAAMJ,MAAMI,QAAQ,CAAC,EAAE;IACvB,MAAME,aAAa,CAACC;QAClB,MAAMF,QAAQL,IAAIK,KAAK,CAAC,IAAIG,OAAO,GAAGD,KAAK,8BAA8B,CAAC,EAAE;QAC5E,IAAI,CAACF,OAAO;YACV,OAAO;QACT;QACA,iEAAiE;QACjE,IAAI,QAAQ/B,IAAI,CAAC+B,KAAK,CAAC,EAAE,GAAI;YAC3B,OAAO;QACT;QACA,MAAMH,QAAQO,WAAWJ,KAAK,CAAC,EAAE;QACjC,OAAOK,OAAOC,QAAQ,CAACT,SAASA,QAAQ;IAC1C;IAEA,MAAMzD,QAAQ6D,WAAW;IACzB,MAAM9D,SAAS8D,WAAW;IAC1B,IAAI7D,SAAS,QAAQD,UAAU,MAAM;QACnC,OAAO;YAAEA,QAAQ4B,KAAKwC,KAAK,CAACpE;YAASC,OAAO2B,KAAKwC,KAAK,CAACnE;QAAO;IAChE;IAEA,MAAMoE,eAAeb,IAAIK,KAAK,CAAC;IAC/B,IAAIQ,cAAc;QAChB,MAAMC,QAAQD,YAAY,CAAC,EAAE,CAC1BE,IAAI,GACJC,KAAK,CAAC,UACNC,GAAG,CAACP;QACP,IAAII,MAAM9C,MAAM,KAAK,KAAK8C,MAAMI,KAAK,CAAC,CAACC,IAAMT,OAAOC,QAAQ,CAACQ,KAAK;YAChE,MAAM,KAAKC,WAAWC,WAAW,GAAGP;YACpC,IAAIrE,SAAS,MAAM;gBACjB,OAAO;oBAAED,QAAQ4B,KAAKwC,KAAK,CAAC,AAACnE,QAAQ2E,YAAaC;oBAAa5E,OAAO2B,KAAKwC,KAAK,CAACnE;gBAAO;YAC1F;YACA,IAAID,UAAU,MAAM;gBAClB,OAAO;oBAAEA,QAAQ4B,KAAKwC,KAAK,CAACpE;oBAASC,OAAO2B,KAAKwC,KAAK,CAAC,AAACpE,SAAS6E,aAAcD;gBAAW;YAC5F;YACA,OAAO;gBAAE5E,QAAQ4B,KAAKwC,KAAK,CAACS;gBAAa5E,OAAO2B,KAAKwC,KAAK,CAACQ;YAAW;QACxE;IACF;IAEA,OAAO;AACT;AAEA;;;;;;;CAOC,GACD,SAASjC,SAAS9C,IAAY;IAC5B,IAAIA,IAAI,CAAC,EAAE,KAAK,QAAQA,IAAI,CAAC,EAAE,KAAK,MAAM;QACxC,OAAOiF,mBAAmBjF,MAAM;IAClC;IAEA,sEAAsE;IACtE,2DAA2D;IAC3D,MAAMkF,UAAUC,QAAQnF,MAAM,QAAQ;IACtC,IAAIkF,SAAS;QACX,OAAOD,mBAAmBjF,MAAMkF,QAAQE,UAAU,GAAG;IACvD;IAEA,MAAMC,YAAYC,aAAatF,MAAM;IACrC,IAAI,CAACqF,UAAU1D,MAAM,EAAE;QACrB,OAAO;IACT;IAEA,yEAAyE;IACzE,MAAM4D,aAAapE,OAAOqE,MAAM,CAC9BH,UAAUT,GAAG,CAAC,CAACa,MAAQzF,KAAKuB,QAAQ,CAACkE,IAAIL,UAAU,GAAG,GAAGK,IAAIrC,MAAM,GAAGqC,IAAIC,IAAI;IAEhF,OAAOT,mBAAmBM,YAAY;AACxC;AAEA,SAAS3D,wBAAwB5B,IAAY;IAC3C,OACEA,KAAK2B,MAAM,IAAI,MACf3B,KAAKwD,YAAY,CAAC,OAAO,cACzBxD,KAAK8B,QAAQ,CAAC,SAAS,GAAG,OAAO,UACjC9B,IAAI,CAAC,EAAE,KAAK,QACZA,IAAI,CAAC,EAAE,KAAK,QACZA,IAAI,CAAC,GAAG,KAAK,QACbA,IAAI,CAAC,GAAG,KAAK;AAEjB;AAIA,SAAS2F,cAAc3F,IAAY,EAAEoD,MAAc;IACjD,IAAIA,SAAS,IAAIpD,KAAK2B,MAAM,EAAE;QAC5B,OAAO;IACT;IAEA,MAAMuC,OAAOlE,KAAK8B,QAAQ,CAAC,SAASsB,SAAS,GAAGA,SAAS;IACzD,IAAIsC,OAAO1F,KAAKwD,YAAY,CAACJ;IAC7B,IAAIgC,aAAahC,SAAS;IAE1B,IAAIsC,SAAS,GAAG;QACd,4DAA4D;QAC5D,IAAItC,SAAS,KAAKpD,KAAK2B,MAAM,EAAE;YAC7B,OAAO;QACT;QACA,MAAMiE,YAAY5F,KAAK6F,eAAe,CAACzC,SAAS;QAChD,IAAIwC,YAAYE,OAAOzB,OAAO0B,gBAAgB,GAAG;YAC/C,OAAO;QACT;QACAL,OAAOrB,OAAOuB;QACdR,aAAahC,SAAS;IACxB,OAAO,IAAIsC,SAAS,GAAG;QACrB,6DAA6D;QAC7DA,OAAO1F,KAAK2B,MAAM,GAAGyB;IACvB;IAEA,IAAIsC,OAAON,aAAahC,UAAUA,SAASsC,OAAO1F,KAAK2B,MAAM,EAAE;QAC7D,OAAO;IACT;IAEA,OAAO;QAAEuC;QAAMkB;QAAYhC;QAAQsC;IAAK;AAC1C;AAEA,sEAAsE;AACtE,0DAA0D;AAC1D,SAASP,QAAQnF,IAAY,EAAEkE,IAAY,EAAE8B,WAAmB;IAC9D,IAAI5C,SAAS4C;IAEb,IAAK,IAAIrD,IAAI,GAAGA,IAAI,QAAQS,SAASpD,KAAK2B,MAAM,EAAEgB,IAAK;QACrD,MAAM8C,MAAME,cAAc3F,MAAMoD;QAChC,IAAI,CAACqC,KAAK;YACR,OAAO;QACT;QACA,IAAIA,IAAIvB,IAAI,KAAKA,MAAM;YACrB,OAAOuB;QACT;QACArC,UAAUqC,IAAIC,IAAI;IACpB;IAEA,OAAO;AACT;AAEA,SAASJ,aAAatF,IAAY,EAAEkE,IAAY;IAC9C,MAAM+B,QAAe,EAAE;IACvB,IAAI7C,SAAS;IAEb,IAAK,IAAIT,IAAI,GAAGA,IAAI,QAAQS,SAASpD,KAAK2B,MAAM,EAAEgB,IAAK;QACrD,MAAM8C,MAAME,cAAc3F,MAAMoD;QAChC,IAAI,CAACqC,KAAK;YACR;QACF;QACA,IAAIA,IAAIvB,IAAI,KAAKA,MAAM;YACrB+B,MAAMC,IAAI,CAACT;QACb;QACArC,UAAUqC,IAAIC,IAAI;IACpB;IAEA,OAAOO;AACT;AAEA;;;CAGC,GACD,SAAShB,mBAAmBjF,IAAY,EAAEgG,WAAmB;IAC3D,IAAIG,aAAaH;IACjB,IAAII,YAAY;IAEhB,MAAMC,WAAW,CAAC1E;QAChB,IAAI2E,SAAS;QACb,IAAIC,WAAW;QAEf,MAAOA,WAAW5E,OAAQ;YACxB,IAAIwE,cAAcnG,KAAK2B,MAAM,EAAE;gBAC7B,MAAM,IAAI6E,WAAW;YACvB;YACA,MAAMC,cAAczG,IAAI,CAACmG,WAAW;YACpC,MAAMO,WAAW,IAAIN;YACrB,MAAMO,aAAa5E,KAAKC,GAAG,CAACL,SAAS4E,UAAUG;YAC/C,MAAME,OAAO,AAAC,CAAA,KAAKD,UAAS,IAAK;YACjCL,UAAU,AAAC,CAAA,AAACG,eAAeL,YAAaQ,IAAG,KAAML;YAEjDA,YAAYI;YACZP,aAAaO;YACb,IAAIP,cAAc,GAAG;gBACnBD;gBACAC,YAAY;YACd;QACF;QAEA,OAAOE;IACT;IAEA,MAAMO,wBAAwB;QAC5B,MAAMC,YAAYT,SAAS;QAC3B,MAAMU,YAAY;YAAC;YAAG;YAAI;YAAI;SAAG,CAACD,UAAU;QAC5C,OAAO,IAAIT,SAASU;IACtB;IAEA,IAAI;QACF,MAAMC,eAAeX,SAAS,OAAO;QACrC,MAAMlG,SAAS6G,eAAe,IAAK,CAAA,IAAIX,SAAS,EAAC,IAAKQ;QACtD,MAAMI,YAAYZ,SAAS;QAE3B,IAAIjG;QACJ,IAAI4G,gBAAgBC,cAAc,GAAG;YACnC7G,QAAQ,IAAK,CAAA,IAAIiG,SAAS,EAAC;QAC7B,OAAO,IAAIY,cAAc,GAAG;YAC1B7G,QAAQyG;QACV,OAAO;YACL,MAAMK,eAAe;gBAAC;gBAAG;gBAAK,IAAI;gBAAG;gBAAK,KAAK;gBAAG,IAAI;gBAAG;aAAE;YAC3D9G,QAAQ2B,KAAKoF,KAAK,CAAChH,SAAS+G,YAAY,CAACD,YAAY,EAAE;QACzD;QAEA,OAAO;YAAE9G;YAAQC;QAAM;IACzB,EAAE,OAAM;QACN,OAAO;IACT;AACF"}

package/dist/uploads/resolveURLUploadInput.d.ts

@@ -0,0 +1,25 @@
+import * as z from 'zod/mini';
+import type { CollectionSlug } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { File } from './types.js';
+export declare const externalURLInputSchema: z.ZodMiniObject<{
+    name: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    source: z.ZodMiniLiteral<"externalURL">;
+    url: z.ZodMiniURL;
+}, z.core.$strict>;
+export type ExternalURLInput = z.infer<typeof externalURLInputSchema>;
+/**
+ * Resolves caller-supplied URL upload input, not existing files being resized or copied.
+ *
+ * For example, `{ source: 'externalURL', url: 'https://example.com/image.png' }`
+ * becomes a Payload `File` after applying `pasteURL`, allow-list, and size restrictions.
+ * Remote callers require an explicit allow-list; the trusted local CLI can opt out.
+ * Operation-specific access checks belong to the caller and the subsequent Payload operation.
+ */
+export declare const resolveURLUploadInput: ({ slug, input, req, requireAllowList, }: {
+    input: ExternalURLInput;
+    req: PayloadRequest;
+    requireAllowList?: boolean;
+    slug: CollectionSlug;
+}) => Promise<File>;
+//# sourceMappingURL=resolveURLUploadInput.d.ts.map

package/dist/uploads/resolveURLUploadInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveURLUploadInput.d.ts","sourceRoot":"","sources":["../../src/uploads/resolveURLUploadInput.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAOtC,eAAO,MAAM,sBAAsB;;;;kBAIjC,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,4CAK/B;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,IAAI,EAAE,cAAc,CAAA;CACrB,KAAG,OAAO,CAAC,IAAI,CA0Bf,CAAA"}

package/dist/uploads/resolveURLUploadInput.js

@@ -0,0 +1,53 @@
+import * as z from 'zod/mini';
+import { APIError } from '../errors/index.js';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+import { downloadFileToBuffer } from './downloadFileToBuffer.js';
+import { validateUploadURL } from './validateUploadURL.js';
+export const externalURLInputSchema = z.strictObject({
+    name: z.optional(z.string().check(z.minLength(1))).check(z.describe('File name override.')),
+    source: z.literal('externalURL'),
+    url: z.url().check(z.describe('The http or https URL to download.'))
+});
+/**
+ * Resolves caller-supplied URL upload input, not existing files being resized or copied.
+ *
+ * For example, `{ source: 'externalURL', url: 'https://example.com/image.png' }`
+ * becomes a Payload `File` after applying `pasteURL`, allow-list, and size restrictions.
+ * Remote callers require an explicit allow-list; the trusted local CLI can opt out.
+ * Operation-specific access checks belong to the caller and the subsequent Payload operation.
+ */ export const resolveURLUploadInput = async ({ slug, input, req, requireAllowList = true })=>{
+    const uploadConfig = req.payload.collections[slug]?.config.upload;
+    const url = validateUploadURL({
+        requireAllowList,
+        uploadConfig,
+        url: input.url
+    });
+    const file = await downloadFileToBuffer({
+        data: {
+            filename: sanitizeFilename(input.name || getURLFilename(url)),
+            url: url.href
+        },
+        req,
+        uploadConfig: {
+            ...uploadConfig,
+            externalFileHeaderFilter: uploadConfig?.externalFileHeaderFilter ?? (()=>({}))
+        }
+    });
+    file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream';
+    file.size = file.data.length;
+    const maxFileSize = req.payload.config.upload.limits?.fileSize;
+    if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
+        throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400);
+    }
+    return file;
+};
+const getURLFilename = (url)=>{
+    const pathSegment = url.pathname.split('/').pop() || 'upload';
+    try {
+        return decodeURIComponent(pathSegment);
+    } catch  {
+        return pathSegment;
+    }
+};
+
+//# sourceMappingURL=resolveURLUploadInput.js.map

package/dist/uploads/resolveURLUploadInput.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/resolveURLUploadInput.ts"],"sourcesContent":["import * as z from 'zod/mini'\n\nimport type { CollectionSlug } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\nimport { downloadFileToBuffer } from './downloadFileToBuffer.js'\nimport { validateUploadURL } from './validateUploadURL.js'\n\nexport const externalURLInputSchema = z.strictObject({\n  name: z.optional(z.string().check(z.minLength(1))).check(z.describe('File name override.')),\n  source: z.literal('externalURL'),\n  url: z.url().check(z.describe('The http or https URL to download.')),\n})\n\nexport type ExternalURLInput = z.infer<typeof externalURLInputSchema>\n\n/**\n * Resolves caller-supplied URL upload input, not existing files being resized or copied.\n *\n * For example, `{ source: 'externalURL', url: 'https://example.com/image.png' }`\n * becomes a Payload `File` after applying `pasteURL`, allow-list, and size restrictions.\n * Remote callers require an explicit allow-list; the trusted local CLI can opt out.\n * Operation-specific access checks belong to the caller and the subsequent Payload operation.\n */\nexport const resolveURLUploadInput = async ({\n  slug,\n  input,\n  req,\n  requireAllowList = true,\n}: {\n  input: ExternalURLInput\n  req: PayloadRequest\n  requireAllowList?: boolean\n  slug: CollectionSlug\n}): Promise<File> => {\n  const uploadConfig = req.payload.collections[slug]?.config.upload\n  const url = validateUploadURL({ requireAllowList, uploadConfig, url: input.url })\n\n  const file = await downloadFileToBuffer({\n    data: {\n      filename: sanitizeFilename(input.name || getURLFilename(url)),\n      url: url.href,\n    },\n    req,\n    uploadConfig: {\n      ...uploadConfig,\n      externalFileHeaderFilter: uploadConfig?.externalFileHeaderFilter ?? (() => ({})),\n    },\n  })\n\n  file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'\n  file.size = file.data.length\n\n  const maxFileSize = req.payload.config.upload.limits?.fileSize\n\n  if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {\n    throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400)\n  }\n\n  return file\n}\n\nconst getURLFilename = (url: URL): string => {\n  const pathSegment = url.pathname.split('/').pop() || 'upload'\n\n  try {\n    return decodeURIComponent(pathSegment)\n  } catch {\n    return pathSegment\n  }\n}\n"],"names":["z","APIError","sanitizeFilename","downloadFileToBuffer","validateUploadURL","externalURLInputSchema","strictObject","name","optional","string","check","minLength","describe","source","literal","url","resolveURLUploadInput","slug","input","req","requireAllowList","uploadConfig","payload","collections","config","upload","file","data","filename","getURLFilename","href","externalFileHeaderFilter","mimetype","split","size","length","maxFileSize","limits","fileSize","undefined","Number","isFinite","pathSegment","pathname","pop","decodeURIComponent"],"mappings":"AAAA,YAAYA,OAAO,WAAU;AAM7B,SAASC,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,iBAAiB,QAAQ,yBAAwB;AAE1D,OAAO,MAAMC,yBAAyBL,EAAEM,YAAY,CAAC;IACnDC,MAAMP,EAAEQ,QAAQ,CAACR,EAAES,MAAM,GAAGC,KAAK,CAACV,EAAEW,SAAS,CAAC,KAAKD,KAAK,CAACV,EAAEY,QAAQ,CAAC;IACpEC,QAAQb,EAAEc,OAAO,CAAC;IAClBC,KAAKf,EAAEe,GAAG,GAAGL,KAAK,CAACV,EAAEY,QAAQ,CAAC;AAChC,GAAE;AAIF;;;;;;;CAOC,GACD,OAAO,MAAMI,wBAAwB,OAAO,EAC1CC,IAAI,EACJC,KAAK,EACLC,GAAG,EACHC,mBAAmB,IAAI,EAMxB;IACC,MAAMC,eAAeF,IAAIG,OAAO,CAACC,WAAW,CAACN,KAAK,EAAEO,OAAOC;IAC3D,MAAMV,MAAMX,kBAAkB;QAAEgB;QAAkBC;QAAcN,KAAKG,MAAMH,GAAG;IAAC;IAE/E,MAAMW,OAAO,MAAMvB,qBAAqB;QACtCwB,MAAM;YACJC,UAAU1B,iBAAiBgB,MAAMX,IAAI,IAAIsB,eAAed;YACxDA,KAAKA,IAAIe,IAAI;QACf;QACAX;QACAE,cAAc;YACZ,GAAGA,YAAY;YACfU,0BAA0BV,cAAcU,4BAA6B,CAAA,IAAO,CAAA,CAAC,CAAA,CAAC;QAChF;IACF;IAEAL,KAAKM,QAAQ,GAAGN,KAAKM,QAAQ,EAAEC,MAAM,IAAI,CAAC,EAAE,IAAI;IAChDP,KAAKQ,IAAI,GAAGR,KAAKC,IAAI,CAACQ,MAAM;IAE5B,MAAMC,cAAcjB,IAAIG,OAAO,CAACE,MAAM,CAACC,MAAM,CAACY,MAAM,EAAEC;IAEtD,IAAIF,gBAAgBG,aAAaC,OAAOC,QAAQ,CAACL,gBAAgBV,KAAKQ,IAAI,GAAGE,aAAa;QACxF,MAAM,IAAInC,SAAS,CAAC,iBAAiB,EAAEmC,YAAY,mBAAmB,CAAC,EAAE;IAC3E;IAEA,OAAOV;AACT,EAAC;AAED,MAAMG,iBAAiB,CAACd;IACtB,MAAM2B,cAAc3B,IAAI4B,QAAQ,CAACV,KAAK,CAAC,KAAKW,GAAG,MAAM;IAErD,IAAI;QACF,OAAOC,mBAAmBH;IAC5B,EAAE,OAAM;QACN,OAAOA;IACT;AACF"}

package/dist/uploads/safeFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeFetch.d.ts","sourceRoot":"","sources":["../../src/uploads/safeFetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpD;;GAEG;AACH,eAAO,MAAM,yBAAyB;;CAErC,CAAA;AAsDD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAmB,UAAU,CAAC,OAAO,WAAW,CAAC,KAAG,OAAO,CAAC,QAAQ,CA4CzF,CAAA"}
+{"version":3,"file":"safeFetch.d.ts","sourceRoot":"","sources":["../../src/uploads/safeFetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpD;;GAEG;AACH,eAAO,MAAM,yBAAyB;;CAErC,CAAA;AA6DD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAmB,UAAU,CAAC,OAAO,WAAW,CAAC,KAAG,OAAO,CAAC,QAAQ,CA4CzF,CAAA"}

package/dist/uploads/safeFetch.js

@@ -6,6 +6,7 @@ import { Agent, fetch as undiciFetch } from 'undici';
  */ export const _internal_safeFetchGlobal = {
     lookup
 };
+const buildBlockedFetchError = (hostname)=>new Error(`Blocked unsafe attempt to ${hostname}. This host resolves to a private or internal address. ` + `If this is a trusted destination, allowlist it via the upload collection's "skipSafeFetch" option ` + `(https://payloadcms.com/docs/upload/overview#skip-safe-fetch).`);
 const isSafeIp = (ip)=>{
     try {
         if (!ip) {
@@ -39,7 +40,7 @@ const ssrfFilterInterceptor = (hostname, options, callback)=>{
                 ];
             }
             if (ips.some((ip)=>!isSafeIp(ip))) {
-                callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family);
+                callback(buildBlockedFetchError(hostname), address, family);
                 return;
             }
             callback(null, address, family);
@@ -74,7 +75,7 @@ const getSafeDispatcher = ()=>{
         }
         if (ipaddr.isValid(hostname)) {
             if (!isSafeIp(hostname)) {
-                throw new Error(`Blocked unsafe attempt to ${hostname}`);
+                throw buildBlockedFetchError(hostname);
             }
         }
         return await undiciFetch(url, {

package/dist/uploads/safeFetch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nlet safeDispatcher: Agent | undefined\n\nconst getSafeDispatcher = (): Agent => {\n  if (!safeDispatcher) {\n    safeDispatcher = new Agent({ connect: { lookup: ssrfFilterInterceptor } })\n  }\n  return safeDispatcher\n}\n\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw new Error(`Blocked unsafe attempt to ${hostname}`)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: getSafeDispatcher(),\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","hostname","options","callback","err","address","family","ips","Array","isArray","map","a","some","Error","safeDispatcher","getSafeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACN,OAAOO,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBR,OAAOS,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACC,UAAUC,SAASC;IAChEX,0BAA0BL,MAAM,CAACc,UAAUC,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAAClB,KAAO,CAACD,SAASC,MAAM;gBACnCS,SAAS,IAAIU,MAAM,CAAC,0BAA0B,EAAEZ,UAAU,GAAGI,SAASC;gBACtE;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,IAAIQ;AAEJ,MAAMC,oBAAoB;IACxB,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,IAAIzB,MAAM;YAAE2B,SAAS;gBAAE7B,QAAQa;YAAsB;QAAE;IAC1E;IACA,OAAOc;AACT;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAejB,QAAQ,GAAGgB;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAIlB,WAAWmB,IAAInB,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAASqB,UAAU,CAAC,QAAQrB,SAASsB,QAAQ,CAAC,MAAM;YACtDtB,WAAWA,SAASuB,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAIpC,OAAOO,OAAO,CAACM,WAAW;YAC5B,IAAI,CAACR,SAASQ,WAAW;gBACvB,MAAM,IAAIY,MAAM,CAAC,0BAA0B,EAAEZ,UAAU;YACzD;QACF;QACA,OAAQ,MAAMV,YAAY6B,KAAK;YAC7B,GAAGlB,OAAO;YACVuB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBd,OAAO;YAC1B,IAAIc,MAAMC,KAAK,YAAYf,SAASc,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIjB,MAAMc,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAIP,MAAM,CAAC,qBAAqB,EAAEkB,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst buildBlockedFetchError = (hostname: string): Error =>\n  new Error(\n    `Blocked unsafe attempt to ${hostname}. This host resolves to a private or internal address. ` +\n      `If this is a trusted destination, allowlist it via the upload collection's \"skipSafeFetch\" option ` +\n      `(https://payloadcms.com/docs/upload/overview#skip-safe-fetch).`,\n  )\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(buildBlockedFetchError(hostname), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nlet safeDispatcher: Agent | undefined\n\nconst getSafeDispatcher = (): Agent => {\n  if (!safeDispatcher) {\n    safeDispatcher = new Agent({ connect: { lookup: ssrfFilterInterceptor } })\n  }\n  return safeDispatcher\n}\n\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw buildBlockedFetchError(hostname)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: getSafeDispatcher(),\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","buildBlockedFetchError","hostname","Error","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","options","callback","err","address","family","ips","Array","isArray","map","a","some","safeDispatcher","getSafeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,yBAAyB,CAACC,WAC9B,IAAIC,MACF,CAAC,0BAA0B,EAAED,SAAS,uDAAuD,CAAC,GAC5F,CAAC,kGAAkG,CAAC,GACpG,CAAC,8DAA8D,CAAC;AAGtE,MAAME,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACT,OAAOU,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBX,OAAOY,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACT,UAAUU,SAASC;IAChEb,0BAA0BL,MAAM,CAACO,UAAUU,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAACjB,KAAO,CAACD,SAASC,MAAM;gBACnCQ,SAASZ,uBAAuBC,WAAWa,SAASC;gBACpD;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,IAAIO;AAEJ,MAAMC,oBAAoB;IACxB,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,IAAI1B,MAAM;YAAE4B,SAAS;gBAAE9B,QAAQgB;YAAsB;QAAE;IAC1E;IACA,OAAOY;AACT;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAehB,QAAQ,GAAGe;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAI1B,WAAW2B,IAAI3B,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAAS6B,UAAU,CAAC,QAAQ7B,SAAS8B,QAAQ,CAAC,MAAM;YACtD9B,WAAWA,SAAS+B,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAIrC,OAAOU,OAAO,CAACJ,WAAW;YAC5B,IAAI,CAACE,SAASF,WAAW;gBACvB,MAAMD,uBAAuBC;YAC/B;QACF;QACA,OAAQ,MAAMH,YAAY8B,KAAK;YAC7B,GAAGjB,OAAO;YACVsB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBjC,OAAO;YAC1B,IAAIiC,MAAMC,KAAK,YAAYlC,SAASiC,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIpC,MAAMiC,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAI1B,MAAM,CAAC,qBAAqB,EAAEqC,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}

package/dist/uploads/sanitizeUploadData.d.ts

@@ -0,0 +1,26 @@
+import type { FlattenedField } from '../fields/config/types.js';
+type Operation = 'create' | 'update';
+export type ExternalUploadSource = {
+    filename: string;
+    url: string;
+};
+type UploadDataOptions = {
+    locale?: string;
+    localizedProperties?: Set<string>;
+};
+export declare const getExternalUploadSource: (data: unknown) => ExternalUploadSource | undefined;
+export declare const getUploadDestination: ({ data, file, }: {
+    data: unknown;
+    file: {
+        uploadReference?: unknown;
+    } | null | undefined;
+}) => {
+    objectKey?: string;
+    prefix?: string;
+};
+export declare const getLocalizedUploadProperties: (fields: FlattenedField[]) => Set<string>;
+export declare const sanitizeUploadData: <T>(data: T, operation: Operation) => T;
+export declare const mergeUploadDataWithDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export declare const restoreUploadDataFromDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export {};
+//# sourceMappingURL=sanitizeUploadData.d.ts.map

package/dist/uploads/sanitizeUploadData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeUploadData.d.ts","sourceRoot":"","sources":["../../src/uploads/sanitizeUploadData.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,KAAK,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEpC,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,KAAK,iBAAiB,GAAG;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAClC,CAAA;AAQD,eAAO,MAAM,uBAAuB,SAAU,OAAO,KAAG,oBAAoB,GAAG,SAS9E,CAAA;AAKD,eAAO,MAAM,oBAAoB,oBAG9B;IACD,IAAI,EAAE,OAAO,CAAA;IACb,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CACvD,KAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAoBxC,CAAA;AAcD,eAAO,MAAM,4BAA4B,WAAY,cAAc,EAAE,KAAG,GAAG,CAAC,MAAM,CAUjF,CAAA;AAqBD,eAAO,MAAM,kBAAkB,GAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,KAAG,CA4BrE,CAAA;AAQD,eAAO,MAAM,2BAA2B,GAAI,CAAC,QACrC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CA8BF,CAAA;AAiBD,eAAO,MAAM,6BAA6B,GAAI,CAAC,QACvC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CAeF,CAAA"}

package/dist/uploads/sanitizeUploadData.js

@@ -0,0 +1,161 @@
+import path from 'path';
+import { APIError } from '../errors/APIError.js';
+const hasOwnProperty = (value, key)=>Object.prototype.hasOwnProperty.call(value, key);
+const isRecord = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+export const getExternalUploadSource = (data)=>{
+    if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {
+        return undefined;
+    }
+    return {
+        filename: data.filename,
+        url: data.url
+    };
+};
+// Resolves the server-owned upload destination for a document write. For provider uploads the
+// prefix and key segment come from the verified upload reference; for server uploads (including
+// staged uploads) the prefix falls back to the submitted document data and there is no key segment.
+export const getUploadDestination = ({ data, file })=>{
+    if (!file) {
+        return {};
+    }
+    const submittedPrefix = isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined;
+    const { uploadReference } = file;
+    // A staged upload only identifies server-owned temporary bytes, so its final destination still
+    // comes from the accompanying document data, the same as a plain server upload.
+    if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {
+        return {
+            prefix: submittedPrefix
+        };
+    }
+    return {
+        objectKey: typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,
+        prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined
+    };
+};
+const getDocumentProperty = (document, property, { locale, localizedProperties })=>{
+    const value = document[property];
+    return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value;
+};
+// Accepts flattened fields so localized identity fields declared inside presentational
+// containers (row/collapsible/unnamed tabs) are still detected — those live at the document
+// root data level but are nested in the config tree, so walking `fields` alone would miss them.
+export const getLocalizedUploadProperties = (fields)=>{
+    const localizedProperties = new Set();
+    for (const field of fields){
+        if ('name' in field && field.localized) {
+            localizedProperties.add(field.name);
+        }
+    }
+    return localizedProperties;
+};
+// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to
+// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string
+// values are ignored here because they are removed by the caller anyway.
+const validateFilename = (filename)=>{
+    if (typeof filename !== 'string') {
+        return;
+    }
+    const pathSegments = filename.replace(/\\/g, '/').split('/');
+    if (path.posix.isAbsolute(filename) || path.win32.isAbsolute(filename) || pathSegments.includes('..')) {
+        throw new APIError('Invalid filename.', 400);
+    }
+};
+export const sanitizeUploadData = (data, operation)=>{
+    if (!isRecord(data)) {
+        return data;
+    }
+    validateFilename(data.filename);
+    if (isRecord(data.sizes)) {
+        for (const sizeData of Object.values(data.sizes)){
+            if (isRecord(sizeData)) {
+                validateFilename(sizeData.filename);
+            }
+        }
+    }
+    const sanitizedData = {
+        ...data
+    };
+    delete sanitizedData.filename;
+    delete sanitizedData.sizes;
+    delete sanitizedData.url;
+    // Server-owned; never accepted from the caller.
+    delete sanitizedData._objectKey;
+    // On update, `prefix` is restored from the stored document (file identity); kept on create.
+    if (operation === 'update') {
+        delete sanitizedData.prefix;
+    }
+    return sanitizedData;
+};
+// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,
+// `url`, `sizes`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,
+// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`
+// are user-editable crop input, and the rest are regenerated by generateFileData when a file is
+// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full
+// tuple below.
+export const mergeUploadDataWithDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const mergedData = {
+        ...data
+    };
+    for (const property of [
+        '_objectKey',
+        'filename',
+        'prefix',
+        'url'
+    ]){
+        if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {
+            mergedData[property] = getDocumentProperty(document, property, options);
+        }
+    }
+    const documentSizes = getDocumentProperty(document, 'sizes', options);
+    if (!hasOwnProperty(data, 'sizes') && hasOwnProperty(document, 'sizes')) {
+        mergedData.sizes = documentSizes;
+    } else if (isRecord(data.sizes) && isRecord(documentSizes)) {
+        const mergedSizes = {
+            ...documentSizes
+        };
+        for (const [sizeName, sizeData] of Object.entries(data.sizes)){
+            const documentSize = documentSizes[sizeName];
+            mergedSizes[sizeName] = isRecord(sizeData) && isRecord(documentSize) ? {
+                ...documentSize,
+                ...sizeData
+            } : sizeData;
+        }
+        mergedData.sizes = mergedSizes;
+    }
+    return mergedData;
+};
+const uploadDerivedProperties = [
+    '_objectKey',
+    'filename',
+    'filesize',
+    'focalX',
+    'focalY',
+    'height',
+    'mimeType',
+    'prefix',
+    'sizes',
+    'thumbnailURL',
+    'url',
+    'width'
+];
+export const restoreUploadDataFromDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const restoredData = {
+        ...data
+    };
+    for (const property of uploadDerivedProperties){
+        if (hasOwnProperty(document, property)) {
+            restoredData[property] = getDocumentProperty(document, property, options);
+        } else {
+            delete restoredData[property];
+        }
+    }
+    return restoredData;
+};
+
+//# sourceMappingURL=sanitizeUploadData.js.map

package/dist/uploads/sanitizeUploadData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/sanitizeUploadData.ts"],"sourcesContent":["import path from 'path'\n\nimport type { FlattenedField } from '../fields/config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype Operation = 'create' | 'update'\n\nexport type ExternalUploadSource = {\n  filename: string\n  url: string\n}\n\ntype UploadDataOptions = {\n  locale?: string\n  localizedProperties?: Set<string>\n}\n\nconst hasOwnProperty = (value: Record<string, unknown>, key: string): boolean =>\n  Object.prototype.hasOwnProperty.call(value, key)\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nexport const getExternalUploadSource = (data: unknown): ExternalUploadSource | undefined => {\n  if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {\n    return undefined\n  }\n\n  return {\n    filename: data.filename,\n    url: data.url,\n  }\n}\n\n// Resolves the server-owned upload destination for a document write. For provider uploads the\n// prefix and key segment come from the verified upload reference; for server uploads (including\n// staged uploads) the prefix falls back to the submitted document data and there is no key segment.\nexport const getUploadDestination = ({\n  data,\n  file,\n}: {\n  data: unknown\n  file: { uploadReference?: unknown } | null | undefined\n}): { objectKey?: string; prefix?: string } => {\n  if (!file) {\n    return {}\n  }\n\n  const submittedPrefix =\n    isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined\n  const { uploadReference } = file\n\n  // A staged upload only identifies server-owned temporary bytes, so its final destination still\n  // comes from the accompanying document data, the same as a plain server upload.\n  if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {\n    return { prefix: submittedPrefix }\n  }\n\n  return {\n    objectKey:\n      typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,\n    prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined,\n  }\n}\n\nconst getDocumentProperty = (\n  document: Record<string, unknown>,\n  property: string,\n  { locale, localizedProperties }: UploadDataOptions,\n): unknown => {\n  const value = document[property]\n  return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value\n}\n\n// Accepts flattened fields so localized identity fields declared inside presentational\n// containers (row/collapsible/unnamed tabs) are still detected — those live at the document\n// root data level but are nested in the config tree, so walking `fields` alone would miss them.\nexport const getLocalizedUploadProperties = (fields: FlattenedField[]): Set<string> => {\n  const localizedProperties = new Set<string>()\n\n  for (const field of fields) {\n    if ('name' in field && (field as { localized?: boolean }).localized) {\n      localizedProperties.add(field.name)\n    }\n  }\n\n  return localizedProperties\n}\n\n// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to\n// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string\n// values are ignored here because they are removed by the caller anyway.\nconst validateFilename = (filename: unknown): void => {\n  if (typeof filename !== 'string') {\n    return\n  }\n\n  const pathSegments = filename.replace(/\\\\/g, '/').split('/')\n\n  if (\n    path.posix.isAbsolute(filename) ||\n    path.win32.isAbsolute(filename) ||\n    pathSegments.includes('..')\n  ) {\n    throw new APIError('Invalid filename.', 400)\n  }\n}\n\nexport const sanitizeUploadData = <T>(data: T, operation: Operation): T => {\n  if (!isRecord(data)) {\n    return data\n  }\n\n  validateFilename(data.filename)\n\n  if (isRecord(data.sizes)) {\n    for (const sizeData of Object.values(data.sizes)) {\n      if (isRecord(sizeData)) {\n        validateFilename(sizeData.filename)\n      }\n    }\n  }\n\n  const sanitizedData: Record<string, unknown> = { ...data }\n  delete sanitizedData.filename\n  delete sanitizedData.sizes\n  delete sanitizedData.url\n  // Server-owned; never accepted from the caller.\n  delete sanitizedData._objectKey\n\n  // On update, `prefix` is restored from the stored document (file identity); kept on create.\n  if (operation === 'update') {\n    delete sanitizedData.prefix\n  }\n\n  return sanitizedData as T\n}\n\n// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,\n// `url`, `sizes`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,\n// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`\n// are user-editable crop input, and the rest are regenerated by generateFileData when a file is\n// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full\n// tuple below.\nexport const mergeUploadDataWithDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const mergedData: Record<string, unknown> = { ...data }\n\n  for (const property of ['_objectKey', 'filename', 'prefix', 'url']) {\n    if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {\n      mergedData[property] = getDocumentProperty(document, property, options)\n    }\n  }\n\n  const documentSizes = getDocumentProperty(document, 'sizes', options)\n  if (!hasOwnProperty(data, 'sizes') && hasOwnProperty(document, 'sizes')) {\n    mergedData.sizes = documentSizes\n  } else if (isRecord(data.sizes) && isRecord(documentSizes)) {\n    const mergedSizes: Record<string, unknown> = { ...documentSizes }\n\n    for (const [sizeName, sizeData] of Object.entries(data.sizes)) {\n      const documentSize = documentSizes[sizeName]\n\n      mergedSizes[sizeName] =\n        isRecord(sizeData) && isRecord(documentSize) ? { ...documentSize, ...sizeData } : sizeData\n    }\n\n    mergedData.sizes = mergedSizes\n  }\n\n  return mergedData as T\n}\n\nconst uploadDerivedProperties = [\n  '_objectKey',\n  'filename',\n  'filesize',\n  'focalX',\n  'focalY',\n  'height',\n  'mimeType',\n  'prefix',\n  'sizes',\n  'thumbnailURL',\n  'url',\n  'width',\n] as const\n\nexport const restoreUploadDataFromDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const restoredData: Record<string, unknown> = { ...data }\n  for (const property of uploadDerivedProperties) {\n    if (hasOwnProperty(document, property)) {\n      restoredData[property] = getDocumentProperty(document, property, options)\n    } else {\n      delete restoredData[property]\n    }\n  }\n\n  return restoredData as T\n}\n"],"names":["path","APIError","hasOwnProperty","value","key","Object","prototype","call","isRecord","Array","isArray","getExternalUploadSource","data","filename","url","undefined","getUploadDestination","file","submittedPrefix","prefix","uploadReference","objectKey","_objectKey","getDocumentProperty","document","property","locale","localizedProperties","has","getLocalizedUploadProperties","fields","Set","field","localized","add","name","validateFilename","pathSegments","replace","split","posix","isAbsolute","win32","includes","sanitizeUploadData","operation","sizes","sizeData","values","sanitizedData","mergeUploadDataWithDocument","options","mergedData","documentSizes","mergedSizes","sizeName","entries","documentSize","uploadDerivedProperties","restoreUploadDataFromDocument","restoredData"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,MAAMC,iBAAiB,CAACC,OAAgCC,MACtDC,OAAOC,SAAS,CAACJ,cAAc,CAACK,IAAI,CAACJ,OAAOC;AAE9C,MAAMI,WAAW,CAACL,QAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACM,MAAMC,OAAO,CAACP;AAEhE,OAAO,MAAMQ,0BAA0B,CAACC;IACtC,IAAI,CAACJ,SAASI,SAAS,OAAOA,KAAKC,QAAQ,KAAK,YAAY,OAAOD,KAAKE,GAAG,KAAK,UAAU;QACxF,OAAOC;IACT;IAEA,OAAO;QACLF,UAAUD,KAAKC,QAAQ;QACvBC,KAAKF,KAAKE,GAAG;IACf;AACF,EAAC;AAED,8FAA8F;AAC9F,gGAAgG;AAChG,oGAAoG;AACpG,OAAO,MAAME,uBAAuB,CAAC,EACnCJ,IAAI,EACJK,IAAI,EAIL;IACC,IAAI,CAACA,MAAM;QACT,OAAO,CAAC;IACV;IAEA,MAAMC,kBACJV,SAASI,SAAS,OAAOA,KAAKO,MAAM,KAAK,WAAWP,KAAKO,MAAM,GAAGJ;IACpE,MAAM,EAAEK,eAAe,EAAE,GAAGH;IAE5B,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,CAACT,SAASY,oBAAoB,cAAcA,iBAAiB;QAC/D,OAAO;YAAED,QAAQD;QAAgB;IACnC;IAEA,OAAO;QACLG,WACE,OAAOD,gBAAgBE,UAAU,KAAK,WAAWF,gBAAgBE,UAAU,GAAGP;QAChFI,QAAQ,OAAOC,gBAAgBD,MAAM,KAAK,WAAWC,gBAAgBD,MAAM,GAAGJ;IAChF;AACF,EAAC;AAED,MAAMQ,sBAAsB,CAC1BC,UACAC,UACA,EAAEC,MAAM,EAAEC,mBAAmB,EAAqB;IAElD,MAAMxB,QAAQqB,QAAQ,CAACC,SAAS;IAChC,OAAOC,UAAUC,qBAAqBC,IAAIH,aAAajB,SAASL,SAASA,KAAK,CAACuB,OAAO,GAAGvB;AAC3F;AAEA,uFAAuF;AACvF,4FAA4F;AAC5F,gGAAgG;AAChG,OAAO,MAAM0B,+BAA+B,CAACC;IAC3C,MAAMH,sBAAsB,IAAII;IAEhC,KAAK,MAAMC,SAASF,OAAQ;QAC1B,IAAI,UAAUE,SAAS,AAACA,MAAkCC,SAAS,EAAE;YACnEN,oBAAoBO,GAAG,CAACF,MAAMG,IAAI;QACpC;IACF;IAEA,OAAOR;AACT,EAAC;AAED,8FAA8F;AAC9F,4FAA4F;AAC5F,yEAAyE;AACzE,MAAMS,mBAAmB,CAACvB;IACxB,IAAI,OAAOA,aAAa,UAAU;QAChC;IACF;IAEA,MAAMwB,eAAexB,SAASyB,OAAO,CAAC,OAAO,KAAKC,KAAK,CAAC;IAExD,IACEvC,KAAKwC,KAAK,CAACC,UAAU,CAAC5B,aACtBb,KAAK0C,KAAK,CAACD,UAAU,CAAC5B,aACtBwB,aAAaM,QAAQ,CAAC,OACtB;QACA,MAAM,IAAI1C,SAAS,qBAAqB;IAC1C;AACF;AAEA,OAAO,MAAM2C,qBAAqB,CAAIhC,MAASiC;IAC7C,IAAI,CAACrC,SAASI,OAAO;QACnB,OAAOA;IACT;IAEAwB,iBAAiBxB,KAAKC,QAAQ;IAE9B,IAAIL,SAASI,KAAKkC,KAAK,GAAG;QACxB,KAAK,MAAMC,YAAY1C,OAAO2C,MAAM,CAACpC,KAAKkC,KAAK,EAAG;YAChD,IAAItC,SAASuC,WAAW;gBACtBX,iBAAiBW,SAASlC,QAAQ;YACpC;QACF;IACF;IAEA,MAAMoC,gBAAyC;QAAE,GAAGrC,IAAI;IAAC;IACzD,OAAOqC,cAAcpC,QAAQ;IAC7B,OAAOoC,cAAcH,KAAK;IAC1B,OAAOG,cAAcnC,GAAG;IACxB,gDAAgD;IAChD,OAAOmC,cAAc3B,UAAU;IAE/B,4FAA4F;IAC5F,IAAIuB,cAAc,UAAU;QAC1B,OAAOI,cAAc9B,MAAM;IAC7B;IAEA,OAAO8B;AACT,EAAC;AAED,6FAA6F;AAC7F,6FAA6F;AAC7F,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,eAAe;AACf,OAAO,MAAMC,8BAA8B,CACzCtC,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMwC,aAAsC;QAAE,GAAGxC,IAAI;IAAC;IAEtD,KAAK,MAAMa,YAAY;QAAC;QAAc;QAAY;QAAU;KAAM,CAAE;QAClE,IAAI,CAACvB,eAAeU,MAAMa,aAAavB,eAAesB,UAAUC,WAAW;YACzE2B,UAAU,CAAC3B,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACjE;IACF;IAEA,MAAME,gBAAgB9B,oBAAoBC,UAAU,SAAS2B;IAC7D,IAAI,CAACjD,eAAeU,MAAM,YAAYV,eAAesB,UAAU,UAAU;QACvE4B,WAAWN,KAAK,GAAGO;IACrB,OAAO,IAAI7C,SAASI,KAAKkC,KAAK,KAAKtC,SAAS6C,gBAAgB;QAC1D,MAAMC,cAAuC;YAAE,GAAGD,aAAa;QAAC;QAEhE,KAAK,MAAM,CAACE,UAAUR,SAAS,IAAI1C,OAAOmD,OAAO,CAAC5C,KAAKkC,KAAK,EAAG;YAC7D,MAAMW,eAAeJ,aAAa,CAACE,SAAS;YAE5CD,WAAW,CAACC,SAAS,GACnB/C,SAASuC,aAAavC,SAASiD,gBAAgB;gBAAE,GAAGA,YAAY;gBAAE,GAAGV,QAAQ;YAAC,IAAIA;QACtF;QAEAK,WAAWN,KAAK,GAAGQ;IACrB;IAEA,OAAOF;AACT,EAAC;AAED,MAAMM,0BAA0B;IAC9B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,gCAAgC,CAC3C/C,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMgD,eAAwC;QAAE,GAAGhD,IAAI;IAAC;IACxD,KAAK,MAAMa,YAAYiC,wBAAyB;QAC9C,IAAIxD,eAAesB,UAAUC,WAAW;YACtCmC,YAAY,CAACnC,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACnE,OAAO;YACL,OAAOS,YAAY,CAACnC,SAAS;QAC/B;IACF;IAEA,OAAOmC;AACT,EAAC"}

package/dist/uploads/stagedUpload.d.ts

@@ -0,0 +1,27 @@
+import type { PayloadHandler } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { File, UploadInstructions, UploadInstructionsRequest } from './types.js';
+/**
+ * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value
+ * is later passed to a document create or update request.
+ */
+export declare const generateStagedUploadInstructions: ({ collectionSlug, docPrefix, filename, filesize, mimeType, req, }: {
+    req: PayloadRequest;
+} & UploadInstructionsRequest) => Promise<UploadInstructions>;
+/**
+ * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only
+ * becomes available when its size exactly matches the size in the upload ID.
+ */
+export declare const uploadStagedFile: PayloadHandler;
+/** Removes a temporary upload that the client no longer needs. */
+export declare const deleteStagedFile: PayloadHandler;
+/**
+ * Loads a completed staged file for a document request. Only the same user and collection can use
+ * it, and the temporary file is deleted after it is read.
+ */
+export declare const getStagedFile: ({ collectionSlug, req, uploadReference, }: {
+    collectionSlug: string;
+    req: PayloadRequest;
+    uploadReference: unknown;
+}) => Promise<File>;
+//# sourceMappingURL=stagedUpload.d.ts.map

package/dist/uploads/stagedUpload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stagedUpload.d.ts","sourceRoot":"","sources":["../../src/uploads/stagedUpload.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAOrF;;;GAGG;AACH,eAAO,MAAM,gCAAgC,sEAO1C;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CAsClF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA0D9B,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,cAO9B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,8CAIvB;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,EAAE,OAAO,CAAA;CACzB,KAAG,OAAO,CAAC,IAAI,CAyCf,CAAA"}